Part 2 of a two-part series on operational security lessons from the US-Iran conflict. In Part 1: The readiness gap, we set out why "preparedness" and "readiness" are different things, and where the gap opened. Here, we examine how an intelligence-led approach closed it, and what organisations should do next.
The US-Iran conflict accelerated a shift in operational security: from a plans-and-logistics model to a threat- and intelligence-led integrated approach. This aligns with Control Risks' long-standing intelligence-led approach to operational security. Integrating intelligence and analysis into a client's decision-making enabled executives to effectively triage information and weigh up evolving options: shelter-in-place, relocate or evacuate, as well show to sequence the movement of essential and non-essential workers.
Control Risks delivered this support through our 24/7 Global Risk Operations Centre (G-ROC) and our Intelligence & Analysis (I&A) teams. The G-ROC generated a continuous stream of tactical intelligence, alerts, and operational advice, while our Middle East Monitor provided forward-looking analysis to support strategic decision-making. Together, these capabilities formed the backbone of the response, ensuring that operational security teams on the ground had access to both real-time situational awareness and longer-term assessments to guide planning and action.
A multi-layered intelligence picture
- Kinetic indicators: Strike locations, frequency and emerging patterns were assessed not as isolated events but as signals of escalation or corridor formation.
- Mobility and access: Border closures, checkpoint status and road viability were assessed to determine whether restrictions were temporary and administrative in nature or becoming more entrenched.
- Aviation intelligence: Tracked airspace and corridor availability, answering whether “charter out” was a viable option or a closing window.
- Cyber and information signals: Monitored for distortion or amplification, distinguishing real-world impact from shaped narratives.
- Human reporting: Staff and subcontractors grounded the operating picture, often confirming or challenging what the feeds suggested.
By building and maintaining realistic scenarios and triggers, Control Risks avoided shifting its position daily in response to every signal on the ground. Clients who initially leaned toward immediate evacuation were able to hold a shelter‑in‑place position where escalation patterns did not warrant movement, avoiding premature exposure at borders and airports. Where movement was required, departures were sequenced by the criticality of their people, based on live assessments of crossings, airspace and on the ground conditions.
When operating conditions are changing constantly, strategic decision-making becomes significantly more difficult. Trustworthy and relevant information – with comprehensive scenarios and escalation triggers – becomes a major advantage.
The information battlefield
This conflict was not only kinetic. Cyber activity and influence operations accelerated in parallel, shaping perception, amplifying uncertainty and, at times, distorting the operating picture that leadership teams relied on.
Organisations that treated cyber as a secondary or downstream risk found themselves reacting to narratives and unvalidated signals. By contrast, those that integrated cyber and information monitoring alongside physical intelligence were better able to distinguish noise from actionable insight. The lesson is clear: in modern conflict, the digital environment moves with the same tempo as the physical one, and separating the two creates more vulnerability.
What organisations should do next
The conflict exposed a series of readiness gaps that organisations can address today. Leaders should:
- Separate preparedness from readiness. Then test both. Ensure not only that your plans exist and reflect reality, but also that the logistics, vehicles, subcontractors and intelligence required to enact them are genuinely in place.
- Do not try to develop playbooks for every possible scenario. Focus instead on strengthening core crisis management capability, underpinned by accurate, timely and actionable business-critical intelligence. A competent and well-structured crisis team should be able to navigate through any number of scenarios.
- Exercise your capabilities. Validate crisis arrangements against a range of high-impact scenarios, including military conflict, natural disasters and supply chain disruption, but avoid becoming fixated on any single threat. The objective is not to predict every crisis, but to build the capabilities, processes and decision-making structures needed to respond effectively regardless of the circumstances.
- Decide triggers before the crisis. For evacuation planning, pre-agree shelter-in-place and evacuation triggers, and a defensible basis for categorising essential and non-essential personnel.
- Integrate intelligence into decision-making. Build a threat- and intelligence-led model that informs leadership decisions, rather than outsourcing the decision itself.
- Hold the line on method. Set realistic scenarios and triggers and avoid recalibrating daily, so strategic decisions are not crowded out by tactical noise.
- Watch the risks you are not looking at. Maintain cyber and insider-threat vigilance throughout a physical crisis.
- Maintain your arrangements. Audit passport mobility across relevant borders and ensure vehicle ownership and documentation will withstand scrutiny at a crossing.
- Embed the lessons on an enterprise-wide basis. Treat these crises as standing entries in the risk register and build the capability before the next flashpoint arrives.
The organisations that navigated the conflict most effectively were not necessarily those with the most detailed plans, but those with the highest levels of operational readiness. When disruption occurred, they had the intelligence, logistics, resources and decision-making structures needed to act. Readiness, not preparedness alone, proved to be the decisive factor.
Control Risks is helping organisations to move beyond preparedness as a static exercise and build capabilities that remain effective when conditions deteriorate, embedding protective intelligence into day-to-day operations so that emerging signals are converted into timely decisions and coordinated action. The goal is not simply to have plans in place, but to develop the operational readiness needed to execute them when it matters most.
Learn more about our Protective Intelligence and Operational Security Services.
Missed Part 1? This article builds on The readiness gap, which explores why so many well-prepared organisations found they were not ready when the US-Iran conflict broke out, from the "compliance trap" to logistical breakdowns at the border. Read Part 1: The readiness gap