TSCM Partners · Security framework
Proximity Threat Management (PTM)
Beyond traditional TSCM. A structured approach to surveillance risk management.
Traditional TSCM investigates technical surveillance. PTM brings surveillance-related exposure into a structured, repeatable and accountable security management process.
Confidential information can be exposed without a cyber breach. Conversations can be overheard, screens observed and electronic devices used to collect information.
Proximity Threat Management combines specialist TSCM expertise, structured assessments and purpose-built software to identify, assess and manage the conditions that make surveillance possible.
People
Specialist expertise
Methodology
Repeatable assessments
Software
Comparable findings
What Is Proximity Threat Management?
Proximity Threat Management (PTM) is a specialist information security framework for identifying, assessing, reducing and monitoring surveillance-related risks arising from physical, visual, acoustic, electronic and environmental exposure to confidential information.
Developed by Marko Tuisk, PTM builds upon established Technical Surveillance Countermeasures practices by connecting specialist field inspections with structured risk assessments, documented evidence and ongoing security management.
The framework examines not only whether surveillance equipment is present, but also whether an environment creates opportunities for information to be observed, recorded, intercepted or inferred.
What is a proximity threat?
A proximity threat arises when a person, device or collection capability can gain sufficient access to an information source to observe, capture or infer sensitive information through a physical or locally situated technical pathway.
The person operating the collection equipment does not necessarily need to be nearby. For example, a microphone installed inside a meeting room may be operated remotely.
Diagram 1: How proximity creates information exposure
Confidential information
Boardroom discussions · Documents · Screens · Activities
Visual exposure
Acoustic exposure
Electronic exposure
Physical access
Potential collection opportunity
Observe · Record · Intercept · Infer
PTM assessment and controls
Identify · Evaluate · Reduce · Verify
How confidential information may be exposed through physical, visual, acoustic and electronic pathways.
Diagram 1: Simplified conceptual model. In the technical specification, exposure pathways and collection capabilities are assessed separately. One threat scenario may involve several pathways.
Why Traditional Security Controls Are Not Always Enough
Organisations rely on multiple layers of security to protect information, people and infrastructure. Cybersecurity protects digital systems and information. Physical security manages access to buildings and restricted areas. Technical Surveillance Countermeasures provide specialist capabilities for detecting and investigating technical surveillance threats.
These disciplines already overlap and complement one another. However, sensitive information may still be exposed through ordinary business activities and the environments in which they occur.
PTM brings these proximity-related exposures into a defined assessment and management process.
Diagram 2: PTM's relationship with existing security
Cybersecurity
Digital systems and data
Physical security
Premises and access
TSCM
Technical surveillance
Proximity Threat Management
A specialist assessment and management process that draws on relevant controls and evidence across existing disciplines.
Information security governance
Risk owners · Treatment decisions · Evidence · Continual improvement
Relationship between PTM, TSCM, cybersecurity and physical security.
Diagram 2: PTM complements established disciplines. It does not replace their control ownership or claim that existing security frameworks exclude proximity-related risks.
How Does PTM Extend Traditional TSCM?
Advanced TSCM providers may already offer many of the capabilities compared here. PTM does not describe conventional TSCM as nothing more than a search for hidden devices. The distinction is that PTM makes the management process explicit and systematic.
| Dimension | Conventional TSCM engagement | PTM programme |
|---|---|---|
| Primary objective | Investigate technical surveillance threats and vulnerabilities | Manage proximity-related information exposure |
| Assessment focus | Technical surveillance and relevant environmental vulnerabilities | Collection pathways, information exposure, controls and risk |
| Delivery | Specialist inspection and reporting | Specialist inspection integrated with a structured management process |
| Findings | Technical observations and recommendations | Structured findings linked to information assets, risk owners and controls |
| Repeat assessments | Available depending on service | Defined methodology for comparable assessments |
| Management reporting | Depends on provider and engagement | Explicit framework requirement |
| Emerging threats | Addressed through evolving specialist capabilities | Capability-based threat classification and controlled updates |
PTM does not replace professional TSCM. It provides a framework for connecting specialist technical assessments to broader information security risk management, with documented findings, accountable actions and comparable evidence over time.
Understanding the Proximity Attack Surface
Five exposure domains
Physical
Access to information sources, devices, rooms, documents and infrastructure.
Visual
Direct observation, photography, optical collection and screen visibility.
Acoustic
Overheard speech, sound transmission, microphones and vibration-based collection.
Electronic and RF
Wireless transmission, electronic implants, emissions and local interception.
Connected and autonomous systems
Networked sensors, smart devices, wearables, robotics and AI-assisted collection.
