Security Intelligence

Case Study: Turning Early Warning Into a Decision Rather Than a Feeling

Eight named indicators, agreed thresholds and three pre-authorised responses, so a deteriorating environment triggered action instead of debate.

By Mowlid Ali 03 Sep 2026 7 min Security Intelligence
Source

Originally reported by INGO ADVISORY. INGO ADVISORY analysis is attributable to our intelligence desk; the underlying reporting remains the property of the publisher.

Read the original publication View all 5 citations
Author
Mowlid Ali
Source
INGO ADVISORY
Publication date
03 Sep 2026
Location
Client locations withheld
Country
Horn of Africa
Category
Security Intelligence
Threat level
SUBSTANTIAL — An attack is likely.
Analytic confidence
High
Verification status
Verified
Listen · 2 minReady to play · about 2 min

Anonymised practitioner case study. The organisation, precise locations and dates are withheld to protect the client and its staff. Internal metrics are not published, and none has been invented in their place.

The client

An organisation operating across several Horn of Africa locations, each with a different deterioration profile, reporting into one regional management team.

The problem

Deterioration was recognised late and argued about long. Managers described conditions as 'getting worse' without agreed evidence, so decisions to reduce footprint or relocate staff were taken under time pressure, usually after an incident rather than before one.

An early-warning system that does not name the response in advance is a newsletter.

The method: indicators, thresholds, pre-authorised responses

  • Selected eight observable indicators per location, not twenty. Each had to be something a field team could see or count weekly without special access.
  • Examples included checkpoint behaviour changes, market price movement on staple goods and fuel, closure of specific services, changes in local staff commuting patterns, and the departure of other organisations.
  • Set two thresholds for each indicator: a watch level and an action level, both defined numerically or behaviourally rather than descriptively.
  • Pre-authorised three graduated responses, reduce movement, reduce non-essential presence, relocate, with the authority to trigger each named in advance.
  • Reviewed indicators fortnightly in a fifteen-minute standing item, so the system did not depend on someone raising a concern.
  • Recorded each review even when nothing had changed, which is what made the trend visible.

What changed

Deterioration became a shared observation rather than a matter of temperament, and the discussion shifted from whether conditions were worsening to whether a threshold had been met. Because responses were pre-authorised, action no longer waited for a meeting. One location's indicators improved, which allowed a reduction in restrictions that would otherwise have persisted by default.

Transferable lessons

  • Few indicators, observed reliably, beat many observed occasionally.
  • Define thresholds in numbers or behaviours, not adjectives.
  • Name the response and the decision-maker before the threshold is crossed.
  • Record 'no change' reviews. The trend is the product.
  • Build the system to relax restrictions as well as impose them.
Africa Risk Brief

Get the weekly Africa Risk Brief

Analysis like this — on security intelligence and Africa's highest-risk operating environments — delivered every Monday. Free.

No spam. Unsubscribe anytime. We never share your email.