Private Security, Critical Infrastructure, Insider Betrayal, Management Risk, and the VOSFIT Model
Private security is supposed to protect people, property, information, facilities, and critical assets. But there is a difficult question that must be asked:
What happens when the security provider itself becomes the vulnerability?
A guard at the entrance does not automatically mean protection. A camera on the wall does not automatically mean accountability. An armored vehicle does not automatically mean secure logistics. A federal contract does not automatically mean integrity. A security uniform does not automatically mean trust.
Security presence and real protection are not the same thing.
The deeper question is this:
Are the assets truly protected, or are they merely being watched by an unverified security structure?
Assets Are Everywhere — And Many Are Critical
Private security does not protect generic assets. It protects assets embedded across the national critical-infrastructure ecosystem.
CISA identifies 16 critical infrastructure sectors whose assets, systems, and networks are so vital that their incapacitation or destruction could have a debilitating effect on national security, economic security, public health, public safety, or a combination of those interests. These sectors include Chemical, Commercial Facilities, Communications, Critical Manufacturing, Dams, Defense Industrial Base, Emergency Services, Energy, Financial Services, Food and Agriculture, Government Facilities, Healthcare and Public Health, Information Technology, Nuclear Reactors/Materials/Waste, Transportation Systems, and Water/Wastewater Systems.
This matters because private security companies may be assigned to protect:
- banks and ATMs;
- hospitals and clinics;
- water facilities;
- power substations;
- telecommunications sites;
- ports and airports;
- government buildings;
- emergency-response locations;
- schools and public facilities;
- food-distribution centers;
- data centers;
- manufacturing plants;
- chemical facilities;
- residential and commercial complexes.
That means a security failure may not remain local. A failure at the wrong site can affect public safety, public health, economic continuity, emergency response, financial operations, or national security.
Puerto Rico’s Private Security Sector Is Not Small
Puerto Rico’s private security sector is large enough to operate as a parallel protective infrastructure. In the San Juan-Bayamón-Caguas metropolitan area alone, BLS reported 23,570 security guards and 10,780 police and sheriff’s patrol officers in May 2024.
These numbers matter. Private security companies may protect banks, malls, residential communities, hospitals, schools, government buildings, federal facilities, public events, ATMs, armored cash routes, ports, airports, and other sensitive spaces.
Private security is not simply a commercial service. It is part of the security environment.
The Real Question
The real question is not:
Is there a guard?
The real question is:
Who protects the protected asset from the security provider?
A security provider may have access to:
- cameras;
- access-control logs;
- visitor records;
- incident reports;
- alarm systems;
- employee movement patterns;
- ATM routes;
- cash-handling schedules;
- restricted areas;
- guard posts;
- facility vulnerabilities;
- police relationships;
- management decisions;
- contract information;
- client vulnerabilities.
If the provider is trustworthy, those functions can support protection. If the provider is compromised, those same functions can support surveillance, intimidation, theft, criminal logistics, suppression of evidence, sabotage, or institutional capture.
The Criticality Gap
Many private security employees are hired for a post, a shift, a route, or a facility. But many may not understand the true criticality of the assets they are protecting.
A guard may think he is protecting a gate. In reality, that gate may control access to a water facility, a hospital, a power substation, a data center, a bank vault, a port area, an airport zone, or a government continuity site.
A camera operator may think she is watching routine footage. In reality, she may be observing movement patterns, emergency-response vulnerabilities, executive schedules, cash movement, or access to restricted infrastructure.
An armored-route employee may think he is moving money. In reality, he may be protecting financial continuity and public trust.
This criticality gap is dangerous. People cannot properly protect what they do not understand.
Private security personnel must understand that their responsibility is not only to show up, wear a uniform, and observe. In many environments, their responsibility is connected to national resilience.
