Security Intelligence for Financial Institutions under the ABS Guidelines

Physical security is not only about cameras, doors, alarms and guards.

The ABS Physical Security Guidelines for Financial Institutions 2.0 (Revised 2025) also expects financial institutions to consider Security Intelligence as part of their detection capability.

ABS describes security intelligence as the tracking, monitoring and reporting of threat information or issues that could create risks to the organisation. It says timely, accurate and objective intelligence can help an FI prepare for identified threats and guide security decisions and actions.

The concept is straightforward:

Security intelligence helps an FI identify a potential threat early enough to do something about it.

This is different from simply collecting news.

Useful intelligence should ultimately support a security decision.

What is Security Intelligence under the ABS Guidelines?

ABS frames security intelligence around information that could indicate or help assess threats to the organisation.

The objective is to provide information that is:

timely, accurate and objective

so that the FI can prepare for threats and make appropriate security decisions.

Security intelligence therefore connects directly to other parts of the ABS framework.

For example, intelligence about an emerging threat may lead the FI to:

raise its security posture, increase monitoring, communicate with employees, coordinate with building management or reconsider aspects of its Physical Security Risk Assessment.

Is Security Intelligence the same as physical surveillance?

No.

Physical surveillance detects activity occurring at or around the premises.

Security intelligence can include information obtained before anything happens at the FI’s location.

For example, the FI may become aware of:

a threat affecting a particular area, an incident affecting similar organisations, suspicious activity reported by an industry peer or information from relevant authorities.

The ABS approach therefore combines:

on-site detection

with

information-based threat detection.

What is the ABS intelligence cycle?

ABS sets out a four-stage intelligence cycle:

Planning and Direction → Information Gathering → Information Analysis → Dissemination.

The importance of this sequence is that it prevents intelligence work from becoming random information collection.

The organisation first decides what it needs to know.

It then gathers relevant information.

It analyses that information in context.

Finally, it gets the resulting intelligence to the people who need it.

What is Planning and Direction?

ABS calls Planning and Direction the first phase of the intelligence cycle.

This stage establishes the organisation’s intelligence priorities.

The FI should understand:

what type of information is needed, how much detail is required, how important the requirement is and how the information could be collected.

ABS says a monitoring plan can then be developed and an information-collection plan may be used to track requirements and identify information gaps.

Why shouldn’t an FI simply monitor everything?

Because information without a defined purpose can create noise rather than intelligence.

Consultant’s perspective

Instead of saying:

“Monitor all security news.”

a more useful intelligence requirement might be:

“Identify security incidents or threat information that could affect our Singapore headquarters, retail branches or employees.”

Or:

“Monitor for developments that could require a change in our building access, guard deployment or employee security posture.”

That gives the monitoring function a clear operational purpose.

What are intelligence requirements?

ABS does not prescribe a fixed list of intelligence requirements.

The FI determines its priorities during the Planning and Direction stage.

Consultant’s perspective

Potential areas of interest could include threats affecting the FI, threats near its premises, security incidents affecting the financial sector, suspicious activity affecting similar organisations or events that could influence the FI’s physical security posture.

These are practical examples rather than ABS-defined intelligence categories.

Does ABS recommend an information-collection plan?

Yes.

ABS says an information collection plan may be used to specify and monitor the intelligence requirements, including identifying potential information gaps.

A simple collection plan might contain:

This is a consultant’s example rather than an ABS-prescribed template.

What is the Information Gathering stage?

Information Gathering is the second stage of the ABS intelligence cycle.

ABS says information may come from a variety of sources, including:

internal and external sources, as well as open and closed sources.

This is significant because a good intelligence programme should not depend entirely on one source.

What is an internal intelligence source?

ABS refers to internal sources but does not provide a detailed classification in the cited section.

Consultant’s perspective

Internal information could potentially include:

security incident reports, CCTV observations, access-control anomalies, alarm events, guard observations, employee reports or information from other internal functions.

These examples are practical interpretations rather than a specific ABS list.

What are external sources?

ABS gives several examples of external information sources, including:

media reports, commercial vendor reports, public databases, law-enforcement authorities, foreign embassies, peer organisations and regulators.

This illustrates how broad security intelligence can be.

The organisation does not have to generate all relevant information itself.

What does ABS mean by open and closed sources?

ABS expressly says information may come from open and closed sources, but it does not provide formal definitions in this section.

In practical terms, open sources are generally information available publicly, while closed sources may involve information received through restricted, organisational or trusted networks.

The exact classification and handling rules should follow the FI’s information-security framework.

Does ABS allow online research for security intelligence?

Yes.

ABS specifically identifies online methods such as:

advanced web searches, websites and blogs, Boolean queries, RSS feeds or Google Alerts, keyword or mapping analytics, and geo-fencing.

