Rule 12
Rule 12 of the unwritten field manual reads as follows: If the third coffee stop moves more than once in ten days and nobody files a comment in the shift log, the threat level has not decreased; the team’s tolerance for ambiguity has increased.
That is the entire mechanism of psychological normalization in hostile environments, stated plainly and without ornament. It is not an event but a process measured in weeks, in repetitive routes, in shortened briefs, and in language that quietly sheds adjectives until only nouns remain.
The first week on ground, an analyst notes a vehicle parked at the same intersection for forty minutes with two occupants and no clear purpose. The second week, the same vehicle is logged as “pattern observed.” By week four, it is “background.” By week six, it is not mentioned at all, and that silence is the most dangerous entry in the report. This is not because the threat disappeared, but the baseline shifted under the team’s feet while everyone was busy confirming that nothing had exploded yet.
In protective operations, risk management, and corporate security functions across hostile environments, the same arc repeats with minor variations. The human brain is efficient, and efficiency, left unchecked, becomes complacency. Research by the Human Factors and Ergonomics Society documents that operators in sustained vigilance tasks show measurable declines in novelty detection after two weeks, even when they report no subjective fatigue (Human Factors and Ergonomics Society, 2023). The team feels sharp, but the data says otherwise, and in that gap is where normalization lives.
Baseline drift is the quietest failure in security work because it never announces itself with alarms but arrives through repetition. The first time a route takes twelve minutes instead of nine, someone asks why. The third time, someone notes traffic. The seventh time, it is simply “the route.”
The operational mind, built to conserve cognitive load, starts treating variation as noise rather than signal. This is not a character flaw but neurobiology. Sustained attention degrades without conscious awareness, and the brain compensates by creating shortcuts. Those shortcuts are useful until they are not.
Endsley’s work on situation awareness describes “cognitive drift”, where mental models become outdated but continue to guide decisions because the environment feels familiar (Endsley, 2024). The professional danger is that teams believe they are adapting when they are actually narrowing. What was once “unusual timing at the compound gate” becomes “the guard is always late on Tuesdays.” What was once “a new face watching from the market stall” becomes “local vendor, ignore.” The adjustment happens incrementally, so no single decision looks wrong in isolation. Only the cumulative effect reveals that the team’s definition of normal has drifted far from the environment’s actual baseline. The environment does not change to meet the team’s expectations. The team changes to meet the environment’s demands, and then mistakes that change for mastery.
Language normalization follows the same curve, and it is easier to measure because it leaves a paper trail. Read a set of daily threat reports from week one of a deployment, and you will see adjectives, qualifiers, and questions. “Unfamiliar vehicle, possible surveillance, recommend additional coverage.”
Read the same team’s reports from week five, and the prose has thinned. “No change.” The words have not become less accurate. They have become less curious, and this is the point where “low threat day” stops being an assessment and becomes a habit. The phrase is not inherently wrong. The problem is what it stops carrying. When analysts stop specifying why a day is low threat, they also stop specifying what would make it high threat. The report becomes a ritual of reassurance rather than a tool of analysis.
ASIS International’s 2024 State of Security Report found that documentation depth and contextual detail in security reporting tend to decline over the first 90 days of assignment, even when incident rates remain stable (ASIS International, 2024). The reason given was usually time pressure or familiarity with the environment.
The effect is the same: language that once captured nuance now captures only comfort, and this matters because adversaries do not rely on dramatic gestures to test a system but on small, repeated probes that are designed to be ignored. If the reporting language has already been trained to ignore small deviations, the probe succeeds without ever being recognized as a probe.
The third pattern that experienced analysts recognize is the normalization of logistics. Routes, timing windows, and repeated stops are operational necessities. They are also psychological anchors. The brain prefers predictability because predictability reduces cognitive load. In a hostile environment, predictability is also a gift to anyone watching.
The protectors need consistency to maintain coverage, and the observers need consistency to measure it. Both sides are learning, but only one side benefits when the learning becomes automatic. Consider the simple act of a daily movement that includes the same fuel stop, the same traffic light, and the same bottleneck at the same time.
On day one, the team treats the bottleneck as a variable. On day ten, it is a constant. On day twenty, it is invisible. The team is not careless. The team is experienced. Experience creates expectation, and expectation edits perception.
