From End-to-End Protection to Resilience-by-Design

The Five (5) A’s of Tourism Security in a World of Compound Risk

Part 1 of 2 parts

When I wrote Tourism Security: End to End for SecurityMatters in 2013, the central argument was straightforward: a tourist does not experience security by agency, establishment, or jurisdiction. The tourist experiences one journey.

More than a decade later, that observation has become more consequential.

The tourism environment of 2026 is being shaped by geopolitical tension, climate disruption, cyber incidents, misinformation, changing traveler behavior, infrastructure vulnerability, and increasingly complex international mobility. The World Economic Forum’s Global Risks Report 2026 describes uncertainty as the defining theme of the current global risk outlook. Its Global Cybersecurity Outlook 2026 similarly describes a digital environment in which local failures or targeted attacks can cascade across interconnected systems.

Tourism operates within this interconnected system. Travelers may face cyber scams before departure, airport disruptions upon arrival, unsafe transport to hotels, medical emergencies during activities, or communication failures during severe weather events. These challenges are not unique to any one country.

The incident may occur in one place. The tourism consequence travels everywhere. That is why the question for 2026 is no longer simply:

How do we secure tourism? Can the tourism system remain safe, functional, trusted, and recoverable when something goes wrong?

That is the resilience test.

The Five A’s Still Work

Tourism frameworks have accumulated additional categories over the years. Available Packages and Ancillary Services were useful additions because they recognized the growing importance of tour operators, supporting institutions, healthcare, communications, policing, financial services, and other parts of the tourism ecosystem.

But continuously adding categories creates a problem. A framework that becomes too complicated becomes difficult to remember, teach, assess, and operationalize.

For tourism security, the original journey remains a better organizing structure.

The Five (5) A’s are:

1. Attractions

2.  Accessibility

3.  Accommodation

4.  Activities

5.  Amenities

The difference in 2026 is what we put inside them.

The Five A’s should no longer be treated merely as components of tourism development. They should be treated as systems that must be protected, prepared, connected, and made resilient. Available Packages and Ancillary Services remain important, but they can be integrated into the Five A’s rather than becoming separate categories. One more important change is needed.

Assurance should not become another A. Assurance should be the outcome.

Assurance: What the Tourist Actually Buys

A destination can have beautiful attractions, modern hotels, efficient airports, exciting activities, and excellent restaurants.

The visitor can still feel unsafe. That gap between capability and confidence is where Assurance matters. Assurance is the reasonable confidence that:

· risks are understood;

· services are dependable;

· information is credible;

· assistance is available;

· disruptions will be managed;

· and the destination can recover.

Assurance cannot be created by advertising. It is earned through performance.

A destination demonstrates Assurance when an airport disruption is managed without leaving visitors stranded, when a typhoon warning leads to timely changes in activities, when a medical emergency receives competent assistance, when a cyber incident is contained without compromising guest trust, and when officials communicate clearly instead of allowing rumor to define the story.

The Five A’s are therefore the system. Resilience is the operating principle. Assurance is the result.

The Philippines 2026-2027

The Philippine tourism landscape is more complex than the typical narrative of “potential versus performance.”

The country possesses significant tourism assets and a substantial tourism economy. However, its international visitor volume remains below that of major ASEAN competitors.

ASEAN’s tourism recovery accelerated through 2025. The ASEAN Tourism Outlook reported that climate change, disasters, pandemics, economic downturns, digital transformation, changing consumer behavior, and capacity gaps. Most importantly, a distinction that should matter to Philippine tourism: recovery is not enough; tourism must transform to become resilient.

Preliminary ASEAN figures indicate approximately 147 million international visitors in 2025. Tourism contributed an estimated 9.7 percent of ASEAN GDP in 2024 and supported approximately 42 million jobs.

The Philippines is participating in this regional recovery, but the comparison remains instructive. The challenge is not a lack of attractions, but rather the inconsistent conversion of these assets into a reliable end-to-end visitor experience.

Come join the Department of Tourism (DOT) in partnership with Ace And Associates Risk Management, Inc. (AAA) and the Accommodation Establishment Security and Safety Coordination Council, Inc. (AESSCCI) in the development of our country’s tourism security and resilience protocol for 2026-2027 at PROtecTOURS 2026 this 17 September 2026 at SMX Clark, Pampanga (www.protectours.asia).

Why the Five A’s Matter to Philippine Competitiveness

1. Attractions: Protecting What Brings People Here

The Philippines has no shortage of attractions.

The challenge is protecting them while making them safely accessible and economically sustainable. A remote island may be globally attractive but have limited emergency medical capability. A heritage site may draw large crowds without having sufficient evacuation capacity. A beach destination may become vulnerable to coastal erosion, extreme weather, overcrowding, or environmental degradation. A location that suddenly becomes viral can experience visitor volumes that exceed the capacity for which it was designed.

Security therefore begins before visitors enter the site.

It includes environmental protection, carrying capacity, crowd management, emergency access, communications, fire and life safety, asset protection, and destination reputation.

2. Accessibility: The Journey Between the Destinations

The country is an archipelago. This remains one of the most critical issues for Philippine tourism.

