A weak fat person whose goal is to be strong and lean has to make the right decision countless times a day to avoid the habits that got him fat and kept him weak. A strong person has to make the right choices to stay strong. Understanding the factors involved in calculating risk and the process of choosing and implementing appropriate counter-measures may be useful.

The Model

The Risk Model I invite you to consider is used by many for protecting people in Executive Protection (EP), protecting information in Operational Security (OPSEC), and protecting a variety of resources in physical security and other disciplines. There are other models than the one we are going to explore, and some of the terms are often defined differently. We are simply brushing the surface of the process, and it can be very involved; however my goal is to introduce you to a simple tool, useful for a variety of situations.

A Risk Assessment provides a decision-making advantage so unacceptable Risks (situations with a high potential for an unwanted outcome) can be identified and reduced by applying appropriate Counter-Measures. All of us perform Risk Assessments multiple times a day. When you use a seatbelt or lock a door at night you are applying Counter-Measures in response to a Risk Assessment. 

A Risk Assessment is often referred to as a cycle, and one can begin the process at any point in the cycle. For learning purposes, we will begin at the Asset being protected. An Asset is anything having positive value to our operation. People, processes, tools, activities, information-anything with positive value are an Asset. For simplicity, we may also refer to our efforts as Good Guy operations or activities.

A Threat is defined as a potential adversary with the intent and capability to harm our Asset. Some in the protection field, even those who have been around a while, like to focus on Threat motive. Chasing someone’s motive can be particularly frustrating and unhelpful; instead focus on his intent and capability.

Keep in mind the Threat will almost always attack in a method making the most use of his strength, and they will attack the Asset where it is most Vulnerable to the Threat’s strength. We can refer to the Threat as the Bad Guy and our Asset is the Bad Guy’s target.

Once we define the Threat, the Bad Guy becomes our target. In addition to gathering information on Threat intentions and capabilities we also focus information collection efforts on the Bad Guy’s Vulnerabilities.  

An Asset’s Vulnerability is something about the Asset that makes it susceptible to a particular Threat. The Threat is not nearly as concerned with the Asset’s strength; the Threat will certainly be aware of the Good Guy strengths, but usually only in the context of looking for Asset Vulnerabilities. The Threat’s strength determines the Assets Vulnerability. In the same way, our strengths determine the Bad Guy’s Vulnerabilities.

If the Threat exploits the Asset’s Vulnerability and accomplishes his goal, the result is known as the Impact. The Impact may immediately be clear as harmful, or not – the Impact may have cascading or cumulative effects not immediately apparent.

The formula used to assess Risk is pretty simple, and we would be well served to keep it that way:

​Threat x Vulnerability x Impact = Risk

If the Risk is unacceptable, we apply a Counter-Measure. Counter-Measures are any action, device or activity applied to reduce the Threat, the Vulnerability or the Impact, or any combination of the three factors, with the goal of reducing the overall Risk.

A Counter-Measure has both positive and negative effects. So, every Counter-Measure does something good as well as bad. Everything has a cost. As soon as the positive is defined, define the negative.

Applying the Model

Let’s apply this model to three pretty common scenarios. For the purposes of discussion, our first trainee’s name is Ava. Ava has been fat since she was a small child. Diet and exercise programs didn’t work; she discovered Starting Strength by accident and applied herself fully. Focusing on getting strong produced noticeable results in just a few weeks.

Today is her grandmother’s eightieth birthday party and also a training day. She trains in the evening and will leave the party to go to the gym. She both dreads and looks forward to the party, and the squats, benches, and deadlifts waiting for her after.

Ava’s goal is getting strong and losing fat. Ava, the right fuel, the right gym, the correct training program, the right coach, the right people around her, and adequate sleep, are a few of the Assets potentially at Risk.

There will be dozens of family members at the party, and for her entire life all social events have been based around bad food. Dinners, picnics, even a stop to say hello in the middle of the day may result in a plate of something being shoved in front of her. Ava is focused on counting her proteins, fats, and carbs – her macronutrients. She is concerned about the food at the party, but most of all, she is concerned about the people.

Ava understands the most likely Assets to be targeted at the party are her fuel and training. Because it is something within her immediate control, she chooses to reduce the Vulnerability in the Risk Model first. Consider this: one can choose to lock the apartment door or put a seatbelt on. There may be no choice on the timing of an intruder or car crash.

Ava reduces her Vulnerability by preparing and packing the appropriate meal. This is a Counter-Measure, and there is always a positive and a negative. The positive is complete control of her macros, and one of the negatives is she will have to endure her family’s “You too good for our food?” comments.

Ava has also reduced her Vulnerability by blocking her training time off in her calendar and setting a reminder for herself. She has her gym bag in the car, and prior to leaving for the party she will study her training journal and remind herself how far she has come in such a short time – reinforcing her confidence in her ability to make the right decision.

Ava is right to be most concerned about the people. She has grown up with them; she understands them and their likely courses of action. She also has a strength absolutely necessary for success: she can think like they do. When looking at her Vulnerabilities, she thinks like the Bad Guy. She is a student of the enemy, she understands the Threats she will face.

