Prepare, Detect, Respond: An Election Security Playbook for Homes, Businesses and Institutions

Kenya’s General Election is set for Tuesday, 10 August 2027. Earlier in this series we looked at why the risk conversation needs to start early, how deepfakes shape the information environment, and how leaders and candidates are exposed. This post gets practical for the three groups who keep asking us the same question in different words: what do I actually do?

The honest answer depends on who you are. A family in a gated estate, a retailer with one shop and a bank with a hundred branches face the same election period, but they do not face the same risks, and they should not buy the same protection. Here is how we think about each, and the framework that ties them together.

Same election, different exposure

The right-hand column changes with scale. For a household the problem is mostly detection and time. For an enterprise it is mostly decisions: when to close, when to move people, and who to call.

Homes and estates: see early and buy time

Election-period risk for a household is rarely political in a direct sense. It is the knock-on effect: opportunistic burglars who expect police attention to be elsewhere, night-time intrusions, and trouble that spills over from a nearby protest route.

• Detect at the perimeter, not the door. Cameras with human and vehicle detection and perimeter intrusion alerts tell you about a person at the fence line rather than a cat on the wall, so alerts stay meaningful and do not get muted.
• Make sure alerts reach someone. Mobile alerts and remote monitoring only help if a named person or monitoring team acts on them. Decide who, and what they do, well before election week.
• Agree an estate plan. Gate procedures, visitor control and a contact tree among neighbors and estate management matter more than any single device.
• Plan your movement. Know alternative routes, keep vehicles fuelled and phones charged, and keep documents and essentials in one place in case you need to leave quickly.

Businesses and SMEs: decide before the day

Looting, vandalism and forced closures turn on a handful of decisions. They are far easier to make calmly in advance than at four in the afternoon when a crowd is forming down the road.

• Set closure triggers. Write down what conditions close the premises early, who makes the call and how staff are told.
• Protect people first. Plan how staff get home safely, who should stay away, and how you will confirm that everyone is accounted for.
• Reduce what is worth taking. Limit cash and high-value stock on site during high-risk windows, and check how your shutters, locks and lighting actually perform.
• Watch the perimeter. LPR and perimeter monitoring show who is approaching the premises, and crowd and abnormal behavior analytics can flag a build-up before it reaches your door.
• Check your insurance. Confirm whether your policy covers riot and civil commotion, and what it requires of you, before you ever need to claim.
• Write election-ready SOPs. Keep them to a page, so that every shift can follow them under pressure.

Institutions and enterprises: from alerts to decisions

Banks, hospitals, schools, logistics firms and multi-site enterprises face a different problem. They are more likely to be targeted, their operations depend on many locations and routes, and a disruption in one place can affect customers in another.

• Start with an election-specific risk assessment. Map every site, route and critical dependency against the threats likely in your counties. Our guides to threat, vulnerability and risk assessments and security risk assessments explain how.
• Build early warning into operations. Someone should be watching open-source signals for your areas and have the authority to act on what they find.
• Agree crisis and response playbooks. Escalation triggers, decision owners and communication lines should be settled before an incident, not during one.
• Adjust the guarding posture. Match guard numbers, positions and procedures to the heightened risk, and rehearse them.

One framework behind all three

Whatever the size of the client, the work follows the same five stages.

1. Threat and vulnerability assessment. What could happen here, and where are we exposed?
2. AI-supported early warning and OSINT monitoring. Watching open-source information for the signals that come before incidents.
3. Physical security readiness and guarding posture. Making sure people, procedures and equipment are in place and have been tested.
4. Incident response and crisis escalation playbooks. Who decides, who acts and who is told, in what order.
5. Post-election recovery and resilience. Reviewing what happened and strengthening what failed, because the risk does not end when the results are announced.

Signals are not intelligence

Monitoring tools can surface a flood of posts, hashtags and rumors. That is not the same as knowing what to do. Useful early warning answers three questions, in this order: what is happening, what does it mean for us, and what should we do now?

Trouble in an election period tends to follow a recognizable path: a grievance, a narrative that spreads online, calls to mobilize, people gathering at a place, and sometimes a physical incident that disrupts roads, businesses and services. The earlier on that path a signal is spotted and checked, the more lead time you have to move staff, change your guarding posture or reroute deliveries. That lead time is what early warning is for.

Technology supplies the signals. People supply the context: checking what is real, working out which of your sites and routes are exposed, and recommending a decision. Our approach relies on the lawful analysis of publicly available information.

How we grade alerts

An alert is only useful if the person receiving it knows how seriously to take it. Within the Election Intelligence Cell, every alert is classified at one of three levels.

The point of grading is to link each level to decisions you have already made. If you have agreed in advance what a FLASH means for your branches, your estate or your shifts, nobody has to debate it at the moment it arrives.

Events, visits and executive movements

Campaign season also changes the risk of ordinary corporate activity. If your organization is hosting an AGM, a launch, a customer event or an executive visit to an unfamiliar location, the same discipline applies. Our overview of what executive protection involves goes deeper, but these basics matter most:

• Do the advance work. Visit unfamiliar venues beforehand, and know the entrances, exits, nearest medical help and evacuation routes.
• Layer the protection. Put several layers between your principals and the public, such as access control, screening, controlled routes and close protection, so that one failure does not expose them.
• Plan for more people than expected. Decide in advance how you will respond if attendance exceeds projections.
• Liaise early. Engage law enforcement early for high-risk movements, and be clear about what intelligence you need before a visit goes ahead.
• Hold vendors to account. Onboard security providers with clear service levels, and know what you will do if they are missed.
• Protect confidentiality and keep records. Limit who knows movement details, and keep an auditable record of protective activity and a post-event report.

Three steps to take now

You do not need to do everything at once. Start here:

1. List your sites, people and critical routes, and note which are most exposed.
2. Write down your closure, escalation and communication triggers, and who owns each one.
3. Test your cameras, alerts and call trees, so that you know they work before you need them.

Elections do not have to mean uncertainty. Prepare, detect and respond. If you would like help designing an election security plan for your home, business or institution, talk to us.