Protests have led to massive riots and damage throughout French cities and towns. As the world begins to contemplate the events and the future of western Europe, security leaders responsible for sensitive facilities have a more immediate problem to resolve – how to protect critical assets when the area outside your perimeter is at risk of descending into chaos.

The demonstrations, which brought hundreds of thousands of people into the streets, descended into clashes, arson, and attacks on public buildings. The events illustrate how mob mentality can influence the security of a facility, even when that facility isn’t a direct target.

For data centers, renewable energy sites, military installations, power stations, transportation hubs, and other critical sites, the immediate challenge isn’t necessarily an organized attempt to breach the perimeter, rather the loss of predictability around it.

The security problem begins before the fence

A facility’s security procedures are usually designed around recognizable patterns: established access routes, expected vehicle movements, routine deliveries, and known activity near its boundaries.

Civil unrest can disrupt those patterns.

Road closures may divert pedestrians and vehicles toward normally quiet approaches. Emergency services may be occupied elsewhere in the event of an emergency or mass break-in. Smoke or damaged infrastructure can complicate visual monitoring. 

Security teams must continue protecting the site while distinguishing ordinary movement and potentially hostile activity and the unknown unknowns make security planning that much more difficult. It only takes one bad actor to create a security situation.

Therefore, the real operational question is – what’s happening, where’s it happening, and does it require action?

The threat may not be where you’re looking

When unrest breaks out near a sensitive facility, the most visible disturbance naturally attracts attention. A protest a few blocks from the main entrance may draw surveillance resources and security personnel toward that area.

But the most visible activity isn’t necessarily the most dangerous. While attention is focused on the crowd, someone could attempt to enter through a less-observed service gate. A vehicle approaching a restricted area from an unexpected direction might carry individuals intending to vandalize the facility, or a family following a GPS diversion.

These incidents don’t need to be connected. Road closures and crowd movements create second- and third-order effects. Some are harmless; others may conceal attempts at sabotage.

Security teams therefore must maintain awareness across and even beyond the site, without treating every unusual movement as a threat or overlooking genuine danger.

Turning fragmented information into a coherent picture

Facilities already rely on multiple security technologies, from perimeter intrusion sensors and access-control systems to radar, thermal imaging, video surveillance, and other monitoring tools. The problem isn’t necessarily a lack of information, rather that each system reveals only part of an event.

An access-control system may flag an unusual entry attempt while a perimeter sensor detects activity at a fence and cameras identify movement nearby. Viewed separately, these are disconnected alerts requiring operators to investigate their significance.

Together, with location, timing, and behavioral context, they may reveal a developing intrusion, or establish that the activity is harmless.

Operators need to quickly determine whether events are connected, how the situation is evolving, and whether to continue monitoring, investigate, secure an access point, or initiate an emergency response. In short, they need to understand which events matter while there’s still time to act.

The difference between reacting and responding

During a crisis, security teams may be stretched thin while law enforcement faces competing demands. Overreacting to harmless activity diverts limited resources while responding too slowly to a real threat can allow a manageable incident to escalate.

This is precisely the challenge the Tessera Platform is designed to address. Tessera connects existing security infrastructure with specialized sensing technologies, learns normal site activity, and identifies meaningful deviations. By cross-validating information from multiple OSINT sources and deployed sensors, our intelligence engine helps operators predict understand events in context, prioritize potential threats, and coordinate responses according to site-defined procedures and levels of autonomy.

The lesson from France extends beyond any single episode of unrest. Security leaders can’t control conditions outside their facilities or predict every threat, but they can improve their ability to recognize change, understand its significance, and respond appropriately. In an unpredictable world, protecting critical infrastructure depends as much on understanding what is happening beyond the fence as on the strength of the fence itself.