In recent years food defence has moved far beyond being “just another risk assessment”.
During my time as technical author of the new PAS 96:2026, I had the privilege of working with some of the best minds in the global food defence community.
The recently released PAS 96:2026 Food Defence – Protection and Prevention from Deliberate Acts, builds on nearly two decades of guidance. Last revised in 2017, the document needed a fresh perspective to promote a broader “food protection” mindset. Food protection unites food safety, food defence and food authenticity as interconnected disciplines.
What’s new in 2026?
With our increasingly complex food supply networks, sophisticated threat actors and rising cyber threats, this version of PAS 96 provides a new holistic framework to identify & manage these risks.
The conversation has moved beyond individual sites to think about risks potentially cascading across the entire food supply network. This is reflected in the revised vocabulary being better aligned with industry terminology:
An evolving threat landscape...
Threats are not static. Climate pressures, geopolitical instability, ingredient shortages and increasingly sophisticated cyber capabilities all create new opportunities for those wanting to cause harm or make illicit gains.
A single incident or point of failure can cascade quickly and become an industry wide crisis. Real-world incidents are a reminder of the potential widespread implications:
• Cyber– a large-scale ransomware attack on a major meat processing business saw cascading disruptions from processing plants right through to feedlots impacting continuity of supply and animal welfare
• Malicious Contamination – a food tampering incident in Australia where sewing needles intentionally inserted into strawberries on one farm, triggered widespread public fear and a rapid and sustained drop in sales nationwide. What began as an isolated event, quickly escalated, with copycat incidents also occurring in other fresh fruit nationwide.
• EMA – cheaply produced, methanol-tainted alcohol caused multiple deaths in South-East Asia
Threats, vulnerabilities & risks. Don't get them confused...
One of the most useful clarifications in PAS 96:2026 is the distinction it makes between a threat, a vulnerability and a risk.
At the very heart of effective risk management is a clear understanding that a risk is not the same as a threat or a vulnerability.
Jason Bashura, a long-standing and passionate advocate for a food protection mindset, offers a simple but very effective analogy:
Imagine you’re driving at speed on a freeway…
• The pothole is the threat – its depth, width and exact location all determine the potential of the threat.
• The tyre is the vulnerability – every tyre is vulnerable, but a heavy truck tyre will be more resilient to the threat posed by the pothole than a low profile tyre on a sports car.
• The flat tyre (and possibly a blow-out, wheel damage or a resultant accident) is the risk – the risk is the actual harm that occurs when a threat and a vulnerability meet.
A risk can only occur when there is a vulnerability. A threat, without a vulnerability, is NOT a risk.
How can we reduce a risk?
Going back to our pothole and tyre analogy, there are many mitigation measures that could be applied: reduce our speed, get better tyres, install highly visible road signs warning of potholes or repairing the road.
To mitigate the risk, measures must be targeted to reduce or remove the vulnerability. Mitigation measure should always be proportionate to the risk.
In our pothole and tyre scenario, a mitigation measure to entirely remove the vulnerability would be to simply not drive on the freeway with the pothole. However this is not proportionate to the risk nor would it be practical.
The same logic applies in food operations. Typical mitigation measures fall into various categories:
• Physical access – installing locks, gates and badge systems for sensitive storage and processing areas.
• Process and engineering – utilising in-process tests which flag unexpected variances which could indicate product interference.
• Technology – utilising AI and machine learning to spot anomalies, in addition to established foreign body detection equipment such as metal detection and X-rays.
• Product-specific / tamper-evident – conducting mass balance, yield reconciliations and visual or tampering checks.
• Procedural and behavioural – utilising personnel security measures, paying genuine attention to staff wellbeing and sentiment, developing a food protection culture.
Targeted, rather than generic mitigation measures are the key.
Practical tools that can help you...
TACCP has been aligned with the Plan-Do-Check-Act (PDCA) cycle making it easier to integrate food defence with the continual improvement process models that most businesses already use.
Expert Tip: PAS 96:2026 is packed with multiple checklist prompts to help you assess threats and vulnerabilities and help to determine risk priorities.
Start planning. For the day, when it all goes wrong...
Even the best mitigation measures can’t eliminate every risk. PAS 96:2026 emphasises the need for a clear, predetermined and practised incident response capability.
You can always hope for the best, but you’re going to sleep better if you’re prepared for the worst.
Cyber incidents need particular attention. Unpatched or poorly managed internet connected systems can create easy entry points.
Having cyber specialists involved early in planning and preparedness exercises can dramatically reduce the damage. They will be able to greatly improve your vulnerability mitigation and reduce the time needed to recover from an incident.
Building a true food protection mindset...
Food protection is not the sole responsibility of the Food Safety or Quality Assurance teams.
Meaningful risk assessment and realistic mitigation measures require cross-functional teams bringing together Food Safety/Quality, Physical Security, Procurement, IT/OT, Operations and Logistics.
Recent high-profile cyber disruptions in the food sector have reinforced why cyber and OT considerations now belong inside the food protection conversation.
Organisations need to stay alert to continually evolving threat environments and to the dynamic interplay between threats and vulnerabilities that creates real-world risk.
Ultimately, food protection must be seen as a mindset rather than a rigid checklist.
Practical tips: Take a fresh look at your food defence plan...
If it’s been a while since your last thorough review, or if your current food defence approach is focused on physical site security alone, here are some straightforward ways to use PAS 96:2026 as a prompt for improvements:
Get your free copy and start the food protection conversation in your business...
Download PAS 96:2026, from the BSI Knowledge website. There is no cost – only the opportunity to strengthen what you already do.
Gather the right people around the table, and use the updated guidance as a structured prompt for honest discussion.
Organisations that treat food protection as a living mindset rather than a periodic compliance exercise will be those best placed to protect their products, their brands and their customers.
Need help with your food defence plan?
As always, if you need help to refresh your food defence plan, don’t hesitate to get in touch!