Sabotage and Insider Betrayal
Sabotage does not always look dramatic. It can happen through small acts:
- leaving a door unsecured;
- ignoring an alarm;
- revealing a camera blind spot;
- sharing a patrol schedule;
- delaying a report;
- failing to challenge an unauthorized person;
- mislabeling an incident;
- deleting or withholding footage;
- giving route information to outsiders;
- allowing unauthorized access;
- coordinating with criminal actors.
Insider betrayal is even more serious. It happens when the person entrusted to protect the asset uses that access against the asset.
In private security, betrayal may involve:
- selling information;
- leaking access patterns;
- assisting criminals;
- enabling drug trafficking or arms movement;
- intimidating witnesses;
- tracking individuals;
- suppressing complaints;
- facilitating unauthorized surveillance;
- protecting illicit activity;
- manipulating incident records;
- exploiting police relationships;
- using the uniform as cover.
A private security employee who betrays the mission is not merely a bad employee. In a critical-infrastructure context, that person may become an adversarial node.
The Risk Is Not Only the Guard — It Is Also Management
When people think about insider threat, they often imagine the individual guard, camera operator, driver, technician, or employee who betrays the organization. That is important, but incomplete.
The risk is not only at the bottom. It can also be at the top.
In private security, management controls the system. Owners, executives, managers, supervisors, and contract administrators decide who is hired, where guards are assigned, what post orders say, how incidents are reported, what gets escalated, what gets ignored, who gets disciplined, who keeps working, and who maintains relationships with clients, police, politicians, and procurement officials.
A compromised guard can create a security breach.
A compromised manager can create a security architecture for abuse.
That is why private security risk must be assessed at three levels:
- Individual level: guards, armed personnel, camera operators, drivers, investigators, technicians.
- Management level: supervisors, managers, executives, owners, compliance officers, contract administrators.
- Network level: politicians, police contacts, procurement officials, subcontractors, criminal actors, and affiliated entities.
If management is compromised, the organization may not merely fail to protect the asset. It may become the mechanism through which the asset is exposed.
When Security, Politics, and Criminal Activity Intersect
This issue must be discussed carefully, but it cannot be ignored. There are documented cases showing that private security functions, law-enforcement proximity, security-access roles, and narcotrafficking can intersect.
DOJ reported a Puerto Rico case in which a former private security guard was convicted for providing security for a drug transaction. According to DOJ, the individual was employed as a private security guard, posed as a Puerto Rico police officer during the transaction, and was brought into the scheme by a co-defendant who was a Puerto Rico police officer.
That case shows the danger clearly: a person with security training, a security role, police identity confusion, and armed capability can become useful to a drug-trafficking operation.
DOJ also reported a Puerto Rico airport cocaine-smuggling case involving current and former TSA and airport employees. The investigation involved TSA, DEA, ICE-HSI, FBI, U.S. Marshals, and the Puerto Rico Police. The case demonstrates how security-access positions inside transportation infrastructure can become narcotrafficking enablers.
These cases do not prove that every security company is corrupt. They do prove that the risk model is real.
The pathway is clear:
security role → access → law-enforcement proximity → political exposure → criminal exploitation.
That is why private security must be analyzed as a national-security issue, especially when companies protect or access critical infrastructure.
The Protector Can Become the Attack Surface
A security contractor becomes dangerous when it controls too much of the security picture without enough oversight.
For example:
- guards observe who enters and exits;
- cameras record behavior;
- access systems track movement;
- incident reports define what “officially happened”;
- armored routes reveal where money moves;
- supervisors decide what gets escalated;
- management decides what gets hidden;
- law-enforcement relationships can influence how complaints are handled;
- political relationships can influence how contracts are preserved.
If those functions are compromised, the security layer becomes an attack surface.
The asset may be guarded, but not protected.
Why This Is a National-Security Issue
Private security becomes national-security relevant when it touches the 16 critical infrastructure sectors.
A compromised security provider can expose people, facilities, routes, schedules, vulnerabilities, evidence, and response patterns. It can also provide institutional cover for criminal actors.