These are useful public-facing domains, not five mutually exclusive categories. One exposure scenario may involve more than one domain.
Why proximity is not limited to being inside a room
The person using a collection capability does not have to be in the room where the information is created.
Authorised access with recording equipment. An authorised person can carry a recorder into a meeting. The exposure comes from the capability they bring with them, not only from whether they were permitted to enter.
A line of sight from outside. Someone outside the building can see into an office, photograph a screen, or read material left in view. They do not need to enter the room.
A connected device and a remote operator. A microphone, sensor or other connected device inside the building can send information to a person elsewhere. The operator does not need to be nearby.
The PTM Framework
PTM follows a structured assessment and improvement cycle. It begins with understanding which information requires protection and how it may be exposed. Findings are then evaluated, treated and verified, with subsequent assessments supporting ongoing management decisions.
Diagram 3: The six-component PTM framework
01
Information and assets
Define what needs protection
02
Exposure and proximity
Identify collection pathways
03
Threat assessment
Evaluate plausible scenarios
04
Controls and treatment
Reduce or manage exposure
05
Verification and evidence
Test and document outcomes
06
Monitoring and improvement
Reassess changes over time
Repeat · Compare · Improve
From scope definition to verified controls
The six components above are the conceptual architecture. A PTM assessment follows seven operational stages: scope, exposure mapping, threat identification, risk assessment, treatment, verification and reassessment. The components describe what the framework covers. The stages describe the order of the work. They are not two competing models.
How a PTM Assessment Works
A repeatable seven-stage assessment process
- Define the scope. Identify information assets, locations, activities and assessment limitations.
- Map exposure. Identify physical, visual, acoustic and electronic pathways.
- Identify threats. Conduct field inspections, technical assessments and relevant environmental reviews.
- Evaluate risk. Assess plausible collection scenarios, existing controls, consequences and uncertainty.
- Recommend treatment. Document proportionate countermeasures, owners and priorities.
- Verify outcomes. Retest where appropriate and document residual exposure.
- Review and improve. Compare assessments and update findings following material changes.
Real-World Examples of Proximity Threats
How proximity threats arise in everyday business environments
| Business situation | Potential exposure | PTM assessment focus |
|---|---|---|
| Confidential board meeting | Conversations recorded by an unauthorised device | Acoustic exposure, device inspection and room controls |
| Mergers and acquisitions discussion | Sensitive documents or screens observed | Sightlines, access and information handling |
| External contractor working after hours | Opportunity to introduce recording equipment | Access, supervision and technical inspection |
| Executive meeting in a hotel | Unknown devices and surrounding spaces | Temporary venue exposure assessment |
| Smart glasses worn during negotiations | Visual and acoustic recording | Wearable capabilities and device policy |
| Connected meeting-room AV | Unintended recording or remote access | Microphones, cameras, system configuration and control ownership |
| Autonomous cleaning robot | Sensors collecting information in sensitive areas | Movement, permissions, sensing and data handling |
| Confidential office visible from another building | Long-distance observation or photography | External line of sight and visual countermeasures |
Diagram 4: One practical scenario
Example: Executive boardroom
Information source
Confidential acquisition discussion
Exposure pathway
Speech audible beyond the room
Potential collector
Person or microphone in an adjacent space
PTM assessment
Inspect the environment, assess speech leakage, review existing controls and document the exposure.
Management outcome
Evidence, recommended countermeasures, assigned actions and verification requirements.
Example of a boardroom acoustic exposure pathway and PTM assessment.
Illustrative scenario, not a documented client incident.
People, Methodology and Software
PTM is delivered through specialist professionals applying a documented assessment methodology, supported by software that records findings and evidence in a consistent format.
This enables organisations to compare assessments across locations and over time, track remediation and make informed decisions based on documented exposure rather than isolated inspection results.
Diagram 5: People, methodology and software
TSCM Partners
Technical Surveillance Countermeasures + Proximity Threat Management
People
Professional expertise
Methodology
Structured assessments
Software
Consistent data
Proximity Threat Management
- Repeatable assessments
- Comparable findings
- Evidence-based decisions
From Inspection Findings to Measurable Risk Management
Comparing findings over time
Example: Findings recorded across repeated assessments
Illustrative dataset. Not actual PTM performance results.
- High-priority findings
- Medium-priority findings
| Review | High-priority findings | Medium-priority findings |
|---|---|---|
| Baseline | 12 | 18 |
| Review 1 | 9 | 16 |
| Review 2 | 6 | 12 |
| Review 3 | 4 | 9 |
Illustrative comparison of findings across repeated PTM assessments.