Ava has several aunts, and one in particular will be cutting the cake. She can almost hear the words. “Here, have a piece of cake!” her aunt will say, shoving it in her face. “After all, it’s your Grandmother’s birthday,” she says. “Who knows how many more she will have.” Is the aunt a Threat? Yes, of course she is. She has the stated intent to wreck Ava’s macros, and to undermine her efforts to be strong and lean, and with the piece of cake she has the weaponry.

The aunt’s motives are of no concern. Maybe her aunt loves her and just wants her to enjoy the party, or maybe her aunt is a controlling piece of shit, perfectly happy with Ava being fat and weak. Remember, we don’t care about Threat motives; the aunt has defined herself as a Threat by having the intent and capability to damage Ava’s efforts.  She has attacked Ava from a position of strength and focused on her Vulnerabilities by attempting to exploit her love of family. Guilt and peer pressure can be effective weapons. Ava’s Counter-Measures of packing her food and preparing for training may not be effective against the Aunt’s attack. To be successful, she has to recognize her aunt as a Threat.

The Bad Guy usually sticks with what works. Ava’s aunt has a history of using guilt, shame and peer pressure to accomplish her goals. Threats attack one’s weakness from a position of strength. As a Counter-Measure Ava can simply refuse to eat the cake, which after a lifetime of conditioning can be very tough. The positive of that Counter-Measure is its simplicity and its reduction of all the Risk factors. The down side is she knows other members of her family may see it as “rude and self-righteous.” After all, “Your aunt loves you, and just wants you to have fun.”

Ava may choose an avoidance strategy and simply not go to the party. The negatives are missing out on her time with her family, and, of course, the texts she will get: “Since you started this workout stuff, we feel like you don’t love us as much.”

Now that we talked about this a bit, let’s look at Ava’s concern in a slightly different format.

1. Define the Asset
2. Threat X Vulnerability X Impact = Risk
3. Apply appropriate Counter-Measure

Scenario 1: Birthday Party

1. Asset
   1. Ava’s Macronutrient Count.
2. Threat
   1. Ava’s aunt.
      1. Threat Indicators.
      1. Insists Ava eat food that does not fit her goals.
      2. “Here, have a piece of cake.”
      3. “After all, it’s your grandmother’s birthday.”
      4. “Who knows how many more she will have.”
      2. Threat historical course of action.
         1. Present Ava with harmful food in front of others.
         2. Shame her in front of others.
         3. Encourage others to increase pressure for Ava to conform.
   2. Based on observables, Ava’s aunt has the intent and capability to harm Ava’s nutritional goals.
3. Vulnerability
   1. Ava’s love of family and her desire to please her family are her greatest vulnerabilities to this particular Threat. The aunt has access to Ava, her friends, and family. The Aunt knows Ava’s Vulnerabilities well, and uses time proven tactics to exploit them.
4. Impact
   1. Ava’s nutrition is destroyed for the day, her eating the cake may encourage further Threat activities, and Ava’s confidence and resolve is undermined.
5. Risk
   1. Based on the Threat’s insider knowledge, access, and past success with her courses of action, the Risk warrants the application of a Counter-Measure.
6. Counter-Measure
   1. Reduce the Threat by going to the party and refusing to eat the offered cake.
      1. Negative Impact is increased pressure to conform.
   2. Don’t go to the party.
      1. Negative Impact is loss of social interaction.

Scenario 2: Training Time

How about we take a look at another scenario involving Ava and a friend? We won’t narrate this one; we will just plug it into the model.

1. Asset
   1. Ava’s training time.
2. Threat
   1. Ava’s best friend.
      1. Threat Indicators.
         1. Less than enthusiastic about Ava’s fat loss.
         2. “Ava has changed.”
         3. “I hope Ava is not so disappointed and depressed when she gains the weight back.”
         4. “I just miss my friend.”
      2. Threat historical course of action.
         1. Explain to Ava she wants to work out with her, and then tries to change the schedule. “Let’s catch a movie tonight, and then I will work out with you in the morning!”
         2. Immediately prior to Ava’s training time an urgent emergency will surface only Ava can solve.
         3. Recruits other Threat actors to plan activities Ava would enjoy during Ava’s training time.
      3. Based on observables, Ava’s friend has the intent and capability to harm Ava’s training.
3. Vulnerability
   1. Ava has been friends with her a long time; the friend has access to Ava, knows her family and friends, and of most concern, knows many of her weaknesses. The friend has witnessed Ava fail at a variety of diets and “work out” programs.
4. Impact
   1. Ava misses training days, and missing those days may become a habit.
5. Risk
   1. Based on the Threat’s insider knowledge, access, and past success with her courses of action the Risk warrants the application of a Counter-Measure.
6. Counter-Measures
   1. Ava sets her training time on the calendar and makes no exceptions.
      1. May result in an insulted friend, missed social opportunities, and some isolation.