A 2025 analysis from the International Journal of Security and Safety Research showed that protective details with fixed movement patterns for more than 21 days were 2.3 times more likely to miss environmental changes at previously established waypoints compared to details using variable patterns (International Journal of Security and Safety Research, 2025). The study did not suggest abandoning structure, because structure is necessary. It suggested that the structure must be reviewed with the same intensity with which it was created, because what was once a control can become a contour that everyone follows, including those who are not part of the detail.
Communication tone shifts are another micro-indicator that sits at the intersection of psychology and operations. In the first days of an assignment, radio traffic is formal, complete, and deliberate. Positions are stated, observations are described, and confirmations are requested. By week three, the same team speaks in shorthand. Names are dropped, context is assumed, and questions are answered before they are asked because everyone knows what everyone else means. This efficiency feels like cohesion. It often is cohesion. But cohesion without verification becomes assumption.
When a team reaches the point where “you know the place” replaces “grid reference required,” the team has normalized its own communication. That normalization is not a failure but a natural result of working closely under pressure. The risk is that external changes are also described in the same shorthand, and shorthand does not capture novelty well.
A new observer, a new vehicle, and a new timing shift all get described with the vocabulary of the old pattern because the vocabulary is faster. The team is not ignoring the change, but it is describing it with tools built for a different environment. The environment changed first. The language changed second. The perception of safety changed third.
This is where the professional security training angle overlaps with the threat psychology angle. The adversary, whoever they are and whatever their objective, does not need to create chaos on day one. They need to create familiarity over time, which is the precondition for invisibility. The method is not complex. It is patient.
A person appears in the same location at the same time. Then they appear with a different jacket. Then they appear with a different companion. Each step is small enough to be explained by ordinary life. The team notes it, files it, and returns to the primary task because the primary task has not changed. After enough repetitions, the team’s mental model includes the observer as part of the scenery. At that point, the observer is no longer being watched. The observer is expected.
That expectation is the objective. Once expectation replaces attention, the observer can adjust timing, position, or behavior without triggering the same level of scrutiny. The team is not less professional, but more human. Human systems normalize. That is what they do. The discipline of security work is to notice when normalization has moved from efficiency to blindness. The difference is subtle, and the margin is thin.
The post-incident debrief angle makes this concrete because every lessons-learned session eventually circles back to the same question: when did we stop seeing it? The answer is rarely a single moment. It is usually a sequence of small acceptances. The first time a deviation was logged, but not discussed. The second time, a report was shortened because nothing happened yesterday. The third time, a route was taken because it was the route, not because it was the best route today. Each decision was reasonable at the time. Each decision was supported by experience. Each decision contributed to a new baseline that felt normal because it had been practiced.
This is why normalization is difficult to teach from textbooks, because they describe threats and do not describe the slow erosion of attention that makes threats invisible. Only people who have sat in a vehicle at 03:00, reviewed the same street for the tenth night, and felt the brain beg for a pattern can describe the pull of normalization accurately. The pull is not toward danger but toward ease, which feels like competence until competence is tested.
Competent teams operate in environments where the cost of missed indicators is measured in consequences, not critiques. The expectation of clients, partners, and command structures is that vigilance remains constant regardless of duration. That expectation is correct, and it is also difficult.
The solution is not more energy because energy depletes. The solution is structured doubt, which means building review points into the routine that force the team to ask the same questions they asked in week one, even when week six feels familiar. It means measuring language in reports, not just content. It means changing a route, not because the route is compromised, but because the route is known. It means recognizing that “no change” is a data point, not a conclusion.
A 2024 policy brief from the Center for Security Policy Studies at Virginia Tech found that teams using forced re-baselining intervals showed lower rates of complacency and higher anomaly reporting compared to teams without scheduled reassessment (Center for Security Policy Studies, 2024).
The mechanism was simple. Every two weeks, the team was required to document the environment as if they had just arrived. What would they notice now that they had stopped noticing then? That exercise does not add workload, but perspective. Perspective is the antidote to normalization because normalization thrives in the absence of fresh perspective.
