Map physical security threats, preventive controls, consequences and mitigating controls for facilities, personnel, events and public safety risks.
Used by risk professionals across 40 countries.
BowTie Risk shows a physical security event, the threats and preventive controls that lead to it, and the consequences and mitigating controls that follow.
The same structure supports facility security, personnel security, public events, critical incidents and other physical security risks.
An unauthorised person gains access to a restricted facility or area.
An employee, contractor or other trusted person causes or enables a security event.
Threatening or violent behaviour creates risk to people at a workplace.
A security or public safety event affects a large gathering, venue or event.
A serious security event requires a coordinated operational response.
Assets, stock or sensitive items are stolen, diverted or otherwise lost.
BowTie Risk can be used offline, with assessment files stored locally on the device or in storage locations available to your organisation.
BowTie Risk is built to align with established risk and security management standards, including ISO 31000, ISO/IEC 31010 and ASIS SRA-2024.
Yes. BowTie Risk structures security events, threats, preventive controls, consequences and mitigating controls using bowtie analysis.
Yes. The same bowtie structure can be used to assess major-event, public-safety and critical-incident risks where threats, controls and consequences need to be documented.
Yes. The risk matrix can be configured to reflect your organisation's likelihood and consequence scales, and existing controls can be recorded within the assessment.
Available for Mac, iPad and iPhone.