A compromised guard at a commercial facility may create public-safety risk. A compromised guard at a bank may create financial-security risk. A compromised guard at a hospital may create public-health risk. A compromised guard at a water facility may create public-safety risk. A compromised guard at a port or airport may create transportation-security risk. A compromised guard at a government facility may create continuity-of-government risk. A compromised guard at an IT or data facility may create cyber-physical risk. A compromised manager can multiply all of those risks by controlling assignments, reports, evidence, and contract relationships.
That is why the integrity of the security company must be treated as part of the protected asset.
Applying the VOSFIT Model
The VOSFIT Model provides a disciplined way to assess this problem.
VOSFIT stands for:
Vulnerabilities, Origins, Strategies, Functions, Intention, and Time Frame.
It helps avoid unsupported accusations by forcing the analyst to map the actual risk structure.
Vulnerabilities
The vulnerabilities include weak visibility into private security rosters, limited public statistics on police/private-security overlap, opaque ownership, insufficient disciplinary screening, weak procurement review, overdependence on large security contractors, management opacity, and lack of critical-infrastructure training.
A major vulnerability appears when the same provider controls guards, cameras, access logs, alarms, incident reports, armored logistics, and management reporting.
Origins
The risk may originate from private security agencies, active police, former police, expelled or disciplined law-enforcement personnel, municipal police, corrections officers, political actors, criminal organizations, weak licensing, procurement gaps, owners, executives, managers, subcontractors, and critical-infrastructure owners who outsource protection without sufficient vendor-integrity controls.
The origin does not prove guilt. It identifies where risk may enter the system.
Strategies
A compromised actor may use security employment as cover. That actor may exploit uniforms, armed posts, access badges, camera rooms, guard reports, police relationships, political relationships, or procurement legitimacy.
At the management level, strategies may include assigning trusted insiders to sensitive posts, suppressing incident reports, controlling surveillance footage, using political relationships, hiding behind subcontractors, or normalizing risk through long-term contracts.
A security company can also become embedded over time, making institutions dependent on it.
Functions
The functions are concrete:
- armed guarding;
- camera monitoring;
- access control;
- alarm response;
- incident reporting;
- private investigation;
- armored transport;
- ATM servicing;
- cash logistics;
- federal facility protection;
- prison-adjacent access;
- critical-infrastructure site protection;
- guard assignment;
- management reporting;
- contract administration;
- client communication;
- law-enforcement coordination.
These functions show what the security provider can actually do.
Intention
Intention must be inferred carefully. A company may intend lawful protection. But a compromised actor inside the system may intend unauthorized surveillance, intimidation, theft, criminal protection, sabotage, cash-route intelligence, concealment, or procurement influence.
VOSFIT does not assume intention. It evaluates intention through evidence.
Time Frame
Time frame matters because risk develops over time. Analysts must ask:
- When was the company contracted?
- Who was assigned?
- Who supervised the assignment?
- Who managed the contract?
- Who had camera access?
- Who had access-control authority?
- Who filed reports?
- Who reviewed those reports?
- What incidents occurred?
- What complaints were made?
- Were former police or disciplined officers involved?
- Were criminal cases or corruption signals present during the contract period?
- What critical-infrastructure sector was involved?
- What would have happened if the asset failed?
Without time frame, the analysis becomes speculation. With time frame, the pattern can be tested.
What Should Be Done
Puerto Rico needs a formal private-security integrity review tied directly to the 16 critical infrastructure sectors.
The review should answer:
- Which private security companies employ active or former police officers?
- Which companies employ expelled, terminated, suspended, or disciplined former officers?
- Which companies hold federal, Commonwealth, municipal, banking, prison, airport, port, utility, hospital, school, or critical-infrastructure contracts?
- Which companies control cameras, access logs, armed posts, cash routes, or sensitive facilities?