A reduction in recorded findings is not necessarily proof of reduced risk. Meaningful comparison requires consistent scope, classification, assessment procedures and documentation of changes.
What management can measure
| Metric | Management question |
|---|---|
| Assessment coverage | Which sensitive areas have been assessed? |
| Open findings | What identified exposures remain unresolved? |
| Remediation status | Are agreed actions being completed? |
| Control verification | Have implemented safeguards been tested? |
| Exposure trends | What has changed since the baseline? |
| Evidence completeness | Can the findings and decisions be reviewed? |
Emerging Threats: AI, Robotics and Connected Sensors
Surveillance capabilities are changing. Devices that were once passive or limited in function may now combine cameras, microphones, environmental sensors, wireless communications and AI-assisted processing.
PTM is designed around exposure pathways and collection capabilities rather than fixed lists of surveillance equipment.
This allows new technologies to be assessed using the same fundamental questions: what information can the system access, what can it collect or infer, where can the information be stored or transmitted, and which controls limit that exposure?
Assessing emerging technologies using the same framework
| Technology | Collection capability | Assessment considerations |
|---|---|---|
| Smart glasses | Image, video and audio capture | Recording controls, access and data transmission |
| AI meeting assistants | Speech capture and transcription | Consent, data handling, access and retention |
| Autonomous robots | Mobile cameras and sensors | Operating areas, schedules, collection and storage |
| Smart building sensors | Occupancy and environmental data | Information inference, aggregation and access |
| Drones | Remote visual or other sensor collection | External observation pathways and site exposure |
The point is not that these technologies are inherently hostile. PTM evaluates whether their capabilities create an unacceptable information exposure in a particular environment.
How PTM Supports Existing Security Frameworks
| Framework | Relationship to PTM |
|---|---|
| ISO/IEC 27001 | PTM assessment evidence can support relevant information security risk management activities |
| ISO/IEC 27002 | PTM can inform the implementation and evaluation of relevant security controls |
| ISO 31000 | PTM can use established risk management principles |
| NIST CSF 2.0 | PTM findings can inform relevant security governance and risk outcomes |
| NIST SP 800-53 | PTM can support assessment of applicable physical, environmental and technical controls |
| MITRE ATT&CK | Relevant adversary techniques may inform threat scenarios |
Does PTM replace ISO 27001 or traditional TSCM?
No. PTM is a specialist framework intended to complement established security disciplines. It does not replace an information security management system, independently certify controls or guarantee that surveillance threats will be detected.
About the Framework
Proximity Threat Management was developed by Marko Tuisk to bring together specialist Technical Surveillance Countermeasures, structured assessment practices and software-supported security management.
PTM Framework v1.0 establishes the initial scope, principles and operating model for assessing surveillance-related information exposure.
The framework is intended to evolve through practical application, technical research and professional review, with future revisions documenting changes to terminology, assessment procedures and emerging threat categories.
Framework publication
Initial release
| Framework | Proximity Threat Management |
|---|---|
| Abbreviation | PTM |
| Version | 1.0 |
| Developer | Marko Tuisk |
| Publisher | TSCM Partners |
| Validation | Independent validation not yet claimed |
Where PTM connects
- TSCM services
The established technical discipline for investigating surveillance threats.
- Executive and boardroom privacy
Technical protection for sensitive meeting environments.
- Continuous RF monitoring
Ongoing surveillance detection while a space remains in use.
- Core TSCM threat categories
How technical surveillance threats are grouped for an assessment.
Frequently Asked Questions
What is Proximity Threat Management?
PTM is a specialist framework for identifying, assessing and managing surveillance-related information exposure through physical, visual, acoustic, electronic and environmental pathways.
How is PTM different from TSCM?
TSCM provides specialist technical surveillance capabilities. PTM integrates relevant TSCM assessments into a wider, documented process for managing proximity-related information security risks.
Can PTM help prevent corporate espionage?
PTM can help organisations identify and reduce opportunities for unauthorised information collection. It cannot eliminate every espionage risk or guarantee that an environment is free from surveillance.
Is PTM relevant to AI-enabled devices and robotics?
Yes. PTM's capability-based approach allows organisations to assess how new technologies may collect, process, infer or transmit sensitive information.
Is PTM a recognised international security standard?
No. PTM is a specialist framework developed by Marko Tuisk. It is intended to complement established standards and security practices, not replace them.
Traditional TSCM investigates technical surveillance. PTM brings surveillance-related exposure into a structured, repeatable and accountable security management process.
Request an assessment