Security incidents are judged almost entirely by the first ten minutes. Whatever happens afterward is conducted under the conditions those minutes created. The prerequisite is categorisation. Incidents require different responses, and a guard attempting to determine the appropriate action during the event will usually choose incorrectly. A defined category list covering medical emergency, fire, unauthorised access, theft, violence, suspicious item, vehicle incident and utility failure allows immediate classification. Each category requires a defined first action. For a medical emergency, this is securing the area, summoning first aid and calling emergency services, in that order, with one named person per shift responsible for the call rather than a general instruction. Escalation must specify names and numbers, not designations. A protocol instructing a guard to inform the facility manager fails at 2 AM when the guard does not know who that is or how to reach them. A laminated card with the current escalation tree, updated when people change, is unglamorous and effective. Communication discipline prevents the secondary problem, which is uncontrolled information spreading before facts are established. A single designated point of communication for an incident prevents contradictory accounts reaching tenants, management and occasionally media. Scene preservation matters where any investigation may follow. Guards should be trained to secure rather than to tidy. The instinct to clean up after an incident destroys evidence routinely. Documentation should be contemporaneous and factual. An incident report written three days later, describing conclusions rather than observations, has limited value. Post-incident review, conducted without attributing blame, is what converts a single event into improved protocol. Organisations that conduct these find the same root causes recurring until addressed.