Businesses of all sizes continue to face complex challenges today, not just from financial burdens and crime, but from hybrid warfare, industrial espionage by state-sponsored competitors, and highly competent activist groups. Over the last 12 months we have seen high-street vandalism, package bombs and arson attacks to name a few different incidents against large organisations including DHL and Barclays Bank.
These aren’t just abstract risks. They are unwelcome disruptions to your core mission: providing jobs, creating value, and staying operational.
While many large organisations have the benefit of robust security departments, internal expertise, and external support networks, small to medium-sized businesses often represent a softer opportunity to threat actors.
So, how can your business, especially if it operates in or around sensitive industries, be better prepared?
Understanding the Threat: A Real-World Case
One example worth examining is the activity of the Palestine Action Group (PAG), formed in 2020 with the explicit goal of disrupting UK-based businesses linked to Israel’s defence industry, particularly those associated with Elbit Systems.
Until recently, PAG has been open about its targets, publishing them online and running training events to prepare volunteers for ‘positive action.’ The result? A wave of incidents across the UK—not just affecting manufacturers, but law firms, logistics firms, accountants, and financial institutions.
Organisations such as Barclays Bank and Instro Precision have been targeted multiple times. In Barclays’ case, activist pressure led to a shift in investment strategy to reduce attacks against its high-street branches.
Could this be your business—directly or indirectly?
Lack of Action Isn’t a Strategy
Understanding the anatomy of threat activity can help businesses better prepare. One proven framework is the Crime Triangle, which outlines three core elements of any successful disruptive action:
Motivation
Opportunity
Ability (or Means)
We look at each through the lens of recent incidents and identify actionable insights you can apply today.
1. Motivation
Why would someone target your business?
In traditional crime, the answer is often financial. But in the case of activist action, ideology plays a major role. Instro Precision, a defence contractor, was openly listed on PAG’s public target list. That made the risk easier to foresee.
But not every business has this visibility. You may be unaware that your products, services, or clients place you in the sights of a determined group.
What you can do:
Conduct an asset analysis to understand what might be appealing or symbolic to different actors.
Identify likely threat actors and assess their motivations.
Carry out a risk assessment based on asset value and exposure.
2. Opportunity
This is an area where your business has strong agency.
Opportunity refers to the access, visibility, or vulnerabilities that enable a threat actor to act. In Instro Precision’s case, activists successfully blockaded entrances using lock-on protests and in one incident, physically breached the perimeter, entered a building, and damaged property.
Watch video footage of the break-in here.
This was the third known action against the same site, highlighting a clear escalation. Even before this point, further measures to reduce access, increase detection, and shorten response time would have been proportionate and advisable.
Practical measures businesses could adopt to reduce opportunity include:
Vehicle patrols to detect suspicious persons or pre-operational reconnaissance activity.
Foot patrols of the perimeter to identify breach attempts or physical tampering early.
Improved physical barriers at vulnerable points
Situational awareness training to prepare teams to spot anomalies before a threat escalates.·
These enhancements could have had a measurable impact:
A mobile patrol may have detected activists before a breach occurred.
Foot patrols might have intervened earlier, preventing access to internal spaces.
A visible security presence may have acted as a deterrent, shifting the group’s focus to a softer target.
The key message: even small adjustments to opportunity can have a large effect on a threat actor’s ability to succeed.
3. Ability
What is your adversary capable of and how can you influence the risk to reward ratio?
PAG, for example, trains individuals in protest strategy, planning, and execution. They're often undeterred by arrest because their goal is not to escape. Instead, it is maximum visibility and disruption.
Looking at the Instro Precision break-in video, we can see that a relatively low level of ability was required to conduct this action, mechanical measures facilitated a breach of the external perimeter and building outer and inner doors. While damage to the premises is unknown, little commercial operational damage was seen. This was likely the intent to protect those who conducted this action, while maximising publicity.
But what if a more malicious threat actor had exploited the same weaknesses? A more capable group could have targeted critical infrastructure such as gas feeds, electrical systems, or data servers to have a severe impact to the business.
Despite the breach, the successful arrest of several individuals at the scene, is indicative of an effective post-incident response being in place, with Kent Police arriving swiftly.
What you can do:
Assess the capabilities and methods of likely threat actors.
Align your security measures proportionately to those capabilities.
Recognise the aims, some actors prioritise impact over escape, changing how you must plan.
Protect Your Business: Key Actions to Consider
Even if your organisation doesn’t seem like an obvious target, if your products or services connect to sensitive sectors, directly or indirectly, you could be exposed to unexpected threats.
Here are some practical, proactive steps to take:
Consult with external specialists to identify unknown threats and risks
Conduct an asset analysis to identify what’s valuable or symbolic.
Profile potential threat actors to understand motivations and tactics.
Undertake a risk assessment that includes protest and ideological threats.
Limit opportunity through access control, surveillance, good design and practices
Increase deterrence with visible patrols, secure perimeters, and active monitoring.
Strengthen detection and response with trained personnel and clear protocols.
Update your business continuity plan to include activist disruption where appropriate
Train your staff to spot signs of pre-incident activity or escalatory incidents.
Monitor the threat landscape, identify and track key indicators that signal increased risk, such as online targeting, local activism, or global events.
Take the First Step Today
You don’t need to be a security expert to take action, but you would be wise to consider the impacts on your business.
At BluSkills, we help businesses like yours build tailored, high-performance security strategies that are discreet, effective, and scalable to your risk environment.
Whether you want to assess your current resilience or build a plan for the future, we’re ready to help.
To speak to a specialist, contact BluSkills today.
Credits:
Header Image credit: Cerib - stock.adobe.com
