Security Intelligence

Security During Corporate Insolvency, Administration, and Restructuring

Q: "Why does corporate insolvency create a specific security threat for directors and executives?"

"Insolvency generates significant grievances from multiple parties who identify specific individuals as responsible: creditors who have lost money, suppliers who have outstanding invoices, and employees who have lost their jobs, often without expected redundancy payments when there are insufficient assets. Unlike general business controversy -- where the harm is diffuse and the responsible parties abstract -- insolvency concentrates personal blame on named directors and the insolvency practitioners who administer the process. The Insolvency Act 1986 requirements for directors to cooperate with administrators and provide detailed financial information can result in their names and professional details being publicly associated with the failed business in ways that are findable online for years."

Q: "What are the main security risks for employees being made redundant during restructuring?"

"Redundancy creates insider threat risk during the notice period and at the point of departure. An employee who knows they are being made redundant has a window of access and motivation to take action: extracting confidential data, sabotaging systems, taking physical property, or providing commercially sensitive information to competitors. The Computer Misuse Act 1990, GDPR Article 32 (appropriate security measures for personal data), and employment contract confidentiality obligations all apply, but the practical mitigation is process rather than law: adjusting access privileges at the point of redundancy notification, supervised handover of physical credentials, and monitoring of unusual data access or download activity in the period before departure."

Q: "How should premises access control be managed during administration?"

"When a company enters administration, premises access control becomes a critical and often overlooked security task. The administrator takes legal control of the company's assets, including the premises, but the operational reality of a large or multi-site business means that access credentials (keys, fobs, codes, digital access systems) are still held by dozens of former employees. Credentials held by the directors themselves must be recovered. Access systems should be audited, and codes or digital credentials should be changed to reflect the new operational structure. Physical patrols or temporary security guarding of premises overnight and over weekends during the administration period protects assets from removal."

Q: "Is close personal protection appropriate for directors during an insolvency event?"

"Close personal protection is appropriate for directors who face a specific and credible personal threat: a creditor or former employee who has made explicit threats, a situation involving significant sums lost by identifiable individuals (creditors who have lost hundreds of thousands of pounds can become highly motivated), or a high-profile insolvency with media attention that generates a large and vocal public response. The National Firearms Threat Assessment (NFTAC) confirms that workplace violence incidents following job losses and financial disputes follow a recognisable escalation pattern: online grievance, direct contact, escalating language, pre-attack behaviour. Directors who are receiving threatening communications should take them seriously and escalate to law enforcement and, where warranted, a security adviser."

Q: "What happens to the company's physical security contracts during administration?"

"Contracted security services -- guarding contracts, alarm monitoring, access control maintenance, CCTV systems -- typically continue during administration subject to the administrator's decision on which contracts to disclaim or continue. Administrators have the power under the Insolvency Act 1986 s.236 to deal with contracts as part of the administration. In practice, security contracts are usually continued where there are physical assets to protect. Where a security contract is discontinued, gaps in coverage should be identified immediately: unguarded premises with known assets and accessible entry points are a significant theft target. Temporary guarding can be arranged at short notice through specialist security providers."

Directors and executives face a distinct security threat window during insolvency and restructuring: creditor confrontations, departing staff insider threats, and premises access challenges. James Whitfield covers the requirements.

8 min 7 May 2026

Written by James Whitfield — Senior Security Consultant

Speak to the Team

Corporate insolvency and restructuring events create a security threat window that is distinct from the background threat environment that most executives and directors operate in. The combination of financial loss, job loss, and public attribution of blame generates motivated grievances directed at named, findable individuals – directors, administrators, and senior management – in ways that other business controversies rarely do.

James Whitfield, Senior Security Consultant, advises directors, administrators, and restructuring teams on the personal and organisational security requirements that arise during corporate insolvency. The consistent pattern is that security risk is recognised only after a threat has materialised – a confrontation at the premises, threatening communications to the director’s home, or a significant data extraction event in the final weeks of trading – rather than being planned for in advance.

Why insolvency creates a specific threat

Standard executive security planning addresses external threats (crime, politically motivated actors, reputational attacks) and internal threats (disgruntled staff, corporate espionage). Insolvency combines elements of both and adds a feature not present in most threat scenarios: the concentration of blame on specific named individuals through formal public records.

When a company enters administration or liquidation, the administrators file reports with Companies House under the Insolvency Act 1986. Director conduct reports are submitted to the Insolvency Service. If disqualification proceedings are brought under the Company Directors Disqualification Act 1986, the proceedings are public. The director’s name, professional history, and their connection to the failed company appear in public records that are easily searchable, indefinitely.

