Security is a profession. It’s time we started treating it like one.
Over the years working with dozens of clients across healthcare, corporate, and institutional security programs, I’ve seen a persistent and troubling pattern: organizations hiring security consultants who have never earned a single credential in the field they claim to advise on. No IAHSS certification. No ASIS designation. Just years of “experience” and a confident pitch.
That’s not good enough anymore, and honestly, it never should have been.
Certifications Exist Because Standards Exist
Every mature profession has a credentialing structure. Physicians are board-certified. Attorneys pass the bar. Accountants earn their CPA. These aren’t bureaucratic hoops, they’re proof that a practitioner has been tested against an established body of knowledge, and that they’re accountable to a professional standard larger than their own opinion.
Security has that same infrastructure. The International Association for Healthcare Security and Safety (IAHSS) offers credentials like the Certified Healthcare Protection Administrator (CHPA) built specifically around the standards and guidelines that govern healthcare security programs. ASIS International offers the Certified Protection Professional (CPP), Physical Security Professional (PSP), and Professional Certified Investigator (PCI), each one grounded in rigorously developed standards that reflect decades of collective industry knowledge.
When a consultant references IAHSS guidelines or ASIS standards in their recommendations, they’re not name-dropping. They’re anchoring their advice to something bigger than personal preference, a consensus-built framework that has been tested, peer-reviewed, and refined by practitioners across the industry. That’s the difference between an opinion and a professional recommendation.
A Word of Caution for Organizations Hiring a Security Consultant
If your organization is evaluating a security consultant, whether for a vulnerability assessment, a security program overhaul, or expert support in a legal case, ask about certifications before you ask about anything else.
A consultant without IAHSS or ASIS credentials may still be personable, experienced, and persuasive. But experience without a credentialing framework behind it is just anecdote. It means their recommendations aren’t measured against an established standard, they’re measured against whatever that individual has personally encountered, which may be outdated, incomplete, or simply wrong for your environment.
This matters enormously when the stakes are high. If you’re making decisions about your organization’s security posture, or if you’re relying on expert testimony in litigation, you need someone whose opinions can be traced back to a recognized standard, not someone whose only credential is their own say-so. An uncertified consultant may not have the depth of knowledge to identify gaps you can’t see, to benchmark your program against industry norms, or to hold up under scrutiny when their recommendations are challenged.
Ask directly: “What certifications do you hold?” “What standards inform your recommendations?” If the answer is vague, defensive, or dismissive, treat that as a warning sign, not a quirk.
About the Pushback
I’ve noticed something consistent: many of the loudest critics of security certifications are the ones who don’t hold any. The criticism usually falls into a few familiar buckets, the exams are “just memorization,” the associations are “gatekeeping,” or certifications are “a money grab” that don’t reflect real-world skill.
Sometimes that criticism is worth hearing. No credentialing body is perfect, and reasonable people can debate exam design or renewal requirements. But often, the criticism conveniently shows up only after someone has failed to earn the credential or never attempted it in the first place. It’s a lot easier to dismiss a standard than to meet it.
Every profession draws a line between those who have demonstrated competency against an agreed-upon standard and those who haven’t. That’s not gatekeeping, that’s what a profession is. Medicine doesn’t apologize for licensing boards. Law doesn’t apologize for bar exams. Security shouldn’t apologize for IAHSS and ASIS credentials either.
Raising the Bar for Our Own Field
If we want security to be respected as a profession, treated with the same credibility as legal, medical, or financial expertise, we have to hold ourselves to the same standard those professions hold themselves to. That starts with practitioners pursuing certification, not resisting it, and it continues with organizations refusing to settle for consultants who haven’t done the work to earn one.
Certification isn’t about credentials for their own sake. It’s about giving clients confidence that the advice they’re receiving is grounded in something real, a body of knowledge built and validated by the profession itself, not just one person’s opinion of what security should look like.
If you’re hiring a security consultant, ask the hard question up front. Your organization’s safety, and possibly your legal exposure, depends on the answer.