This shows that open-source online monitoring can form part of an FI’s security-intelligence process.

However, ABS immediately adds an important security warning.

What does ABS say about using AI chatbots?

This is one of the most notable statements in the revised guideline.

ABS says staff should exercise care not to enter sensitive data into search engines or AI chatbots, to avoid compromising classified information belonging to the FI.

That means ABS does not say:

“Financial institutions must not use AI.”

Nor does it say:

“AI cannot be used for security intelligence.”

The warning is specifically about exposing sensitive FI data through search engines or AI chatbot inputs.

Does ABS ban ChatGPT or other AI tools?

No blanket prohibition is stated in the cited section.

The wording is about staff avoiding the entry of sensitive data into AI chatbots or search engines.

Therefore, saying:

“ABS bans banks from using AI chatbots”

would overstate the source.

A more accurate statement is:

ABS warns financial institutions against entering sensitive information into search engines or AI chatbots where doing so could compromise classified FI information.

Why is this AI warning important for physical security teams?

Physical security teams may handle information such as:

building layouts, security-system details, access-control arrangements, guard deployments, vulnerabilities, emergency procedures or critical-infrastructure information.

Consultant’s perspective

Some of that information may be highly sensitive.

A staff member should therefore not assume that information is safe to enter into a public search or AI tool simply because the task relates to physical rather than cyber security.

The organisation’s own information-classification and approved-tool policies should govern such use.

Can AI still assist security teams?

The ABS source does not provide guidance on approved AI use cases, deployment models or internal enterprise AI.

So that question goes beyond what this guideline establishes.

What the ABS document clearly supports is the principle that sensitive FI information should not be exposed while conducting online or AI-assisted research.

Any broader AI policy would need to come from the FI’s internal governance and other applicable requirements.

What are Boolean searches?

ABS specifically mentions Boolean queries using keywords combined with operator words as one possible information-gathering technique.

In practical terms, this allows analysts to narrow searches using combinations of terms.

For example, a security team may structure searches around:

the organisation, location, threat type or relevant incident category.

The guideline does not prescribe exact search queries.

What are open-source alerts?

ABS identifies alerts such as RSS feeds or Google Alerts as examples of information-gathering tools.

These can reduce the need for personnel to repeatedly perform the same manual searches.

Consultant’s perspective

An FI could establish alerts for relevant public threat subjects and then allow a security analyst to assess whether the information has any operational relevance.

The alert itself is not intelligence.

It becomes useful only after analysis.

Does ABS mention geo-fencing?

Yes.

Geo-fencing is specifically listed among the possible online information-gathering and analytical methods.

The guideline does not explain the technology or prescribe how an FI should implement it.

Therefore, detailed technical applications should not be attributed to ABS without another source.

Should FIs use media reports as intelligence?

Media reporting is one of the sources specifically identified by ABS.

However, receiving a media report is only part of the intelligence process.

The FI should still analyse the information and assess its relevance before using it to make a security decision.

This distinction becomes especially important during fast-moving incidents where early reports may be incomplete or inaccurate.

Can FIs receive intelligence from law enforcement?

ABS includes law-enforcement authorities among relevant information sources.

The document also encourages involvement in national security networks and initiatives.

This reflects the wider ABS theme that effective physical security depends on cooperation rather than operating entirely in isolation.

What is the Safety and Security Watch Group?

ABS encourages FIs to participate in national forums and initiatives such as the Safety and Security Watch Group (SSWG) Scheme, which provides platforms for information gathering and sharing.

The guideline also references SSWG elsewhere when discussing security cooperation.

For an article focused purely on what ABS says, it is sufficient to state that ABS encourages FI participation.

A separate article explaining the current SSWG programme in detail would require fresh research from official Singapore sources.

Should financial institutions share security intelligence with each other?

ABS encourages appropriate sharing.

It says that where relevant, financial institutions are encouraged to share non-sensitive information or intelligence with relevant industry peers in a timely manner so appropriate action can be taken.

The phrase non-sensitive is important.

Information sharing should not result in the disclosure of sensitive security information.

Does ABS encourage networking with industry peers?

Yes.

ABS refers to industry and security associations, seminars, conferences, workshops and networks with peers or subject-matter experts as possible ways of obtaining security-related insights.

This recognises that threat information can sometimes be more useful when shared across organisations facing similar risks.

What is Information Analysis?

Information Analysis is the third stage of the ABS intelligence cycle.

ABS says the FI should analyse collected information and place it into the relevant context to assess potential threats and risks to the organisation.

This is arguably the point at which information starts to become intelligence.

For example:

“A security incident occurred overseas.”

is information.

But:

“The incident involved the same type of premises and attack method relevant to our organisation, and therefore our current control should be reviewed.”

is analysis.

The second example is a consultant illustration of contextual analysis, not wording used by ABS.

Why is context important?