Scenario 3: Police Academy

For our next Scenario, let’s take a look at Ricky. Ricky is in his mid-twenties, and strong with a reasonable amount of bodyfat. Ricky has been accepted into the police academy and if he wishes to graduate, he must participate in their physical training.

1. Asset
   1. Ricky’s physical well-being.
2. Threat
   1. Physical Training Instructor.
      1. Threat Indicators.
         1. Delivers a program based on long slow distance cardio and arbitrary and ill-conceived calisthenics.
         2. “Size and strength don’t matter on the street.”
         3. “We don’t warm up; there is no warming up on the street.”
         4. “You can’t bench press your way out of a fight.”
      1. Threat’s Historical course of action
         1. Long slow run through woods with no consideration of individual trainees’ current conditioning.
         2. Denies trainees water and forces them to exercise in high heat conditions.
         3. Harmful high-repetition calisthenics.
      1. Based on observables, the physical training instructor has the intent and capability to injure Ricky.
3. Vulnerability
   1. Ricky needs to satisfactorily complete the training, and to do so he must participate in the training protocols. This allows the Threat access and capabilities the Threat would not normally have.
4. Impact
   1. The most common Impact is knee and shoulder injuries, and in the rarer worse-case scenario, death.
5. Risk
   1. Based on the Threat’s control over the training, the dangerous training protocols, and Ricky’s need to complete the training, the Risk warrants the application of a Counter-Measure.
6. Counter-Measure
   1. Ricky will reduce his strength training during his time at the academy, giving himself a better opportunity to recover.
      1. The reduction in strength may make him more vulnerable to physical injury.
   2. Ricky will draw no attention to himself during class, lowering his profile as a target.
      1. This may negatively Impact Ricky’s learning experience because of decreased participation.
   3. Ricky will not go all-out on the calisthenics, he will hold a bit in reserve to protect himself.
      1. This may result in the instructor accusing him of not fully participating.
   4. Ricky will continue to study the Threat looking for Vulnerabilities he can exploit to reduce Risk.
      1. Ricky’s information collection may draw unwanted attention.

For each one of these scenarios there are additional Threat indicators, Vulnerabilities, Risks and Counter-Measures. Think about each one from the position of the Bad Guy. Knowing what you do about the Threat, if you were the Bad Guy, what would be your most likely course of action?

How would you advise Ava or Ricky to reduce the Risk?  Should they reduce the Threat, the Vulnerability, the Impact, or all three? If you decide to reduce the Threat, what might be useful information? What should we be looking for once the Bad Guy becomes our target? 

When we look at protecting Assets, it is common to focus primarily on our strengths. It is almost universal in security operations. They are so proud of the fences, the barricades, the cameras, all the ninja-upped guys and gals with their sexy little black varmint rifles with cool stuff hanging off them, on display for all, easy to see, easy to identify. All of these can be effective Counter-Measures, however, often they focus so hard on their strengths they ignore their weaknesses – Weaknesses the Threat is delighted to exploit.

Consider your trainees operations, beyond just their strength and nutrition goals. Consider your own operations, the things important to you. If you haven’t yet, I invite you to let this get a little personal: who are the Assets in your life, the people, and the activities that provide positive value? Who are the Threats in your life? Who are those with the intent and capability to do you harm? What about you makes you Vulnerable? Where are you most Vulnerable, and to whom? Thinking like the Bad Guy, where and how are you most likely to be attacked?

Often the Threat is one we don’t wish to acknowledge. A family member who is perfectly happy with you being fat and weak, a lover who “thought she would be much prettier” when she lost weight. A swimming coach the kids are just a bit uneasy about. Maybe a best friend from college who is not so pleased you are no longer the fat friend. Perhaps an instructor whose job should be to help you improve performance instead of hurt you out of arrogance and fear. My personal favorite of all time is a close family member telling someone, “God wants you to be fat.” 

Identifying these Threats is a priority. Do not waste time trying to determine the motive behind a Threat’s actions. Simply determine if the intent and capability to harm the Assets exist.  If the answer is yes, then this person, whoever it is, is a Threat and must be treated accordingly.

The Asset you are protecting is the Threat’s target. Any potential adversary with the intent and capability to harm your Asset is a Threat. Study the Threat, and determine the intentions and capabilities; view them as your target. What strengths do you have that can exploit their weakness? What about the Threat makes him Vulnerable to you? If the Threat accomplishes his goal what is the Impact, both short and long term?

This methodology may seem a little harsh. But please consider the Impact these Threats can have. If they harm your strength training…diabetes, brittle bones, and a lifetime of not being able to fully participate in the world around you can be the Impact. If you are particularly unlucky, you may end up in a nursing home, waiting for a minimum wage employee to change your diaper and roll you over to steal the Fentanyl patch off your back to give to her boyfriend. 

Study all the Assets in your life, what is the Impact if someone successfully harms them?

Define what you are trying to protect. Then define the Threat based on intent and capability. Thinking like the Bad Guy, look at your Vulnerability from the Threat perspective. Then target the Threat. Look at the Impact to you if the Threat accomplishes its goal.

Then do something about it.

Discuss in Forums