Securing Cannabis: A Conversation with Sapphire Risk CEO Tony Gallo

Security has been a defining factor for cannabis practitioners long before a legal industry existed, including to protect one’s stash or grow from the prying eyes of thieves and law enforcement. Today, as the legal cannabis industry expands state by state, country by country, security remains a centerpiece of the business just as it does for any high-risk industry, a category cannabis fits into very comfortably. And for about as long as there has been a legal industry, Sapphire Risk has been helping cannabis companies manage their security needs.

Founded in 2012 by Tony Gallo, a 30-year veteran of the security business, Dallas, Texas-based Sapphire Risk originally provided consultation services to pawn shops, gun shops, jewelry shops, and similar businesses. In time, as Gallo explained during a recent call with Cannabis Business Executive, cannabis not only joined the list of industries served by Sapphire Risk; it became the main focus of the company, which to date has worked with more than 800 cannabis business owners in 35 states and Canada.

According to Gallo, the security industry overall has three main components to it. “There’s the industry that is called security, which is more of a physical position; you would consider a guard a security person, somebody that physically protects the assets of the company. Then there is loss prevention, which is someone who identifies a problem that’s occurring, and puts things in place to prevent those losses from occurring again. If you had a location that had an armed robbery, you would put things in place to prevent future armed robberies from occurring. And then there’s the position that I call asset protection, and that position identifies a potential problem before it even happens. You didn’t wait for the robbery, or you didn’t wait for the employee theft, or you didn’t wait for the emergency procedures. You perceive that these things could occur, and then you put those procedures in place.”

Gallo had done all of those jobs over the course of his long career. “I think I’ve done every job you can do in retail security, from guard, security manager, investigator, regional area director, to my favorite job ever, store detective,” he said. “When I left the pawn industry, I decided to start my own security companies focusing on high-risk businesses. The clients I was looking at were jewelry stores, pawn shops, liquor stores, convenience stores, firearm stores, basically any retail business that has a large amount of cash and a very desirable piece of merchandise. We call it the Big Four: Alcohol, Tobacco, Firearms, Pharmaceuticals. So, that’s really where my focus was because that’s what I did for the previous 17 years. I knew nothing about cannabis. In fact, I didn’t even realize there was an industry.”

That definitely changed one day. “I got a phone call from a startup company called MJBiz,” recalled Gallo. “They said, ‘We’re going to do an event in Boston, then we’re going to do one in Chicago, and then we’re going to do one in San Francisco. We needed someone to talk about how to secure cash in a retail location, and your name came up.’ I said, ‘Let me call you right back.’

“I hung up the phone and looked up cannabis on the computer,” he continued. “What the hell does it look like? Well, like large amounts of cash and very desirable merchandise, which would be the cannabis, and I’m like, this is what I do. I spoke at the very first MJBiz event in Boston, with 125 attendees and 15 vendors. The guy in front of me was Adam Bierman from MedMen, the guy behind me was a guy from BioTrack, and the rest is history.”

Work came Sapphire’s way from the get-go. “I started getting inquiries from people that wanted to apply for a license,” recalled Gallo. “We worked with some application writing companies; we write for most of the major ones right now. That started to get moving, and people would come to us and say, ‘We need your help.’ Back then it was more applications, because there were no cannabis facilities, or they were in the early process of building them out. One of our first clients was GTI (Green Thumb Industries). We did Cookies. We started with a lot of companies at the very beginning of their growth, and that’s how it became less pawn and jewelry inquiries and more cannabis. We started to do more states as the application process started to open up and states were taking licenses, and we just kept growing.”

The Elements of Security

As Gallo explained, security in cannabis has undergone a maturing process as the industry spread west to east. “If you look at security in the cannabis industry, the process started in Colorado, Oregon, Washington, and California, and migrated east, and now we’re in New York and New Jersey,” he said. “That took about five to 10 years, depending on how you look at it. When we look at security in the west, it’s much weaker than it is on the east coast, simply because as it migrated across the United States, people learned valuable lessons when it came to security. When we look at the physical security in Oregon, Washington, or Colorado, we see some deficiencies that were resolved by the time you got to New Jersey and New York.”

I mentioned seeing a lot of safe exhibitors at the early trade shows. “One of the big things about safes, and what a lot of people don’t realize,” noted Gallot, “is that when you go to Costco or you go to a gun store, you’re buying a gun safe, and what that safe is designed to do is to prevent your son or daughter from going in and getting your guns. It’s also designed to prevent the guns from being damaged if there is a fire, but it’s really not designed to prevent anyone from breaking into that safe. With the metal on a gun safe that you would see at Costco or Walmart, I can go to Home Depot and get a diamond cut saw and cut through it. The walls are constructed with sheet rock, which they should be because it prevents fire, and that’s what it’s designed to do, but it’s not designed to store jewelry or cannabis, or a high amount of cash. In California and those states, they would go Costco or Walmart and buy that kind of safe, whereas now on the East Coast, they actually use real TL-rated safes. That became very apparent during the looting a few years ago when there were 83 dispensaries that were attacked across the United States that we were aware of, 23 of them had their safes breached, and all 23 were gun safes.”

