Legitimate contractors are indistinguishable from a courier pretext — what do you recommend to a facilities manager who owns no network?

## The chair you are speaking from This is the debrief after an authorised physical assessment, and the person across the table owns the building. Their charter has no network in it and no hosts. They own the front desk rota, the goods door, the visitor process, the contracts with the cleaning and maintenance firms, and a budget measured against throughput and staff hours. If the recommendation arrives in security's vocabulary, it will be received politely and never implemented — not because the manager disagrees, but because nothing in it maps to anything they control. ## Why the finding is genuinely hard The uncomfortable centre of this debrief is that the assessor and the real contractor performed the *same actions*. Both arrived at the goods door with a work order, both wore the right clothing, both gave a company name, both were let through, both were plausibly escorted for part of the visit. There is no observable feature that separated them. Any recommendation that asks a person at the door to tell them apart is asking for something the situation does not contain, and it will fail in a way that lands on the individual who was on shift. So the recommendation has to move the decision to a place where an asymmetry still exists. There is exactly one: **a genuine visit was requested by somebody inside the organisation, and a pretext visit was not.** ## The three things worth recommending **1. Verify the visit, not the visitor.** The front desk should be checking an expected-visits list the site itself raised, and where a visit is not on it, contacting the named internal requester through an internally held number. The critical detail — and the one that gets lost when this becomes a procedure document — is that the verification must never use a contact detail supplied by the visitor or printed on their paperwork. This is one phone call per unexpected visit, not one person per visit, which is why it survives contact with a busy morning. **2. Escort where presence is worth something, and nowhere else.** Escorting is the strongest measure and the most expensive; a blanket escort policy is the classic recommendation that is agreed to and then quietly abandoned in week three. Scope it: the areas where being present unlocks something further get an escort to the work and back; the rest do not. That framing lets the manager buy a control at a price they can actually approve. **3. Use the contract, which costs nothing.** Requiring service providers to notify visits in advance, and to name the individuals attending, is a procurement term rather than a physical measure. It is renewed anyway, it costs no capital, and it converts most legitimate visits into entries on the expected list — which is what makes measure one workable rather than a permanent stream of exceptions. ## What not to recommend, and why - **Challenge every unbadged person.** Without a named manager who will back a refusal in public and a guarantee that a wrong refusal is never held against the person who made it, this is asking a junior employee to absorb personal risk. It also collapses under courier volume. - **A signed visitor book.** It records intent to be recorded. Nobody with a pretext hesitates to sign. - **A one-body-per-credential interlock everywhere.** It is the right control at a single choke point and unaffordable across a floor with fire exits, goods entrances and accessibility routes. Present it costed, for one location, or not at all. - **Anything phrased as a network or host risk.** This owner cannot act on it and it makes the rest of the conversation someone else's problem. ## Naming the residual The part that makes this a leadership answer rather than a list is closing the loop explicitly: **after all three measures, an adversary who gets a real appointment booked still gets in.** That is not a failure of the recommendation, it is its boundary, and the owner should accept it knowingly rather than discover it after the next exercise. Write the acceptance down, attach it to the areas it applies to, and put a review date on it. An accepted residual with a named owner is a decision; an unspoken one is a surprise. ## Presenting it without blaming the front desk The person who let the assessor in will be identified within a day whether you name them or not, and if the debrief reads as an accusation, the next assessment is fought rather than used. Frame the finding as a process that asked a person to make a decision it never gave them the information to make: they were handed a stranger, a plausible document and a queue behind him. The fix is that the answer is already in front of them before the visitor speaks. That framing is also what makes measure one persuasive, because it offers the front desk something rather than demanding something.