- Which companies have corruption, narcotrafficking, weapons, theft, extortion, sabotage, or organized-crime exposure?
- Which owners, executives, managers, or supervisors present political, criminal, or conflict-of-interest concerns?
- Which companies train their personnel on the criticality of the assets they protect?
- Which companies require enhanced due diligence, suspension review, debarment review, or law-enforcement referral?
The objective is not to attack legitimate companies. The objective is to identify compromised risk nodes before they harm people, institutions, public trust, or national security.
The Core Message
An asset is not protected merely because someone is guarding it.
An asset is protected only when the security provider is trustworthy, vetted, audited, accountable, trained, and separated from criminal, political, or conflicted control.
The strongest national-security principle is this:
A compromised security contractor can convert protective infrastructure into adversarial infrastructure.
That is why private security must be assessed with the same seriousness as any other critical security function. The integrity of the security provider is not external to the asset. It is part of the asset’s protection.
The VOSFIT Model gives us the tool to make that assessment carefully:
What is vulnerable? Where did the risk originate? What strategies are visible? What functions are available? What intention can be inferred? Over what time frame did the pattern develop?
That is how we determine whether the assets are truly protected — or merely watched by the wrong hands.
Are the Assets Really Protected?
Private Security, Critical Infrastructure, Insider Betrayal, Management Risk, and the VOSFIT Model
Private Security, Critical Infrastructure, Insider Betrayal, Management Risk, and the VOSFIT Model
Private security is supposed to protect people, property, information, facilities, and critical assets. But there is a difficult question that must be asked:
What happens when the security provider itself becomes the vulnerability?
A guard at the entrance does not automatically mean protection. A camera on the wall does not automatically mean accountability. An armored vehicle does not automatically mean secure logistics. A federal contract does not automatically mean integrity. A security uniform does not automatically mean trust.
Security presence and real protection are not the same thing.
The deeper question is this:
Are the assets truly protected, or are they merely being watched by an unverified security structure?
Assets Are Everywhere — And Many Are Critical
Private security does not protect generic assets. It protects assets embedded across the national critical-infrastructure ecosystem.
CISA identifies 16 critical infrastructure sectors whose assets, systems, and networks are so vital that their incapacitation or destruction could have a debilitating effect on national security, economic security, public health, public safety, or a combination of those interests. These sectors include Chemical, Commercial Facilities, Communications, Critical Manufacturing, Dams, Defense Industrial Base, Emergency Services, Energy, Financial Services, Food and Agriculture, Government Facilities, Healthcare and Public Health, Information Technology, Nuclear Reactors/Materials/Waste, Transportation Systems, and Water/Wastewater Systems.
This matters because private security companies may be assigned to protect:
That means a security failure may not remain local. A failure at the wrong site can affect public safety, public health, economic continuity, emergency response, financial operations, or national security.
Puerto Rico’s Private Security Sector Is Not Small
Puerto Rico’s private security sector is large enough to operate as a parallel protective infrastructure. In the San Juan-Bayamón-Caguas metropolitan area alone, BLS reported 23,570 security guards and 10,780 police and sheriff’s patrol officers in May 2024.
These numbers matter. Private security companies may protect banks, malls, residential communities, hospitals, schools, government buildings, federal facilities, public events, ATMs, armored cash routes, ports, airports, and other sensitive spaces.
Private security is not simply a commercial service. It is part of the security environment.
The Real Question
The real question is not:
Is there a guard?
The real question is:
Who protects the protected asset from the security provider?
A security provider may have access to:
If the provider is trustworthy, those functions can support protection. If the provider is compromised, those same functions can support surveillance, intimidation, theft, criminal logistics, suppression of evidence, sabotage, or institutional capture.
The Criticality Gap
Many private security employees are hired for a post, a shift, a route, or a facility. But many may not understand the true criticality of the assets they are protecting.
A guard may think he is protecting a gate. In reality, that gate may control access to a water facility, a hospital, a power substation, a data center, a bank vault, a port area, an airport zone, or a government continuity site.
