AMOs & VIs An Attacker’s Method of Operation (AMO) is a description of a way in which an adversary can operate that has been proven in practice to pose a viable threat to one’s own organization. AMOs can be collected by analyzing old incidents in databases, but also, for example, by trend analyses. With an up-to-date picture of relevant AMOs, which have been properly incorporated into procedures, security guards can work more effectively and intervene more adequately in undesirable situations. Suspicious indicators (VIs): – A lot of interest in the presence/absence of security or security equipment on location; – Making (secret) photo/film recordings in the area; – Prolonged without a clear purpose and contact with others present in the entrance hall and surroundings; – Striking clothing compared to the norm; – Presence at an illogical time; – Evade staff and security or have an aggressive attitude; – Person in recognizable company clothing is unknown and is not recognized by colleagues; – Person is present outside regular working hours; – An unattended item left behind in or around the location/surroundings. An unknown or unknown person asks a (security) employee (by telephone) about procedures regarding access, agendas, MT location, busy days, camera surveillance, security measures, etc. Based on the aforementioned AMOs and VIs identified from this, a so-called Standard Operational Procedure to be drawn up.