Not every security event reported globally requires an FI in Singapore to change its security posture.

The information needs to be assessed against:

location, relevance, plausibility, assets at risk and the organisation’s own threat environment.

This aligns with the wider ABS risk-assessment philosophy.

Consultant’s perspective

Useful analytical questions include:

Is this threat relevant to us?

Could it occur at our premises?

Which assets or people might be affected?

Do our current controls address it?

Has the likelihood or potential consequence changed?

Does management need to take action?

Should intelligence automatically trigger a security response?

Not necessarily.

The purpose of analysis is to establish whether action is justified.

Some information may be recorded and monitored.

Other intelligence may justify:

additional monitoring, employee awareness, landlord engagement, changes in access controls or raising the FI’s security posture.

The action should be proportionate to the assessed threat.

What is Dissemination?

Dissemination is the fourth phase of the ABS intelligence cycle.

ABS says the FI should have a communication plan identifying:

who should receive the intelligence, including relevant stakeholders and senior management, how and when it should be distributed and what reporting method should be used.

ABS gives examples such as:

email, written briefs and threat maps.

The fundamental requirement is timeliness.

Why must intelligence be disseminated quickly?

ABS says intelligence should generally be distributed in a timely manner so relevant stakeholders and senior management can initiate appropriate action and response.

Security intelligence that arrives after the threat has already passed may have investigative value but much less preventive value.

Consultant’s perspective

The dissemination urgency should therefore reflect the threat.

A general industry trend may support a periodic report.

A credible immediate threat near an FI office may require rapid escalation.

Does every intelligence report need to go to senior management?

ABS says the dissemination plan should identify the relevant stakeholders and senior management who need to receive the information.

It does not say every piece of raw information must be forwarded to every executive.

The word relevant matters.

Consultant’s perspective

A tiered approach can reduce information overload.

Routine monitoring may remain with the security team.

A material change in risk may go to senior security or facilities leadership.

A significant or imminent threat may require executive or crisis-management escalation.

That hierarchy is an implementation example rather than an ABS-prescribed model.

Does ABS require threat maps?

No.

ABS gives threat maps as one example of how intelligence may be reported, alongside email and written briefs.

Therefore:

“ABS requires banks to maintain threat maps”

would not be accurate.

Threat maps are one possible presentation method.

Does every FI need a dedicated intelligence analyst?

ABS does not state this.

The guideline establishes an intelligence process but does not prescribe:

staffing numbers, job titles or a dedicated intelligence department.

A smaller FI may incorporate the function into its security-management role, while a larger organisation might maintain a specialised intelligence capability.

That organisational decision should reflect risk, scale and resources.

Can a Security Control Room perform intelligence monitoring?

ABS does not specifically state that an SCR must perform the Security Intelligence function.

However, the two functions can complement each other.

The SCR may provide operational information from:

CCTV, alarms, access events and on-site security.

The intelligence function may provide external threat information.

Consultant’s perspective

Bringing the two together can improve situational awareness:

Operational monitoring tells you what is happening at the site.

Security intelligence helps tell you what may be developing outside the site.

The integration model itself is not mandated by ABS.

Can a GSOC combine security monitoring and intelligence?

ABS does not use the term GSOC in this section.

However, it separately recognises remote monitoring and describes a security-intelligence cycle.

Consultant’s perspective

A central GSOC could therefore combine functions such as:

remote CCTV and alarm monitoring, threat-intelligence monitoring, incident escalation and communication.

That is a modern operating model compatible with the functional concepts in ABS, but it should not be described as an ABS requirement.

Should intelligence affect the Physical Security Risk Assessment?

Potentially, yes.

Security intelligence helps an FI understand changes in the threat environment.

The Physical Security Risk Assessment separately requires the FI to evaluate applicable threats.

Consultant’s perspective

If intelligence shows that a threat has materially changed, the FI should consider whether:

the threat assessment, risk register or existing mitigation measures need review.

That connects Security Intelligence with the wider ABS risk-management cycle.

Can intelligence lead to heightened security measures?

Yes, conceptually.

The previous ABS section addresses increased security measures during heightened conditions.

Security intelligence can provide information that helps management decide whether a change in security posture is appropriate.

For example, credible intelligence may justify reviewing:

entry points, guarding, screening, employee communication or monitoring priorities.

Those are possible outcomes based on the ABS framework, not an automatic rule.

Should intelligence be objective?

ABS specifically says intelligence should be timely, accurate and objective.

This is important because security decisions can be distorted if intelligence is based on:

rumour, assumption or sensational reporting.

Consultant’s perspective

An intelligence product should distinguish between:

confirmed fact, unverified information, and analytical assessment.

That distinction is a practical analytical discipline, although ABS does not prescribe this exact terminology.

What happens if the source is unreliable?

ABS does not provide a formal source-reliability scoring system.

