Three out of four U.S. workers have skipped going into work because of a hazardous condition like severe weather, a security concern, or an infrastructure failure. That instinct isn’t overcautious: The U.S. recorded a dozen billion-dollar weather disasters in just the first half of 2026 alone, according to Climate Central.
What’s potentially more disturbing is how this vast number of workers find out something is wrong in the first place. More than half (54%) hear about it from news outlets and social media or word of mouth (39%). Employer communication trails fourth in its own emergency chain, according to a recent Envoy survey of U.S. adults employed at physical locations.
The fact is that most employers find out about a threat the same way their employees do: by seeing it on the news or in a social feed. Somewhere in facilities or HR, there’s a person who has to notice something is happening, decide it’s relevant to the workplace, figure out who needs to know, write the message, and send it. Every one of those steps takes time, creating a gap while an active situation continues to develop. The data doesn’t reflect the fact that employers care about keeping their people safe, but the tools and processes are reactive by design.
Closing the gap means taking the human latency out of that first mile. It’s a shift from “someone will send an update when they get to it” to threat monitoring that’s always on, message templates already written for the scenarios you can anticipate, and recipient groups already defined by site and shift. When a threat crosses a threshold, the right people should hear from their employer in the same beat they’d otherwise hear a news alert (or before), except that message actually tells them what to do. The goal is to be the first source that’s also authoritative and actionable.
When Risk Isn’t Evenly Distributed
Beyond weather disasters, the survey finding that should worry facilities and security teams most is that workers who’ve experienced crime or violence near their workplace are nearly three times more likely to find out about a disruption on their own than to hear it through an official channel. That’s exactly backwards, and it usually happens because high-risk sites run on the same passive, one-size-fits-all communication cadence as everywhere else.
The fix is to treat risk as a variable, not a constant. A late-night warehouse shift, a location in a higher-crime area, or a site near a frequent protest corridor shouldn’t be waiting on the same corporate broadcast that goes to a low-risk suburban office. That means lower alert thresholds for those locations, monitoring tuned to the threats they actually face, and notifications segmented by site and shift so the right people get something relevant instead of noise they learn to tune out. It also means knowing who is genuinely on that shift or in that building at the time. The teams that get this right treat emergency communication as something that flexes to match where risk actually concentrates.
A Realistic First Step, Without a Security Operations Center
The good news is that the first step does not require standing up an expensive security operations center. It’s connecting things most facilities managers almost certainly already have. Most are already collecting the raw ingredients: some form of check-in or occupancy data that shows who’s in the building, and some way to send a mass notification. The problem is that detection, notification, and presence usually live in three separate systems that don’t talk to each other, so pulling them together in a crisis becomes a manual scramble at the worst possible moment.
Start narrow and practical. Pick your highest-risk location and do three things. First, get to a single view of who is actually present rather than who’s on the org chart. A notification sent to 500 people on a roster might only reach the 200 who are really there. Second, pre-write templates for the handful of scenarios you can reasonably anticipate at that site, so no one is drafting under pressure. Third, define your recipient groups by location and shift ahead of time, and make sure every alert is logged automatically. None of that requires a big budget or a dedicated team.
The Audit Trail Regulators Will Actually Ask For
When something happens, regulators, insurers, and attorneys ask three questions: Did you know? Did you communicate? Can you prove it? Most organizations can only partially answer the first two.
A real audit trail is a timestamped chain that runs from the first signal to the final acknowledgment. It has to be captured automatically as events happen, not reconstructed afterward. In practice, that means a record of what threat was detected and when; what decision was made and by whom; who was notified, through which channel, and at what time; who was actually present or at risk in that moment; and who acknowledged the message. When a regulator, an insurer, or a plaintiff’s attorney asks, the answer should come from a single source.
This is where most organizations fall short. They can usually establish that they knew something and sent something, but the proof is archaeological because they stitched it together after the fact from emails, chat logs, badge data, and people’s memories, across systems that were never designed to talk to each other. And they often can’t connect the message to who was actually in the building, which is the part that matters most for duty of care. With standards like California’s SB 553, OSHA’s emergency action plan requirements, and ISO 45001 all pushing in this direction, “we think we handled it” is no longer a defensible answer. The trail has to be automatic, or it effectively doesn’t exist.
Closing the Distance Between Detection and Duty of Care
Workers said they need faster warning, more decisive communication, and proof that safety extends to everyone, not just the C-suite. None of that requires reinventing how a facility operates. It requires connecting what’s already there— presence, detection, and notification—so the people closest to the risk hear from their employer first.
Aditi Ganpule is the product lead for Envoy Response, Envoy’s threat detection and incident management product. She’s spent her career building enterprise B2B software, with roles at Yelp, DoorDash, and Envoy, where she previously led the workplace spaces product before returning to help build Envoy’s move into safety and security. She’s drawn to products where getting the details right has real stakes for the people who depend on them.