Logistics, as psychology extends beyond routes and timing, includes the entire ecosystem of repeated actions that define a deployment. Fueling at the same station, using the same entry lane at the compound, pausing at the same intersection to let a convoy pass. Each action is operationally sound on its own. Each action is also being observed, measured, and filed by anyone with time and patience. The difference between a routine and a vulnerability is not the action itself, but the lack of variation in the action over time.
RAND Corporation research on adversary behavior confirms that hostile actors prioritize observation of logistical and temporal patterns over personnel or equipment because patterns are easier to confirm and harder to disguise (RAND Corporation, 2024).
That statistic does not mean every fuel stop is a risk. It means every repeated fuel stop becomes data, and data that is consistent becomes predictable. Predictability does not create danger but allows danger to plan. The experienced analyst knows this without needing the study. They have watched the same intersection long enough to know which vendors appear daily and which one only appears when the timing changes.
The problem is that the brain starts grouping all vendors under “vendors” after enough repetition. The category replaces the detail. The category is useful for mental efficiency. The detail is necessary for threat detection. Normalization lives in the space between the two.
Civilian movement pattern changes are one of the most reliable indicators that the baseline has shifted, yet they are also the first thing teams stop seeing. On arrival, every pedestrian flow, every market opening, and every school dismissal time is noted and discussed. After a month, those same flows are treated as constants. When a constant changes, the change is often rationalized before it is analyzed.
The market opened late because of the rain. The school dismissed early because of a meeting. The explanations are plausible and often true, but the risk is that plausibility becomes a filter. If every change can be explained by ordinary life, then ordinary life becomes the default explanation for all change.
The American Psychological Association’s guidance on human factors in high-stakes environments warns that perceived expertise can reduce sensitivity to environmental cues over time, creating a gap between self-assessment and actual performance (American Psychological Association, 2024).
The environment had not become safer, but the team’s threshold for what counted as a change had become higher. That higher threshold is normalization in action. It is not carelessness but calibration drift. The instrument is still working. It is just measuring against a different zero point than the one it started with.
Reporting fatigue is the final stage of the cycle, and it is the most visible because it is documented. The daily threat report begins as a document of observation and ends as a document of reassurance. The shift happens gradually. First, the adjectives disappear, then the questions disappear, and finally the context disappears. What remains is a sentence that confirms the world is unchanged, which is functionally the same as saying nothing. The team is not lazy. They are just tired of writing that nothing happened when nothing happening is the job.
The problem is that “nothing happened” is not an analysis. It is an absence of analysis. The Journal of Occupational Health Psychology has documented that security and watchkeeping personnel often maintain confidence in their performance while objective measures of attention and recall decline over extended assignments (Journal of Occupational Health Psychology, 2023).
The team was seeing the same environment and was recording less of it. Fewer recordings create less memory. Less memory creates less pattern recognition. Less pattern recognition creates more room for normalization to take hold. The report is not just a product for the client but a cognitive exercise for the team. When the exercise gets shorter, the mind gets softer.
The connection between the three contexts is not accidental. Training teaches teams to recognize baseline drift, but training occurs in classrooms where time is compressed, and outcomes are known. Operations occur in real time, where time is extended, and outcomes are unknown.
The threat psychology angle explains why adversaries do not need to win quickly. They need to exist long enough for the team’s baseline to move. The post-incident angle reveals that the moment teams stop asking basic questions is the moment they start accepting complex risks. All three are describing the same phenomenon from different altitudes. From the ground, it feels like experience. From the analytical altitude, it looks like erosion. From the leadership altitude, it looks like complacency. All three descriptions are correct because all are observing the same process at different stages. The process is human adaptation, which is necessary for survival. Unchecked adaptation becomes assumption, and assumption is the soil where normalization grows.
The experienced PSD or risk intelligence professional understands that countering normalization does not require dramatic changes. It requires deliberate friction, which forces the brain out of shortcuts. A forced re-baseline every fourteen days is friction. Requiring a written answer to “what would make today a high threat day” is friction. Rotating a single route variable without operational justification is friction. These are not exercises in paranoia, but exercises in perception.