However, its requirement for accurate and objective intelligence strongly supports assessing information critically rather than accepting every report at face value.

Consultant’s perspective

Where possible, significant information should be corroborated before major security decisions are based on it, unless the urgency of the threat itself justifies precautionary action.

Should social media be monitored?

ABS mentions online platforms including websites and blogs but does not specifically prescribe social-media monitoring in the cited section.

Therefore, social-media monitoring should not be presented as an explicit ABS requirement.

It may be one possible external information source depending on the FI’s intelligence requirements and applicable governance.

Does ABS require continuous 24/7 intelligence monitoring?

No universal 24/7 requirement is stated in the Security Intelligence section.

The frequency should follow:

the FI’s intelligence priorities, risk level, threat environment and resources.

Consultant’s perspective

An organisation may combine automated alerts with periodic human analysis rather than requiring an analyst to manually search the internet continuously.

The key outcome is timely awareness of relevant information.

What should a Security Intelligence report contain?

ABS does not prescribe a report template.

A practical intelligence brief might contain:

Threat / Issue

What has happened or may happen.

Source

Where the information originated.

Assessment

Why it matters to the FI.

Potential Impact

Which locations, people or assets may be affected.

Recommended Action

What should be monitored or changed.

Distribution

Who needs to know.

This is a consultant’s example, not an ABS-defined format.

How should sensitive intelligence be handled?

ABS’s explicit AI and search-engine warning demonstrates that the FI should protect sensitive information while conducting intelligence activities.

The guideline also limits its encouragement of peer intelligence sharing to non-sensitive information.

Together, these points establish a useful principle:

Security intelligence should improve security without exposing the organisation’s own sensitive security information.

Common mistakes when interpreting the ABS Security Intelligence guidance

“Security intelligence means reading the news.”
No. ABS establishes a cycle of planning, collection, analysis and dissemination.

“More information is always better.”
Not necessarily. Planning and Direction exists so collection is driven by intelligence priorities.

“Everything found online is intelligence.”
No. Information needs to be analysed in context before its relevance to the FI is understood.

“ABS bans AI.”
No. The guideline warns staff not to enter sensitive FI information into search engines or AI chatbots where it could compromise classified information.

“All threat information should be shared across the industry.”
No. ABS encourages appropriate sharing of non-sensitive information or intelligence.

“Security intelligence is useful even if nobody receives it.”
ABS specifically requires timely dissemination to relevant stakeholders so action can be initiated.

A practical ABS Security Intelligence workflow

A financial institution can translate the ABS intelligence cycle into an operational process by first deciding what threats it needs to monitor and which locations or assets are most important. It can then assign suitable information sources and monitoring methods, gather relevant information, validate and analyse it in the FI’s own context, determine whether any security action is required, and send the resulting intelligence to the appropriate stakeholders.

Where the threat is significant, the intelligence may trigger further monitoring, management escalation or a change in security posture. Where no immediate action is required, it may instead contribute to the FI’s wider threat assessment or risk register.

At every stage, the organisation should avoid exposing sensitive FI information unnecessarily, particularly when using online search tools or AI systems.

Practical Security Intelligence Checklist

An FI should be able to answer:

• What are our physical-security intelligence priorities?
• Which locations, assets and threats are we monitoring?
• Do we have an information-collection or monitoring plan?
• Which internal and external sources are relevant?
• Are open and closed sources used appropriately?
• Are online alerts or search tools being used where useful?
• Do staff understand that sensitive FI information should not be entered into unapproved search engines or AI chatbots?
• Are relevant authority, regulator and industry sources included?
• Does the FI participate in suitable information-sharing networks?
• Is non-sensitive intelligence shared appropriately with peers?
• Is collected information analysed rather than simply forwarded?
• Is it assessed in the FI’s own operational context?
• Are significant sources and claims critically assessed?
• Is intelligence distributed only to the people who need it?
• Is urgent intelligence escalated quickly enough to support action?
• Can intelligence trigger a review of security posture or the Physical Security Risk Assessment?
• Are intelligence requirements periodically reviewed as threats change?

Conclusion

The ABS guideline treats Security Intelligence as part of the financial institution’s broader Detection capability.

It defines a four-stage intelligence cycle:

Planning and Direction → Information Gathering → Analysis → Dissemination.

ABS recognises a wide range of possible information sources, including public information, commercial reports, authorities, regulators, peers, industry networks and online tools.

But information alone is not enough.

It needs to be placed in context, assessed for its relevance to the FI and communicated to the people able to make security decisions.

One of the most current points in the revised guideline is also one of the clearest:

Staff should exercise care not to enter sensitive FI data into search engines or AI chatbots where doing so could compromise classified information.

The underlying principle is:

Good security intelligence is not about collecting as much information as possible. It is about identifying the right information early enough to make a better security decision.