When new leadership stepped in at Penn Cove Group (PCG) last year, one of the first priorities became clear: we needed a better system for identifying and addressing vulnerabilities across our properties. Oxford Athletic Club was the first site we assessed, and from there we developed a framework that has since expanded to North Park Sports Complex and Cool Springs.

From physical safety to operational readiness, numerous assumptions existed, but there was a lack of structure. Over the last year and a half, we’ve built a proactive, systematic approach to risk management and emergency planning that prioritizes both people and property.

At PCG, we believe security isn’t just about reacting to threats; it’s about anticipating them. Our goal is to identify, manage, and mitigate vulnerabilities before they become incidents. While we had basic safety procedures in place, we lacked a unified protocol for vulnerability assessment and response. The key questions quickly emerged: Who is accountable for what? How do we train for real-world scenarios? Where are we most exposed?

To answer them, I spearheaded a comprehensive vulnerability management initiative that redefined how PCG views physical and operational risk. Our process began with on-site walkthroughs alongside local first responders. Together, we mapped out every potential risk point in our buildings. Their insights—on access control, visitor management, communication protocols, and employee response training—shaped a clear action plan tied to accountability, timelines, and measurable outcomes.

With this blueprint in place, we are now setting a new company-wide standard. At Oxford Athletic Club alone, we’ve already addressed nearly 75% of identified vulnerabilities, strengthening confidence among staff and members alike. More importantly, this initiative has laid the foundation for resilience across all PCG companies.

For us, security can’t be an afterthought—it must be built into every aspect of operations. As organizations that serve people in physical spaces, it was worth pausing to ask the tough questions. Because the real issue isn’t whether an incident will occur, but how prepared we are when it does.