A camera operator may think she is watching routine footage. In reality, she may be observing movement patterns, emergency-response vulnerabilities, executive schedules, cash movement, or access to restricted infrastructure.
An armored-route employee may think he is moving money. In reality, he may be protecting financial continuity and public trust.
This criticality gap is dangerous. People cannot properly protect what they do not understand.
Private security personnel must understand that their responsibility is not only to show up, wear a uniform, and observe. In many environments, their responsibility is connected to national resilience.
Sabotage and Insider Betrayal
Sabotage does not always look dramatic. It can happen through small acts:
Insider betrayal is even more serious. It happens when the person entrusted to protect the asset uses that access against the asset.
In private security, betrayal may involve:
A private security employee who betrays the mission is not merely a bad employee. In a critical-infrastructure context, that person may become an adversarial node.
The Risk Is Not Only the Guard — It Is Also Management
When people think about insider threat, they often imagine the individual guard, camera operator, driver, technician, or employee who betrays the organization. That is important, but incomplete.
The risk is not only at the bottom. It can also be at the top.
In private security, management controls the system. Owners, executives, managers, supervisors, and contract administrators decide who is hired, where guards are assigned, what post orders say, how incidents are reported, what gets escalated, what gets ignored, who gets disciplined, who keeps working, and who maintains relationships with clients, police, politicians, and procurement officials.
A compromised guard can create a security breach.
A compromised manager can create a security architecture for abuse.
That is why private security risk must be assessed at three levels:
If management is compromised, the organization may not merely fail to protect the asset. It may become the mechanism through which the asset is exposed.
When Security, Politics, and Criminal Activity Intersect
This issue must be discussed carefully, but it cannot be ignored. There are documented cases showing that private security functions, law-enforcement proximity, security-access roles, and narcotrafficking can intersect.
DOJ reported a Puerto Rico case in which a former private security guard was convicted for providing security for a drug transaction. According to DOJ, the individual was employed as a private security guard, posed as a Puerto Rico police officer during the transaction, and was brought into the scheme by a co-defendant who was a Puerto Rico police officer.
That case shows the danger clearly: a person with security training, a security role, police identity confusion, and armed capability can become useful to a drug-trafficking operation.
DOJ also reported a Puerto Rico airport cocaine-smuggling case involving current and former TSA and airport employees. The investigation involved TSA, DEA, ICE-HSI, FBI, U.S. Marshals, and the Puerto Rico Police. The case demonstrates how security-access positions inside transportation infrastructure can become narcotrafficking enablers.
These cases do not prove that every security company is corrupt. They do prove that the risk model is real.
The pathway is clear:
security role → access → law-enforcement proximity → political exposure → criminal exploitation.
That is why private security must be analyzed as a national-security issue, especially when companies protect or access critical infrastructure.
The Protector Can Become the Attack Surface
A security contractor becomes dangerous when it controls too much of the security picture without enough oversight.
For example:
If those functions are compromised, the security layer becomes an attack surface.
The asset may be guarded, but not protected.
Why This Is a National-Security Issue
Private security becomes national-security relevant when it touches the 16 critical infrastructure sectors.
A compromised security provider can expose people, facilities, routes, schedules, vulnerabilities, evidence, and response patterns. It can also provide institutional cover for criminal actors.
A compromised guard at a commercial facility may create public-safety risk. A compromised guard at a bank may create financial-security risk. A compromised guard at a hospital may create public-health risk. A compromised guard at a water facility may create public-safety risk. A compromised guard at a port or airport may create transportation-security risk. A compromised guard at a government facility may create continuity-of-government risk. A compromised guard at an IT or data facility may create cyber-physical risk. A compromised manager can multiply all of those risks by controlling assignments, reports, evidence, and contract relationships.
That is why the integrity of the security company must be treated as part of the protected asset.
