Security management · Briefings

A brief is written to be used in a meeting, not read like an article

The same information becomes far more useful when it is structured: one threat-level judgement, facts separated by confidence, an assessment with reasoning, and the operational consequence stated plainly.

Illustrative analytical example — demonstrates method, not operational guidance for a specific organisation.

Briefing structure

Threat level

One UK-scale judgement with its operational meaning stated in full.

Situation

What is confirmed, what is reported and what remains unclear — separated.

Assessment

The analyst's judgement and the reasoning behind it, not a summary of the news.

Operational implications

What this changes for movement, sites, programmes and staff care.

Key indicators

The signals that would raise or lower the assessment.

Recommended monitoring

What the security team should watch, and on what rhythm.

Confidence and sources

Stated confidence level with named, checkable sources.

Security brief

Somalia · Current reporting period

Threat level: SEVEREAn attack is highly likely.

Situation

  • Confirmed: explosive and complex attacks continue to be reported in Banadir, concentrated on arterial roads, government targets and locations with predictable footfall.
  • Reported: checkpoint numbers and informal taxation on inter-city corridors have increased, with transporters describing inconsistent authority at control points.
  • Assessed: security-force transition arrangements are creating short-lived control gaps in districts adjoining main supply routes.

Assessment

  • The pattern of attack remains directed at fixed, predictable targets rather than at humanitarian actors specifically, but proximity exposure is the dominant risk for offices and transfers on arterial roads.
  • Corridor risk is rising faster than urban risk. Illegal taxation and shifting checkpoint authority indicate contested control rather than a single actor exercising it.

Operational implications

  • Airport and arterial transfers should be treated as the highest-exposure routine activity, with timing variation enforced rather than encouraged.
  • Overland movement to the south-west requires day-of-travel route review and a written abort threshold.
  • Site standards — stand-off, access control, safe room, drill rhythm — carry more weight than movement rules alone.

Key indicators

  • Change in attack method or target selection within Banadir districts.
  • Base handovers or checkpoint staffing changes on the Baidoa and Afgooye corridors.
  • Transporter refusals or sudden freight-rate increases on specific segments.

Recommended monitoring

  • Daily: claimed attacks by district; road status on planned corridors.
  • Weekly: checkpoint mapping updates from transporters and partners; access-incident reporting.
  • Monthly: review of the risk register against observed pattern change.

Confidence and sources

Moderate — pattern-level judgement drawn from open sources with consistent reporting, but limited independent verification at district level.

  • · ACLED conflict event data
  • · UN OCHA situation reporting
  • · Insecurity Insight aid-security reporting
  • · Somali national and regional media monitoring
  • · INGO ADVISORY analyst assessment

Security brief

Horn of Africa · Current reporting period

Threat level: SUBSTANTIALAn attack is likely.

Situation

  • Confirmed: conflict and displacement continue across Sudan, with corridor and administrative constraints reported in Darfur and along inland routes from Port Sudan.
  • Reported: access conditions in northern Ethiopia remain administratively conditional, with corridor status changing faster than permit cycles.
  • Assessed: maritime disruption in the Red Sea and Gulf of Aden continues to lengthen supply lead times into inland programmes.

Assessment

  • Regional risk is increasingly driven by access and logistics rather than by direct targeting of aid actors, though staff exposure rises wherever programmes compensate for access loss with additional movement.
  • Political friction between and within states is the most likely near-term source of sudden operational restriction.

Operational implications

  • Supply planning should assume longer lead times and hold explicit buffer stock assumptions.
  • Remote-management arrangements need verification design built in, not retrofitted.
  • Regional movement policy should be reviewed against border and permit volatility, not only against attack data.

Key indicators

  • Border crossing closures or new documentation demands.
  • Front-line movement onto recognised supply corridors.
  • Shipping insurance and rerouting notices affecting regional ports.

Recommended monitoring

  • Daily: corridor and crossing status; incident reporting by country.
  • Weekly: access-constraint reporting and partner suspension notices.
  • Quarterly: regional outlook and register revision.

Confidence and sources

Moderate — regional judgement based on consistent open-source reporting with uneven country-level granularity.

  • · ACLED conflict event data
  • · UN OCHA and HDX regional datasets
  • · IOM displacement tracking
  • · International Crisis Group analysis
  • · INGO ADVISORY analyst assessment

Security brief

Mogadishu & Banadir · Current reporting period

Threat level: SEVEREAn attack is highly likely.