Creditors – particularly individual creditors who have lost significant sums – can identify these individuals. Former employees who have not received expected redundancy payments can identify them. Suppliers with outstanding invoices can identify them. These are not abstract grievances directed at a corporate entity; they are personal grievances directed at people.

The NFTAC (National Firearms Threat Assessment Centre) and NaCTSO threat assessment frameworks both recognise the escalation pathway from financial grievance to targeted threat: online research to identify the individual, direct contact with threatening or accusatory content, escalating frequency and tone, and in a small number of cases, physical confrontation or worse. Not all grievances escalate. But the pattern is consistent enough to require a monitoring and response protocol.

Personal security for directors during the event

Directors face the highest personal risk profile during the most acute phase of the insolvency event: the week of the administration filing, the period when large creditor or staff meetings take place, and the weeks immediately following redundancy notifications.

During these periods, a security review should cover the following elements.

Home address security. If the director’s home address is researchable through Companies House director records (which it often is, or was historically), a basic residential security review is warranted: the condition of perimeter security, external lighting, and alarm and CCTV coverage. The Electoral Register suppression scheme and Companies House registered address suppression under the ECATA 2023 are legal mechanisms for reducing the searchability of the director’s home address for future filings, though they do not address information already in the public record.

Threat monitoring. Monitoring of direct communications (email, phone, social media contact) for threatening or escalating language. The first threatening communication should be reported to the police and documented. The Protection from Harassment Act 1997, the Malicious Communications Act 1988, and the Communications Act 2003 s.127 all apply to threatening or offensive messages. Documentation from the outset establishes the evidence base for restraining orders or prosecutions.

Journey security. During the acute phase, the director’s routes to and from the insolvency practitioners’ offices, relevant courts, and any creditor meetings should vary. Creditor meetings, in particular, are attended by the people most likely to have a grievance and to have done the research to identify the director’s face and movements.

Personal protective equipment. Close personal protection is warranted where specific, credible threats have been received, where the financial sums involved are very large and creditor anger is demonstrable, or where the director has received media attention that has generated a volume of hostile public comment. The threshold for CPO deployment should be threat-specific, not precautionary, unless the nature of the insolvency warrants a higher baseline.

Insider threat during the redundancy period

The period between redundancy notification and physical departure is the highest insider threat window in a corporate insolvency.

An employee who knows they are being made redundant has both access and motivation. The data they can extract – customer lists, supplier contracts, financial records, product specifications, personnel files – has value to competitors and may also be used as leverage. The Computer Misuse Act 1990, GDPR Article 32 (appropriate technical and organisational security measures), and employment contract confidentiality obligations all create legal liability after the fact. The practical mitigation is procedural.

At the point of redundancy notification, network access should be reviewed and adjusted to operational necessity only. Elevated privileges (admin access, financial system access, HR data access) should be revoked unless operationally required through the notice period. Unusual data access or large downloads in the days before and after notification should be flagged by the IT security monitoring system.

Physical handover of credentials – keys, fobs, access cards, company mobile devices, and any physical security materials – should be conducted as a formal process at the point of departure, with a signed receipt. This is not bureaucratic formality; it is the mechanism for ensuring that former employees do not retain physical access to the premises after their employment has ended.

For managing the insider threat dimension during this period, the framework in our insider threat and corporate security guide applies directly. For the crisis communications and incident management requirements that frequently accompany a major insolvency event, see our corporate crisis management and security incidents guide.

Sources:

Insolvency Act 1986. HMSO. Company Directors Disqualification Act 1986. HMSO. Companies House: Director Conduct Reporting Requirements. 2024. Computer Misuse Act 1990. HMSO. Protection from Harassment Act 1997. HMSO. Malicious Communications Act 1988. HMSO. UK GDPR Article 32: Appropriate Technical and Organisational Measures. ICO, 2024. NaCTSO: Identifying and Managing Workplace Violence Risk. 2024. NFTAC: Targeted Violence Assessment Framework. 2024. ASIS International: Workplace Violence Prevention Standard, ASIS WVPI.1-2011. Reaffirmed 2023. Control Risks: Corporate Restructuring Security Requirements. 2024. R3 (Association of Business Recovery Professionals): Administration Process and Director Obligations. 2024.

James Whitfield is a Senior Security Consultant with experience in executive protection, corporate security programme design, and security management during high-risk corporate events.

