Skip to content

Disrupting Hostile Reconnaissance

Why and how hostile reconnaissance is conducted, and the principles of how to disrupt threats during the reconnaissance phase, along with practical measures on how to reduce the vulnerability of their site

Last Updated 09 September 2021


Organisations face a variety of threats: terrorists, activists, corporate or state-sponsored spies and criminals. While these threats and their aims may vary, hostiles are united in their desire to succeed. Recognising they may not get a second chance to achieve their aims, hostiles will typically plan carefully. Generally, the more sophisticated the attack, the more complex the attack planning, and consequently the greater the need for specific, current and credible information. 

This information gathering activity can be described as hostile reconnaissance and it is a vital component of the attack planning process. CPNI defines hostile reconnaissance as

Purposeful observation with the intention of collecting information to inform the planning of a hostile act against a specific target. 

The information gathered from people, places and websites is typically used by hostiles to assess the state of security and likelihood of detection; to assess vulnerabilities in security and to assess likelihood of success. These commonalities in information requirements mean that measures put in place to disrupt hostile reconnaissance can be effective over a wide range of threats.

Understanding hostile reconnaissance and the attack planning process gives security managers and staff a crucial opportunity to disrupt the hostile by creating the perception and/or assessment of failure by hostiles in two main ways:

  • denying them the ability to obtain the information they need from their research because they simply cannot obtain it, or they could but the risk of detection to achieve this is too high
  • promoting failure – both of their ability to conduct hostile reconnaissance (they will not be able to get the information, they will be detected) and of the attack itself

These effects can be achieved because in the process of conducting hostile reconnaissance the hostiles are making themselves vulnerable to detection. 

Protective security strategies can therefore be focussed in the following manner to:

  • DENY the hostile the opportunity to gain information
  • DETECT them when they are conducting their reconnaissance
  • DETER them by promoting failure through messaging and physical demonstration of the effective security.

This approach will play on the hostiles’ concerns of failure and detection.

Understanding Hostile Reconnaissance

A critical aspect of detecting and deterring hostile reconnaissance at a site is knowing the threat that you face and understanding where hostiles might conduct their reconnaissance from. This will enable the effective targeting of protective security measures to the area’s most vulnerable to hostile reconnaissance.

CPNI has produced guidance to help organisations understand what hostile reconnaissance is, where it may be conducted and what can be done to deter it, while having a reassuring and recruiting effect on the regular site user.

Guidance also covers utilising existing protective security resources such as CCTV control rooms, security officers and other important resources, such as corporate communications and employees, more effectively to disrupt hostile reconnaissance.

Eyes Wide Open Video

See, Check and Notify

SCaN logoSee, Check and Notify (SCaN) aims to help businesses and organisations maximise safety and security using their existing resources. Your people are your biggest advantage in preventing and tackling a range of threats, including criminal activity, unlawful protest and terrorism. 

SCaN training empowers your staff to correctly identify suspicious activity and know what to do when they encounter it. In addition to this, the skills your staff learn will help them to provide an enhanced customer experience. It helps ensure that individuals or groups seeking to cause your organisation harm are unable to get the information they need to plan their actions.

Action Counters Terrorism

CPNI is proud to support Counter Terrorism Policing’s Action Counters Terrorism (ACT) Campaign which encourages the public to help the police tackle terrorism and save lives by reporting suspicious behaviour and activity. Further information is available on the ACT app and in the Crowded Places Guidance

Did you find this page useful? YesNo
Thank you for your feedback. If you have any further suggestions on how this information can be made even more useful to improve your experience, feel free to share details below.
Thank you for your feedback. Sorry to hear that you haven't found this information useful. Please help us improve your experience and share how we can make this information more useful for you.