Situation

  • Confirmed: complex and explosive attacks continue to be reported in Banadir, concentrated on government and security targets, hotels used by officials, and locations with predictable footfall.
  • Reported: pressure on the airport road and other arterial routes fluctuates with security-force posture, and transporters describe changeable control at informal checkpoints on the city's outskirts.
  • Assessed: aid and commercial organisations are, in most cases, exposed by proximity and by predictable movement patterns rather than by deliberate targeting.

Assessment

  • The dominant risk to civilian organisations in Mogadishu is being close to a target rather than being the target. That makes location choice, stand-off and unpredictability more protective than any single movement rule.
  • Attack tempo is not a reliable planning signal on its own. Changes in method — where a device is placed, whether an assault follows a breach — matter more for site and movement standards than the number of incidents in a week.

Operational implications

  • Airport and arterial transfers are the highest-exposure routine activity. Timing and routing should vary, and a written abort threshold should sit with the person in the vehicle, not only with the approver.
  • Meetings in hotels and venues used by officials carry inherited risk. Where they cannot be avoided, keep exposure short and confirm the venue's own access control before the visit.
  • Site standards — stand-off, vehicle screening at the gate, safe room, drill rhythm — deserve more management attention than they usually get.

Key indicators

  • Change in attack method or target selection inside Banadir districts.
  • Sustained closure or diversion on the airport road, or new permanent checkpoints.
  • Security-force posture changes around government precincts and hotels.

Recommended monitoring

  • Daily: claimed attacks by district and road status on the routes in use.
  • Weekly: venue and site access-control checks; incident reporting from partners.
  • Monthly: review of movement rules against what actually happened.

Confidence and sources

Moderate — pattern-level judgement from consistent open reporting, with limited independent verification at district level.

  • · ACLED conflict event data
  • · UN OCHA situation reporting
  • · Insecurity Insight aid-security reporting
  • · Somali national and regional media monitoring
  • · INGO ADVISORY analyst assessment

Security brief

Ethiopia · Current reporting period

Threat level: SUBSTANTIALAn attack is likely.

Situation

  • Confirmed: armed conflict and localised insecurity continue to be reported in parts of Amhara and Oromia, with movement restrictions and road closures affecting programme travel.
  • Reported: access into and within northern Ethiopia remains administratively conditional, with permissions and corridor status changing faster than authorisation cycles.
  • Assessed: friction between Ethiopia and its neighbours over sea access and regional alignment continues to shape the political environment rather than the immediate threat picture.

Assessment

  • Ethiopia's principal operational risk is not a single armed actor but the speed at which access can close — through a road, a permit or a communications interruption — while staff are already in the field.
  • Where road movement substitutes for suspended flights or blocked corridors, exposure rises quietly. That substitution is usually a programme decision, not a security one, which is why it needs to be visible to the security function.

Operational implications

  • Movement plans should assume permissions can be withdrawn mid-journey; carry a stated fallback location for each leg.
  • Communications redundancy matters as much as route selection where interruptions have been reported.
  • Regional and zonal risk varies sharply. A national rating is not a planning tool; assess by zone and corridor.

Key indicators

  • New road closures or convoy-only requirements on programme corridors.
  • Changes in permit processing or sudden suspension of movement authorisations.
  • Communications or internet interruptions in operational zones.

Recommended monitoring

  • Daily: road status and reported incidents on corridors in use.
  • Weekly: permit and authorisation status; partner access reporting.
  • Monthly: re-rate zones rather than the country.

Confidence and sources

Moderate — access and movement judgements rest on reporting that is uneven by region; political framing is well established but its operational effect is assessed rather than observed.

  • · ACLED conflict event data
  • · UN OCHA Ethiopia reporting
  • · Ethiopian and regional media monitoring
  • · Specialist research and analysis on the Horn
  • · INGO ADVISORY analyst assessment

Security brief

Sudan · Current reporting period

Threat level: CRITICALAn attack is highly likely in the near future.

Situation

  • Confirmed: armed conflict between the Sudanese Armed Forces and the Rapid Support Forces continues, with fighting and displacement reported across Khartoum, Darfur and Kordofan.
  • Reported: inland routes from Port Sudan are subject to changeable authorisation, and administrative constraints on movement and clearance are widely described by operational actors.
  • Assessed: the practical limit on operations is access and clearance rather than the availability of programme capacity.

Assessment

  • Sudan is the most severe operating environment in the region. Front lines move, control of routes changes hands, and the party that grants a clearance may not be the party that holds the road a week later.
  • The most consequential decisions are made before movement: whether the clearance chain is genuinely complete, and whether staff can be withdrawn if the situation closes behind them.

Operational implications

  • Treat every clearance as perishable and re-confirm it on the day of movement.
  • Plan for withdrawal, not only for arrival. Movement without a rehearsed way back should not be approved.
  • Remote management and partner-led delivery should be the default in contested areas rather than the exception.

