A listed mining group brought us in to consolidate fragmented site security into a single capability. Protection had developed independently at each operation, leaving the group without a coherent view of risk across remote and geographically dispersed sites. Our mandate was to engineer one integrated security operations centre and the operating doctrine to run it.
The challenge
Site security was siloed, with each operation running its own arrangements and little flowing back to the centre. Situational awareness was limited, and leadership had no single view of risk across the group's footprint, which made it difficult to compare exposure, direct resources, or respond to events in any coordinated way.
The remoteness of the operations sharpened the problem. Distance and isolation meant that any delay between detecting a threat and acting on it carried real consequence, yet the group had no common operating picture through which to detect and act quickly.
Our approach
We engineered an integrated security operations centre that drew surveillance, access control and intelligence feeds into one place. Rather than replacing what worked at each site, we connected the existing estate into a common architecture, so that disparate systems fed a single, coherent picture of the group's risk.
On top of that picture we established a response doctrine, so that detection led predictably to action. The doctrine set out how events were triaged, who was mobilised, and how the centre and the sites worked together, which turned raw awareness into a disciplined, repeatable response across every integrated operation.
Designing the centre as a consolidation exercise also let us remove duplication that the siloed model had been quietly carrying. The workstreams were:
- An integrated security operations centre unifying surveillance, access control and intelligence feeds
- A single operating picture spanning all of the group's remote operations
- A response doctrine governing triage, mobilisation and centre-to-site coordination
- Integration of existing site systems into a common architecture rather than wholesale replacement
- Consolidation of duplicated arrangements across the previously siloed estate
The outcome
Seven sites were integrated into the centre, giving the group the single view of risk it had previously lacked. With surveillance, access control and intelligence converging on one operating picture, the operations that had been managed in isolation could finally be seen and run as a whole.
The doctrine turned that awareness into speed: detection-to-response fell to under four minutes across the integrated estate. At the same time, consolidating fragmented arrangements into one capability reduced security spend by 18 per cent, so the group gained both faster response and a more efficient cost base.
We went from seven sites each guarding its own corner to one centre that sees the whole group. That single picture is the difference between reacting and being in control.
The capability proved durable because it was built as an operating model, not a control room. With a common architecture and a clear response doctrine, the group can integrate further operations into the same centre on the same terms, which means the single operating picture grows with the business rather than fragmenting again.