Applying the VOSFIT Model
The VOSFIT Model provides a disciplined way to assess this problem.
VOSFIT stands for:
Vulnerabilities, Origins, Strategies, Functions, Intention, and Time Frame.
It helps avoid unsupported accusations by forcing the analyst to map the actual risk structure.
Vulnerabilities
The vulnerabilities include weak visibility into private security rosters, limited public statistics on police/private-security overlap, opaque ownership, insufficient disciplinary screening, weak procurement review, overdependence on large security contractors, management opacity, and lack of critical-infrastructure training.
A major vulnerability appears when the same provider controls guards, cameras, access logs, alarms, incident reports, armored logistics, and management reporting.
Origins
The risk may originate from private security agencies, active police, former police, expelled or disciplined law-enforcement personnel, municipal police, corrections officers, political actors, criminal organizations, weak licensing, procurement gaps, owners, executives, managers, subcontractors, and critical-infrastructure owners who outsource protection without sufficient vendor-integrity controls.
The origin does not prove guilt. It identifies where risk may enter the system.
Strategies
A compromised actor may use security employment as cover. That actor may exploit uniforms, armed posts, access badges, camera rooms, guard reports, police relationships, political relationships, or procurement legitimacy.
At the management level, strategies may include assigning trusted insiders to sensitive posts, suppressing incident reports, controlling surveillance footage, using political relationships, hiding behind subcontractors, or normalizing risk through long-term contracts.
A security company can also become embedded over time, making institutions dependent on it.
Functions
The functions are concrete:
These functions show what the security provider can actually do.
Intention
Intention must be inferred carefully. A company may intend lawful protection. But a compromised actor inside the system may intend unauthorized surveillance, intimidation, theft, criminal protection, sabotage, cash-route intelligence, concealment, or procurement influence.
VOSFIT does not assume intention. It evaluates intention through evidence.
Time Frame
Time frame matters because risk develops over time. Analysts must ask:
Without time frame, the analysis becomes speculation. With time frame, the pattern can be tested.
What Should Be Done
Puerto Rico needs a formal private-security integrity review tied directly to the 16 critical infrastructure sectors.
The review should answer:
The objective is not to attack legitimate companies. The objective is to identify compromised risk nodes before they harm people, institutions, public trust, or national security.
The Core Message
An asset is not protected merely because someone is guarding it.
An asset is protected only when the security provider is trustworthy, vetted, audited, accountable, trained, and separated from criminal, political, or conflicted control.
The strongest national-security principle is this:
A compromised security contractor can convert protective infrastructure into adversarial infrastructure.
That is why private security must be assessed with the same seriousness as any other critical security function. The integrity of the security provider is not external to the asset. It is part of the asset’s protection.
The VOSFIT Model gives us the tool to make that assessment carefully:
What is vulnerable? Where did the risk originate? What strategies are visible? What functions are available? What intention can be inferred? Over what time frame did the pattern develop?
That is how we determine whether the assets are truly protected — or merely watched by the wrong hands.
About the Author
Eduardo Meléndez Jr. (Santiago), PhD
Founder, CEO, President & Principal Investigator, ITAICS LLC · NCAE-C Scholar
Eduardo Meléndez Jr. (Santiago), PhD, leads ITAICS LLC and ITAICS Research. His research and technical work span cybersecurity, artificial intelligence, security science, critical infrastructure, global supply chains, advanced persistent threats, and the analysis of complex adversarial systems. He directs the continuing development of the VOSFIT research program, including work on vulnerabilities, origins, strategies, functions, intentions, time, critical-infrastructure dependencies, and resilient system states.
His work also includes applied research, technical education, workforce development, cyber-defense modeling, and the translation of formal analytical methods into practical security and resilience problems. Through ITAICS Research, he contributes research commentaries, Proceedings publications, collaborative research concepts, and public-interest technical analysis intended to connect rigorous security research with operational and societal consequence.