Key indicators

  • Front-line movement affecting routes in use or planned.
  • Changes in clearance authority, or new actors levying charges on corridors.
  • Airport, port and border status changes affecting rotation and resupply.

Recommended monitoring

  • Daily: conflict reporting on corridors in use; port and border status.
  • Weekly: clearance and authorisation position; partner access constraints.
  • Monthly: review whether presence remains justifiable against residual risk.

Confidence and sources

Moderate to high on the conflict picture, which is consistently reported; lower on the status of individual routes, which changes faster than reporting can confirm.

  • · ACLED conflict event data
  • · UN OCHA Sudan situation reporting
  • · Radio Dabanga and Sudanese media monitoring
  • · Insecurity Insight aid-security reporting
  • · INGO ADVISORY analyst assessment

Security brief

Kenya & the Somalia border counties · Current reporting period

Threat level: SUBSTANTIALAn attack is likely.

Situation

  • Confirmed: attacks and improvised explosive device incidents continue to be reported in Garissa, Wajir and Mandera counties, including against security patrols and road users.
  • Reported: border management and cross-border movement arrangements remain sensitive to political developments between Nairobi and Mogadishu.
  • Assessed: Nairobi and the main urban centres present a materially different picture, dominated by crime and by risk around protests and political events.

Assessment

  • Kenya is best treated as two operating environments. Applying a national threat level flattens the difference between north-eastern county road travel and routine work in Nairobi, and usually produces controls that are wrong in both places.
  • In the border counties, road movement is the exposure that matters. Elsewhere, predictable routines and crime are the more realistic concern.

Operational implications

  • Road movement in Garissa, Wajir and Mandera should be assessed per route, with daylight-only travel and defined no-go segments.
  • Nairobi-based staff need protest and crime awareness, not counter-terrorism procedure copied from the border counties.
  • Cross-border programme travel should assume that border arrangements can change at short notice for political reasons.

Key indicators

  • Incident reporting on specific road segments in the border counties.
  • Security-force operations or curfews affecting movement.
  • Political developments affecting border crossings and cross-border travel.

Recommended monitoring

  • Daily: incident reporting on the north-eastern corridors; protest notices in Nairobi.
  • Weekly: border crossing status; partner movement reporting.
  • Monthly: review county-level ratings separately from the national picture.

Confidence and sources

Moderate — county-level incident reporting is reasonably consistent; the effect of political developments on border arrangements is assessed rather than confirmed.

  • · ACLED conflict event data
  • · Kenyan national media monitoring
  • · UN and humanitarian reporting for the north-eastern counties
  • · Published government advisory information
  • · INGO ADVISORY analyst assessment

Security brief

Red Sea, Bab el-Mandeb & Djibouti · Current reporting period

Threat level: SEVEREAn attack is highly likely.

Situation

  • Confirmed: maritime attacks and threats against shipping in the Red Sea and Gulf of Aden have been reported over an extended period, with carriers rerouting away from Bab el-Mandeb.
  • Reported: rerouting has lengthened lead times and raised costs on supply into the Horn, with knock-on effects for inland programmes.
  • Assessed: Djibouti itself remains comparatively stable, but its exposure is concentrated in its role as the region's logistics hinge.

Assessment

  • For most land-based organisations the Red Sea risk is a supply-chain risk, not a personal-safety risk. It shows up as stock-outs and slipped timelines rather than as incidents.
  • Because the disruption is prolonged rather than sudden, it tends to be absorbed quietly by programmes until something critical is late. That makes it a management reporting problem as much as a security one.

Operational implications

  • Hold longer lead times and larger buffers for critical items; state the assumption in the plan rather than discovering it.
  • Identify which programme activities fail first if resupply slips, and say so in the continuity plan.
  • Where staff travel by sea or work in port areas, apply the maritime advisory guidance rather than general country ratings.

Key indicators

  • Advisory changes from maritime authorities covering the corridor.
  • Carrier routing announcements and insurance-driven rate changes.
  • Port congestion or handling delays at Djibouti and alternative ports.

Recommended monitoring

  • Daily: maritime advisory notices affecting the corridor.
  • Weekly: lead-time performance against plan for critical supply lines.
  • Monthly: continuity review of the items with no local substitute.

Confidence and sources

Moderate to high on the disruption itself, which is publicly and consistently reported; moderate on the downstream programme effect, which is assessed.

  • · UKMTO and published maritime advisory information
  • · IMO and industry maritime security reporting
  • · Regional shipping and logistics reporting
  • · UN OCHA logistics and supply reporting
  • · INGO ADVISORY analyst assessment