Hostile Reconnaissance

Understanding Hostile Reconnaissance

Organisations face a range of security threats, including terrorism, activism, corporate espionage, and criminal activity. While motivations and objectives may differ, hostile actors are often united by a common goal — to successfully achieve their intended outcome.

Because opportunities to act may be limited, hostile individuals or groups frequently invest significant time in planning and preparation before attempting to carry out an attack. In many cases, the more sophisticated the threat, the greater the level of information gathering, preparation, and reconnaissance required. This preparatory activity is known as Hostile Reconnaissance.

Hostile reconnaissance involves the collection of information about people, premises, security measures, routines, and operational vulnerabilities in order to identify opportunities and reduce the likelihood of detection. Recognising these behaviours at an early stage is critical to preventing incidents and strengthening overall security resilience.

The Centre for the Protection of National Infrastructure (CPNI) defines hostile reconnaissance as the purposeful observation and information gathering used to support the planning of a hostile act against a specific target.

Understanding hostile reconnaissance within the wider attack planning process provides security managers with a key opportunity to disrupt activity by influencing attacker perception and increasing the likelihood of perceived failure in two key ways:

Denying information: restricting access to the information required to plan an attack, or increasing the perceived risk associated with obtaining it.
Promoting failure: increasing the perception that both reconnaissance activity and any subsequent attack are likely to be detected or unsuccessful.

Protective security strategies should therefore focus on three core objectives:

Deny access to sensitive information and opportunities
Detect hostile reconnaissance activity at an early stage
Deter potential threats through visible security presence, effective communication, and robust physical protective measures

This approach directly targets an adversary’s perception of risk, increasing uncertainty and reducing confidence in the success of any planned hostile activity.