Personal security has used a simple model for decades to describe a person's states of attention: the color code, popularized by the American instructor Jeff Cooper. Its value isn't in the theory, but in giving people a common language to talk about something that is hard to teach: when to pay attention and what to do with what they notice.
In Seguridad 360 we use an adapted version: the same states apply to the physical and the digital environment, because the attacker who takes advantage of a distraction on the street and the one who sends an urgent WhatsApp message exploit exactly the same thing: our lack of attention.
The four states
| State | What it means | In the physical environment | In the digital environment |
|---|---|---|---|
| White | Total distraction. The surroundings go unnoticed. | Walking while looking at your phone; opening the door without seeing who's knocking. | Clicking by reflex; replying to messages without reading the sender. |
| Yellow | Relaxed, constant attention. This is the recommended state. | Noticing who is around when entering or leaving a place. | Checking the sender, link and context before acting. |
| Orange | Something out of the ordinary is detected. A response is prepared. | Someone insists on entering without a badge; a vehicle stops for no reason. | An email urgently asks to change bank details; a link doesn't match. |
| Red | The situation is happening. The plan is executed. | Move away, find a safe place, ask for help and report. | Stop, disconnect if appropriate, report immediately through the defined channel. |
Living in yellow isn't living in fear
The goal isn't to make people paranoid. Spending the day in orange is exhausting and leads to mistakes. The yellow state is simply attention with judgment: the same level we use when driving. We know something could happen, we observe and, thanks to that, we react sooner.
At the office, the white state is only reasonable when the environment is truly controlled. And that depends on other people being in yellow: reception, security, IT and every employee who decides whether or not to hold a door.
How to bring the color code to your organization
1. Name the states in training
When a team shares a vocabulary, it's easier to ask for help: “I'm in orange with this email” is a phrase anyone understands, and it invites people to verify together.
2. Define what to do in orange
The orange state needs simple instructions: whom to call, what not to do (don't pay, don't open, don't confront) and how to verify through an independent channel.
3. Practice red
In red there is no time to read a manual. Evacuation drills, phishing-reporting exercises and incident response tests turn the plan into reflex.
4. Measure and recognize
Count how many reports you receive, not just how many incidents occur. An increase in reports usually means people are in yellow.
Conclusions
The color code turns attention into a trainable habit. Its greatest contribution to a company is uniting physical and digital security in a single language: the same judgment that prevents a surprise in the parking lot prevents email fraud.
Frequently asked questions
What is the color code in security?
It is a model of four states of attention —white, yellow, orange and red— that describes a person's level of awareness of their surroundings and guides how to react to a possible threat.
What state should an employee be in during the workday?
Yellow: relaxed, constant attention. Enough to detect the unusual without creating stress or distrust of others.
Does it also apply to cybersecurity?
Yes. The same states can be used to evaluate emails, messages, calls and digital requests before acting.
Sources
- Internal document “Curso de Seguridad y Comportamiento Preventivo” (course reference material, in Spanish)
Bring this topic to your organization
The Seguridad 360 Course turns these ideas into habits. Next edition: October 31, 2026 (taught in Spanish).