Capstone Security Solutions was born out of equal parts frustration and hope.
After years in the security industry, we kept seeing the same pattern: threat and vulnerability assessments (TVAs) that were more about checking boxes than providing insight. Reports were delivered, binders were filled, but few decision-makers walked away knowing what really mattered most or where to start.
On the guard compliance side, the picture wasn’t much better. For anyone trying to launch or manage a Private Patrol Operator (PPO) business in California, there was no clear roadmap — just a handful of outdated books and a maze of regulations spread across the California BSIS, Penal Code, Health and Safety Code, and Labor Code. We’d lived that struggle.
So in 2024, in Southern California, we decided to do something about it. We founded Capstone Security Solutions to make security assessments meaningful and PPO oversight approachable.
Our story started long before Capstone’s name was chosen. As the Qualified Manager for one of the largest security companies in the nation, our CEO had to rebuild the organization’s compliance system from the ground up. No templates. No guidebooks. Just an understanding that accountability mattered. That experience shaped how we built Capstone — focused on clarity, practicality, and raising the bar for how security services are managed and measured.
Our COO is the heart of Capstone. She’s the calm in the storm, the organizational engine, and the person who makes sure every client interaction feels human. Together, we balance process with purpose — structure with empathy.
The name Capstone reflects what we believe in: the final stone that completes a structure, placed with precision, care, and pride. It symbolizes completeness, quality, and reliability — values that guide how we work and who we work with.
Since 2024, Capstone has grown from a small consulting idea into a trusted partner for PPOs and organizations seeking meaningful risk insight. We’ve invested countless hours in legal updates, professional development, and collaboration with industry leaders like CALSAGA to stay ahead of California’s changing security landscape.
But at our core, we’re still a family business — small enough to know our clients personally, but focused enough to make an impact. Every project, whether conducting a threat & vulnerability assessment or a BSIS compliance audit, is another opportunity to help someone succeed and strengthen the industry we care deeply about.
Our mission remains simple: raise the standard of professionalism in contract security and help leaders make informed, confident decisions.
If you’re building something that deserves protection — or starting your journey as a PPO owner — we’d be honored to help you finish it strong. After all, every great structure deserves its Capstone.
Effective security requires more than technology — it requires leadership backed by proven credentials and hands-on experience.
Capstone Security Solutions is led by a licensed PPO Qualified Manager (QM) with the California Bureau of Security and Investigative Services (BSIS), ensuring compliance expertise for Private Patrol Operators across the state. Our leadership also holds the Certified Protection Professional (CPP) designation from ASIS International, the global standard for security management. In addition, we are a Certified CPTED Practitioner (CPD) firm through the U.S. CPTED Association, reflecting specialized expertise in Crime Prevention Through Environmental Design.
These credentials demonstrate more than academic knowledge — they represent a commitment to professional standards, continuous learning, and practical application. Combined with decades of real-world experience in public safety and security operations, they give Capstone clients the confidence that their compliance, assessments, and operational needs are handled with precision and accountability.
Acquire PPO licensing and prepare for BSIS audits with expert compliance consulting. We assist security contractors (PPOs) in meeting California's Private Security Services Act through tailored training, documentation review, and readiness strategies, ensuring a smooth audit process and regulatory success.
Protecting people and assets begins with a CPTED-informed physical threat and vulnerability assessment that delivers actionable results. By assessing the physical environment, you can identify risks and enhance safety by creating spaces that deter crime, reduce liability, and strengthen operational resilience.
Enhance resilience and profitability with measurable improvements to operations. We specialize in staffing model development, SOP creation, policy development, and related system improvements that streamline protocols, ensure compliance, and fortify your organization against evolving threats.
A Qualified Manager aligns your PPO operations with BSIS regulations, allowing you to navigate California's security contracting terrain confidently. They also mitigate against costly lawsuits that can arise from regulatory missteps, safeguarding your business's stability.
Our QM services will supercharge your audit and compliance objectives and provide peace of mind so you can focus on growth and deliver exceptional security services.
A Qualified Manager drives ongoing improvements to keep you ahead of industry shifts by actively monitoring legislative changes, refining your policies, and promoting continuous professional development for your team.
Our proactive approach will help you maintain your competitive edge by integrating compliance and risk management into every aspect of your operations.