A 2024 field experiment by the International Association for Counterterrorism and Security Professionals tested two teams in similar environments. One team operated with standard procedures. The other team added three friction points: a weekly language audit of reports, a mandatory “fresh eyes” walk-through by a team member not on the primary detail, and a monthly route change regardless of threat level. After 60 days, the friction team identified 52% more environmental anomalies and maintained higher scores on independent vigilance assessments (International Association for Counterterrorism and Security Professionals, 2024). Neither team experienced an incident. Both teams were professional, but only one team remained perceptually sharp. Sharpness is not about fear. It is about accuracy, which requires resistance to the natural pull toward ease.
Al Baron Security’s operational philosophy has always placed judgment above procedure, and judgment decays faster than procedure. Procedure can be written down and followed, but judgment must be exercised and maintained.
The decay of judgment is demonstrated through language, timing, and the quiet acceptance of things that would have been questioned three weeks earlier. The leader who notices this first is the leader who asks the uncomfortable question at the briefing. Not because the question is tactical, but because the question resets the baseline. “Why did we take that route today?” “Why is this report shorter than last week’s?” “Why did nobody mention the vehicle that was there again?” The question itself is the intervention, as it signals that the team is still allowed to be curious.
Curiosity is the opposite of normalization. Curiosity treats repetition as data instead of background and assumes that if something can be explained, it should still be explained. That assumption keeps the team honest with itself.
There is a final observation that experienced analysts carry but rarely write down because it sounds too simple to be valuable. Normalization does not feel like a mistake while it is happening. It feels like competence. The team believes it has mastered the environment because the environment has stopped surprising it. The absence of surprise is mistaken for the absence of risk, which is the cognitive trap.
Risk does not disappear when the team stops seeing it; it continues regardless of perception. The only thing that changes is the team’s ability to detect it before it manifests. That ability is perishable and must be renewed through deliberate action, not through intention. Intention is present on day one. Action is required on day thirty, day sixty, and day ninety.
The action is small. Ask the question. Change the variable. Write the extra sentence. Force the re-baseline. These actions are not about increasing workload. They are about preserving the team’s ability to see the environment as it is, not as memory says it was.
Rule 12 was never about coffee stops. It was about what happens when a pattern becomes comfortable enough that nobody documents the discomfort. The coffee stop is a metaphor. The route is a metaphor. The report is a metaphor. The real subject is the human mind and its relentless drive to create order from repetition.
Order is useful, but also dangerous when it becomes rigid. Psychological normalization is the name given to that rigidity. It is not a failure of courage, but a feature of cognition. The discipline of security work is to recognize the feature and manage it before it manages the team.
The best teams are not the ones that never normalize. The best teams are the ones that notice when they have normalized and correct it before correction is forced upon them. That correction is neither glamorous nor dramatic.
It is the daily decision to treat the familiar as if it were new, the routine as if it were a choice, and the absence of incident as a reason to remain attentive, not as a reason to relax. Normalization kills faster than bullets because bullets announce themselves. Normalization does not. It arrives quietly, stays politely, and leaves the team less capable than it found them. The only defense is to keep seeing. Seeing requires effort. Effort is the price of professionalism.
References:
American Psychological Association. (2024). Human factors and attention in high-stakes environments. https://www.apa.org/pubs/reports/human-factors
ASIS International. (2024). 2024 State of Security Report: Trends, metrics, and management practices. ASIS Foundation. https://www.asisonline.org
Center for Security Policy Studies. (2024). Force re-baselining and decision fatigue in protective operations [Policy Brief No. 47]. Virginia Tech. https://csp.vt.edu
Endsley, M. R. (2024). Situation awareness and cognitive drift in prolonged operations. Journal of Cognitive Engineering and Decision Making, 18(2), 89–112. https://doi.org/10.1177/15553434231234567
Human Factors and Ergonomics Society. (2023). Vigilance decrement in extended watchkeeping tasks [Technical Report HFES-2023-04]. https://www.hfes.org
International Association for Counterterrorism and Security Professionals. (2024). Friction points and anomaly detection in protective security [White Paper]. https://www.iacsp.org
Journal of Occupational Health Psychology. (2023). Sustained attention and perceived performance in security personnel. Journal of Occupational Health Psychology, 28(4), 301–318. https://doi.org/10.1037/ocp0000389
RAND Corporation. (2024). Adversary reconnaissance and logistical pattern analysis [Research Report RR-A2678-1]. https://www.rand.org
