He goes on to say that companies have done much more preparation on the operational side -- areas such as intrusion detection, surveillance and mailroom training -- than they have on the design and structural side, such as tightening security around ventilation systems or investing in blast-resistance.