A Qualified Manager demonstrates your commitment to excellence and BSIS compliance, boosting your company's credibility and reputation. This trustworthiness can attract clients and help secure contracts in a competitive industry.
Our QM services have supported PPOs in acquiring security contracts for one of California's five largest counties.
Every organization has unique threats and vulnerabilities—blind spots in surveillance, weak access controls, or inadequate perimeter security. These risks remain hidden without a comprehensive assessment, exposing your assets, employees, and operations.
Our threat and vulnerability assessments uncover these weaknesses and provide actionable recommendations, ensuring your business is equipped to deter and respond to threats.
Whether it's OSHA's workplace safety requirements, security industry standards and best practices (ANSI/ASIS/RIMS RA.1-2019), or security lighting standards, conducting a threat and vulnerability assessment demonstrates your commitment to meeting standards, avoiding costly penalties, and mitigating potential litigation.
Our threat and vulnerability assessments will help you stay ahead of the regulatory landscape, helping your business achieve full compliance while reducing liability risks.
A single security breach or incident can tarnish years of hard work. Conducting an actionable security vulnerability assessment is your best defense against the unexpected, ensuring your business remains a trusted name in your industry. By identifying and addressing security gaps, you can stop problems before they escalate into headlines.
Our threat and vulnerability assessments will help ensure your organization is ready for anything, minimizing risks that could harm your reputation.
Capstone Security Solutions is a Certified CARVER Assessment Professional (CCAP) firm. We apply the CARVER methodology—Criticality, Accessibility, Recoverability, Vulnerability, Effect, and Recognizability—to identify and prioritize threats to critical assets systematically. Our use of the CARVER+ platform delivers actionable, data-driven assessments with qualitative and quantitative insights. CARVER+ aligns with DHS and ASIS standards and is SOC 2 Type 1 and Type 2 certified, ensuring your data is protected to the highest security, confidentiality, and operational integrity standards.
A force multiplier occurs when Capstone Security Solutions leverages CARVER+ and the AI Informant (optional / added cost) service to deliver real-time, data-driven threat and vulnerability alerts to stakeholders in "nanoseconds." Combining these tools removes your need to incur additional costs and resources to build and manage a proprietary AI threat detection apparatus. The optional AI Informant service uses AI to analyze global open-source data across 200+ languages, providing early warning alerts on your organization's physical, cyber, political, and economic threats. These combined platforms empower leaders to prioritize risks, justify budgets, and act decisively.
An asset's criticality is measured by how severely its loss would impact mission or operational continuity. For example, a hospital's emergency power system is highly critical—its failure during an outage puts patient lives at immediate risk. Its essential role makes it a top-priority asset for protection and redundancy under CARVER's Criticality factor.
An asset’s accessibility is measured by how easily an adversary can approach, enter, or interact with it to carry out an attack. For example, an unlocked loading dock provides direct, unmonitored access to a building’s interior. This ease of access makes it a high-risk point under CARVER’s Accessibility factor and a priority for physical security upgrades.
An asset's recoverability is measured by the time it takes to be repaired, replaced, or recovered. For example, a campus's central security camera server is damaged during a break-in. Without a backup system, footage is lost, and surveillance is down for days. The delay in restoring coverage highlights poor recoverability, making it a high-risk asset under CARVER’s Recoverability factor.
An asset’s vulnerability is measured by how easily it can be damaged, destroyed, or compromised using known or likely attack methods. For example, a corporate campus with multiple public entrances, limited access control, and poor nighttime lighting is highly vulnerable—an intruder could move between buildings or access critical systems without detection. This lack of physical and procedural safeguards makes it a high-risk asset under CARVER’s Vulnerability factor.
An asset’s effect is measured by the severity of consequences resulting from a successful attack. For example, a targeted incident at a university research lab housing sensitive biological materials or proprietary data could lead to contamination, theft of intellectual property, and significant reputational and financial damage to the institution. The broad impact on public safety, research integrity, and institutional operations makes it a high-risk asset under CARVER’s Effect factor.
An asset’s recognizability is measured by how easily an adversary can identify it under operational conditions. For example, a residential roof access hatch or elevator penthouse door — often signaled by external ladders, cages, or signage and visible from nearby buildings or parking decks — is easily identified. Its function as an obvious entry point makes it a high-risk asset under CARVER’s Recognizability factor.
