Threat Detection

Warning Signals

Among the first scholars to point out the significance of inadequate threat detection was Barry Turner, with his disaster incubation theory. According to Turner, disasters are caused by the accumulation of events that are at odds with organizational norms about safe operation by a multiplicity of minor causes, misperceptions, misunderstandings, and miscommunications accumulated during the disaster incubation period. These events remain unnoticed because of a range of communication errors, which he identifies as signals known and ignored or distrusted, signals buried or distributed across the organization and hence not collated; and what he calls “organizational exclusivity,” when the organization ignores warnings coming from outsiders.

These signals can be any kind of information (qualitative or quantitative) that indicates a deviation from normalcy and can be interpreted as symptoms or peaks in the development of a crisis. In an organizational context, these can, therefore, be viewed as messages or pieces of information about anomalies (discontinuities) generated by “organizational imperfections” (e.g., failures, breakdowns, errors, incidents, near-accidents, unintentional deviations) in the external (e.g., poor quality of raw materials offered by the organization's suppliers) and/or the internal environment of the organization (e.g., a steady increase of employee absences).

Threat Detection Process

The threat detection process is often understood as involving activities grouped into two categories: (1) activities triggered by a need to define warning signals (identifying potential signals, locating data in these signals, and transmitting the signals) and (2) activities triggered by a need to resolve a potential crisis (interpreting the threat signals, stabilizing the potential crisis, planning a method to avert the crisis, and resolving the crisis). It can therefore be perceived as a multistage dynamic process that aims at the timely scanning for external/internal threat signals, their capture, and their transmission to the organization's incident response center, which, interpreting the information they carry, will decide about potential preventive action.

The threat detection process should have “interim goals” that exist at each stage of the [Page 930]detection process and “eventual outcomes.” The first goal is the creation of a shared understanding about the situation and of a consensus for a commitment to the crisis response activities. The second is the establishment of accountability with regard to these response activities, and the third is the reduction of key organization members’ uncertainty by creating awareness about the emerging crisis. The eventual outcomes of the process will be changes in the organization's core beliefs about its vulnerability to certain threats and in the procedures and structures for threat detection.

...