Summary

Key takeaways

Insolvency creates a concentrated personal blame environment

Unlike general business failures where responsibility is diffuse, insolvency events name specific directors and practitioners in formal public records, create financial losses for identifiable individuals, and concentrate grievance on people rather than on abstract organisations. This combination -- identified individual, motivated grievance, and public information -- is the threat profile that personal protection is designed for.

The notice and departure period is the highest insider threat window

Employees who have been notified of redundancy retain access to systems and premises for the duration of their notice period. Data extraction, property removal, and system sabotage are most likely in this window. Access privileges should be adjusted at notification, physical handover of credentials should be conducted as a formal process, and departures should be managed -- particularly for senior staff with significant system access or knowledge.

Premises security degrades rapidly unless actively managed during administration

The administrator takes control of physical assets, but unless they actively audit and update access credentials, the previous access structure remains in effect. Former employees, suppliers with delivery access, and previous service providers may still hold valid credentials. An urgent access control audit and credential update is a priority task in the first days of an administration.

Escalating communications from creditors or former employees should be reported

Threatening communications -- whether by email, letter, phone, or social media -- should be reported to the police (Action Fraud or directly to the local force if the threat is immediate) and documented for subsequent use in any injunction application. The Protection from Harassment Act 1997 and the Malicious Communications Act 1988 both apply. Documenting from the first communication provides the evidence base for legal action.

The risk period extends beyond the administration

Grievances from insolvency events do not resolve when the administration concludes. Directors who are subsequently disqualified under the Company Directors Disqualification Act 1986, or who face personal liability claims from insolvency practitioners, face a prolonged public association with the failure. Threat monitoring should continue for a defined period after the administration concludes.

FAQ

Frequently Asked Questions

Insolvency generates significant grievances from multiple parties who identify specific individuals as responsible: creditors who have lost money, suppliers who have outstanding invoices, and employees who have lost their jobs, often without expected redundancy payments when there are insufficient assets. Unlike general business controversy – where the harm is diffuse and the responsible parties abstract – insolvency concentrates personal blame on named directors and the insolvency practitioners who administer the process. The Insolvency Act 1986 requirements for directors to cooperate with administrators and provide detailed financial information can result in their names and professional details being publicly associated with the failed business in ways that are findable online for years.

Redundancy creates insider threat risk during the notice period and at the point of departure. An employee who knows they are being made redundant has a window of access and motivation to take action: extracting confidential data, sabotaging systems, taking physical property, or providing commercially sensitive information to competitors. The Computer Misuse Act 1990, GDPR Article 32 (appropriate security measures for personal data), and employment contract confidentiality obligations all apply, but the practical mitigation is process rather than law: adjusting access privileges at the point of redundancy notification, supervised handover of physical credentials, and monitoring of unusual data access or download activity in the period before departure.

When a company enters administration, premises access control becomes a critical and often overlooked security task. The administrator takes legal control of the company’s assets, including the premises, but the operational reality of a large or multi-site business means that access credentials (keys, fobs, codes, digital access systems) are still held by dozens of former employees. Credentials held by the directors themselves must be recovered. Access systems should be audited, and codes or digital credentials should be changed to reflect the new operational structure. Physical patrols or temporary security guarding of premises overnight and over weekends during the administration period protects assets from removal.

Close personal protection is appropriate for directors who face a specific and credible personal threat: a creditor or former employee who has made explicit threats, a situation involving significant sums lost by identifiable individuals (creditors who have lost hundreds of thousands of pounds can become highly motivated), or a high-profile insolvency with media attention that generates a large and vocal public response. The National Firearms Threat Assessment (NFTAC) confirms that workplace violence incidents following job losses and financial disputes follow a recognisable escalation pattern: online grievance, direct contact, escalating language, pre-attack behaviour. Directors who are receiving threatening communications should take them seriously and escalate to law enforcement and, where warranted, a security adviser.

Contracted security services – guarding contracts, alarm monitoring, access control maintenance, CCTV systems – typically continue during administration subject to the administrator’s decision on which contracts to disclaim or continue. Administrators have the power under the Insolvency Act 1986 s.236 to deal with contracts as part of the administration. In practice, security contracts are usually continued where there are physical assets to protect. Where a security contract is discontinued, gaps in coverage should be identified immediately: unguarded premises with known assets and accessible entry points are a significant theft target. Temporary guarding can be arranged at short notice through specialist security providers.

Get in Touch

Request a Consultation

Describe your security requirements below. All enquiries are confidential and handled by licensed consultants.