Security leaders must view organised crime as a supply chain, argues Matt Horne, Director of Intelligence and Investigations at the investigation management app, Clue.ย
The Metropolitan Police’s recent recovery of ยฃ500,000ย of suspected stolen goods demonstrates the value of looking beyond offences to understand the wider criminal networks behind them. The operation resulted in arrests, asset seizures and the disruption of suspected criminal activity, while also creating opportunities to gather intelligence that could support future investigations and uncover links to broader organised crime activity.
This broader perspective is especially important when tackling organised crime groups. One lesson reinforced throughout my policing career was that lasting disruption requires more than enforcement action alone. Organised crime groups are often designed to withstand disruption, adapting their methods, replacing key individuals and exploiting new opportunities as they emerge. The challenge for investigators is not simply identifying those directly involved in offending but understanding the wider networks that enable criminal activity to continue.
My experience at the National Crime Agency (NCA) highlighted how organised crime often extends far beyond the immediate offence under investigation. While criminal activity might appear concentrated in one location, the individuals coordinating operations, moving illicit funds, facilitating logistics or handling communications were often operating elsewhere. Mapping these relationships was frequently the key to understanding the full scale of the threat and identifying the best points for intervention.
Organised crime should therefore be viewed less as a collection of individual offenders and more as an interconnected ecosystem. The questions for law enforcement and security professionals are not only who committed the crime, but how the operation functions, where its vulnerabilities lie, and which interventions will have the greatest impact. Success is measured not simply by arrests, but by the ability to weaken the structures that enable criminal enterprises to operate and adapt.
Criminal networks have adopted a business model
Traditional perceptions of organised crime often focus on hierarchical groups led by a small number of individuals. Today’s threat landscape is considerably more complex.
Criminal networks now operate with many of the characteristics of legitimate businesses, relying on specialist providers, outsourced services and interconnected supply chains to support their activities. Rather than maintaining every capability in-house, criminal groups increasingly access expertise on demand. Specialist facilitators offer services ranging from logistics and transportation to document fraud, encrypted communications, money laundering and cyber capabilities, allowing criminal organisations to scale activity rapidly and adapt to disruption.
Technology has accelerated this transformation. Online criminal marketplaces make it easier to acquire tools, services and specialist capabilities that previously required extensive resources or technical expertise, further lowering the barriers to entry and strengthening these criminal service ecosystems. The result is a highly interconnected environment where financial crime, cybercrime, fraud and organised criminal activity frequently overlap. A single facilitator may support multiple criminal groups, while the same infrastructure can be used across a range of illicit activities. Much like legitimate business supply chains, these networks are resilient because responsibility, expertise and resources are distributed across multiple actors rather than concentrated in a single organisation.
For security leaders, this means threats can no longer be assessed in isolation. Understanding the wider network behind an incident is becoming just as important as responding to the incident itself.
The greatest risks, often hidden in the infrastructure
One of the most significant challenges facing organisations is that the individuals carrying out criminal acts are not always those creating the greatest risk. Operations such as the National Crime Agency’s Operation Destabilise highlighted how a relatively small number of financial facilitators were enabling criminal organisations, cybercriminals and hostile state-linked actors to move and conceal funds on a global scale. The lesson for businesses is that focusing solely on visible threats can leave critical vulnerabilities untouched.
Criminal actors can often be replaced. Infrastructure, trusted networks, financial channels and specialist facilitators are frequently harder to replicate. Identifying and disrupting these enablers can have a far greater impact than responding to individual incidents in isolation. This principle applies equally to corporate security. Whether assessing third-party suppliers, financial transactions, insider threats or cyber risks, organisations benefit from understanding the systems that allow threats to operate rather than concentrating exclusively on the individuals involved.
Intelligence-led disruption in a connected world
The networked nature of organised crime becomes even more evident when offending extends across borders. Goods may be sourced in one country, moved through multiple jurisdictions and ultimately sold in another. At the same time, criminal proceeds can be transferred across international financial networks in a matter of minutes, while those directing the activity may never operate from the same location.
Although law enforcement agencies have strengthened their ability to share intelligence and coordinate operations, organised crime groups continue to benefit from their ability to operate across jurisdictions with relative ease. These networks are structured around opportunity, profit and access to criminal services, rather than geographical or organisational boundaries. This presents a growing challenge for investigators and security professionals. Understanding where a crime occurred is only one part of the picture. Criminal networks often span multiple organisations, jurisdictions and sectors, making it difficult for any single agency or team to build a complete understanding of the threat.
Throughout my career investigating serious and organised crime, the most effective operations focused on the relationships, dependencies and key enablers that allowed criminal networks to function. In many cases, success depended not on acting quickly, but on understanding how the network operated and where intervention would have the greatest impact.
Effective information sharing is therefore critical. By connecting intelligence from multiple sources, investigators and security teams can uncover hidden relationships, identify patterns of activity and build a more complete picture of how money, information and goods move through a network. This helps identify key facilitators, expose vulnerabilities and determine which interventions are most likely to disrupt criminal activity.
Advances in analytics, automation and AI are making it easier to process complex information and surface insights that might otherwise be missed. However, intelligence only creates value when it is shared, trusted and acted upon. Investigators, analysts and decision-makers need a common understanding of the threat landscape to coordinate effective action. Lasting disruption is not achieved through arrests alone. It comes from turning intelligence into coordinated action that weakens a network’s ability to operate, adapt and regenerate over time.
From incident response to network disruption
Organised crime is becoming more specialised, connected and adaptable. As a result, security strategies must evolve accordingly. The most resilient organisations will be those that move beyond a purely incident-focused approach and develop a deeper understanding of the networks, facilitators and infrastructure that underpin modern criminal activity. Responding to incidents will always remain essential. But lasting impact comes from identifying and disrupting the systems that enable threats to emerge in the first place.
For security leaders, the challenge is no longer simply responding to individual events. It is understanding the wider ecosystem behind them and building the intelligence capabilities needed to stay ahead of increasingly sophisticated adversaries.