A tourist does not simply arrive in the Philippines. The tourist moves through a chain of airports, seaports, roads, terminals, vehicles, ferries, aircraft, shuttles, taxis, and increasingly digital transportation platforms.

Every connection is another point of exposure. Weather can close an airport. A vessel can be canceled. A road can become impassable. A transport system can suffer a cyber or communications disruption. A tourist may become stranded without access to reliable assistance.

Resilient accessibility therefore requires redundancy. It requires alternate routes, alternate gateways, reliable information, safe vehicles and vessels, competent operators, emergency communications, and plans for stranded travelers. The question is not whether a transport system works on a normal day.

The question is whether it can adapt when the normal day disappears.

3. Accommodation: More Than a Secure Hotel

Hotels have traditionally been among the most organized components of tourism security. When I was with Shangri-La Hotels and Resorts, the Association of Hotel Security Officers of the Philippines (AHSOP) existed; now the AESSCCI spearheads the trust on security and safety.

But the accommodation environment has changed. Hotels, resorts, hostels, serviced apartments, and alternative lodging increasingly depend on digital booking platforms, electronic payments, guest databases, Wi-Fi networks, smart building systems, and cloud-based services.

The guest is simultaneously a physical person and a digital identity. Protecting the guest therefore requires both physical and cyber security. It also requires business continuity. What happens when power or telecommunications fail? What happens when a fire, flood, earthquake, medical emergency, security incident, or cyberattack affects the property?

A resilient accommodation provider doesn’t just have security equipment. It has trained people, tested procedures, backup arrangements, communications, and relationships with external responders.

4. Activities: Where Risk Becomes Personal

Tourism becomes experiential through activities – Diving, Island hopping, Trekking, Adventure sports, Festivals, Cultural experiences, Events, MICE, Wellness, Sports, Eco-tourism, Medical tourism – each activity has a different risk profile.

At this stage, the tourism industry must recognize a fundamental operational reality:

The tour guide, driver, boat operator, instructor, or activity staff member may become the first responder.

The quality of the outcome may depend on what that person does during the first few minutes. Resilience, therefore, requires more than regulatory compliance. It requires demonstrated competency.

Activity operators should understand weather triggers, emergency communications, first aid, evacuation, participant accountability, equipment limitations, and when to stop an activity.

The safest activity is not necessarily the one that never experiences a disruption.

It is the one that can recognize the disruption early and change the plan before it becomes an emergency.

5. Amenities: The Ecosystem Behind Tourism

This is where the broader tourism ecosystem belongs.

Amenities are not merely conveniences but already the  critical support systems.

This is also where the concept of Ancillary Services can be integrated without creating an additional category.

The tourist does not care which agency technically owns the problem.

The tourist cares whether help is available.

This is why destination resilience requires coordination among public, private, and community stakeholders.

Then there is Airbnb and the platformized tourism ecosystem

The tourism journey has also become increasingly platform-mediated. Airbnb and similar short-term accommodation platforms have expanded the range of places where visitors can stay, while comparable online travel platforms increasingly influence how tourists discover, compare, book, pay for, and review accommodation, transportation, activities, and packages.

They therefore sit across several of the Five A’s rather than belonging to a single category. They are part of Accommodation when they connect visitors with lodging, part of Accessibility when they facilitate transport and transfers, part of Activities when they sell tours and experiences, and part of Amenities because they provide digital payment, information, customer support, reviews, and other services that influence the visitor’s confidence.

This creates both resilience benefits and new vulnerabilities. Platforms can improve access, choice, information, and transaction convenience, but they can also introduce risks involving fraudulent listings, identity theft, payment fraud, misleading reviews, data breaches, platform outages, unverified operators, and fragmented responsibility when something goes wrong. The resilience question is therefore no longer simply whether a tourism establishment is secure. It is whether the digital platform, the service provider, the destination, and the visitor remain connected and accountable when the transaction or service is disrupted.

In the Five A’s framework, platforms should be treated as critical connectors across the tourism journey, with appropriate standards for verification, cybersecurity, consumer protection, emergency assistance, and accountability.

The New Threat: Compound Disruption

The security environment has also changed since 2013. The greatest concern is no longer necessarily a single threat.

It is the combination of threats.

Imagine a destination experiencing a severe weather event while a major transport route is disrupted.

At the same time, a cyberattack affects communications. False information begins circulating online. Tourists attempt to leave simultaneously. Hotels begin receiving stranded visitors. Hospitals experience increased demand. Local authorities struggle to maintain a common operating picture.

None of these problems has to be catastrophic on its own. Together, they can produce a tourism crisis.

For this reason, resilience planning must extend beyond single-hazard scenarios.

A tourism destination needs to ask: What happens when two or three systems fail at the same time?

Such scenarios reveal underlying vulnerabilities.

#PROtecTOURS2026 #TourismSecurity #Resilience #PhilippinesTourism #FiveA’s #i4CPH #DRR #AssetProtection #TourismResilience #SecureTravel #PHHospitality #DisasterRisk #SecurityMatters #PROtecTOURS