Were the safes being hawked at trade shows gun safes? “They were,” said Gallo. “In fact, you still sometimes see them sell gun safes on the west coast, because those regulations haven’t changed. So, people who don’t know any better figure they’ll just go buy a gun safe down the block. It’s the same thing with camera systems from a security point of view. We design loss prevention because we want to prevent these losses from occurring, but I see a lot of people who will go straight to the integrator. Think about it. If you go straight to the guy that’s going to charge you for the work, you have to wonder if they’re charging the right amount for the work or the right amount of equipment. We’ll see locations that may only need 50 cameras that have 100 cameras because the owner didn’t know any better, and those 100 cameras aren’t providing any more security than the 50 would have.”

That would make the consultation services especially valuable, I noted. “Well, let’s say you were going to build a house and you don’t know how to build a house,” replied Gallo. “You may know nothing about house building, but you know that you want a bathroom on the second floor of the house that you’re building. Well, nobody would call the plumber directly to get a price on what it would cost to put the bathroom on the second floor if you didn’t know how to build the house or what the costs would be. You would do your research and hire somebody to help you along with the process.

“The interesting thing is that a lot of times in cannabis people go straight to somebody and get pricing, and they don’t know whether it’s the right price or the right equipment,” he added. “Perfect example: when it comes to cameras, a two-megapixel camera can cover everything in a 30-square-foot room that an eight-megapixel camera would be able to cover at two to three times the price. But how would you know if you didn’t know that? The integrator could say you need an eight-megapixel camera to cover 30 feet, which is true, but you could have had a two-megapixel that would have done the same job.”

As Gallo explained, the basic elements of security have not changed even if the tools have. “The core of any program in retail security – which is what cannabis is, and everything I’ve done – is identifying where your losses are, and the majority of losses in any retail business is internal employee-based,” he said. “Whether it’s employee theft, or employees damaging product, or hurting the margin in some way, it always revolves around the employee. I would say about 80 percent of all the losses in the cannabis industry are due to employee involvement in some way, compared to most retailers, where somewhere between 60 and 80 percent of all their losses are internal.

“What we now have are some better tools to identify those losses,” he continued. “We have POS systems that are now able to do exception reports, unlike the old days, where if you had a loss, you had to rewind your videotape to find out how that loss occurred. Now you can identify that transaction and go straight to that transaction with a video system. Cameras are much more sophisticated. We also have AI software that can identify anything that might be moving around or any losses. Technology is helping the investigator or security program reduce these problems, but the underlying problem has not changed.”

Sapphire Risk’s menu of services includes consulting, application writing services, security floor plan design, secure facility build-outs, SOPs, and risk assessment. In addition to retail, Sapphire also provides security for cultivation sites of all sizes. But cannabis is also tracked by seed-to-sale programs hired by the state, so where are the vulnerable points that would allow a significant level of theft to take place? “A lot of the losses, let’s say at the grow facility, come at the plant or during the trim,” said Gallo. I would say the most vulnerable room is the trim room, where they actually trim the product. That’s where losses can occur because it’s really before the whole tracking mechanism comes in, and it’s difficult to track how many buds were on a plant.

“From a dispensary point of view, it happens at the register and could happen in multiple ways,” he added. “Typical for retail are not ringing up the sale and keeping that money, so that it produces a shrinkage of the product; under-ringing product for friends, giving it away as samples, or not ringing it for the full potential and giving some sort of discount. In fact, a lot of what you see in the dispensary you can equate to a jewelry store or liquor store or pawn shop, anything of that nature.”

But Gallo also stressed that a lot of people have misconceptions about the security risks associated with cannabis. “We do around 100 city council meetings every year, give or take,” he said. “I did 50 in New Jersey alone last year, and a lot of people are under a misconception that crime goes up [around dispensaries]. Believe it or not, crime actually goes down when you have a dispensary in that neighborhood simply because of the amount of security that’s required. Unlike a jewelry store or a pawn shop or liquor store, security is required by the city or the state, and they’ve seen crime actually come down, which is an eye-opener to a lot of city council people who think they’re going to have robberies and will have to hire more police officers and all that.”

Security Boon

Even as the overall industry struggles to find its footing, security remains an essential component of running a cannabis business, and with new states coming online or expanding their programs, Sapphire has plenty of business, especially when states schedule application deadlines for the same day. “I don’t know if they planned this, but applications for the state of Texas and the state of Florida are due the same day, April 28, so we’re getting hit from both sides,” Gallo said of his hectic day. “We have 10 clients in Florida and 10 clients in Texas right now, and we’re trying to figure out how many we can take on, because April 28 does not leave a lot of time.

“When we do our applications – and we do floor plan design, so we take your floor plan and add the security on: the video, the alarm, the access control – we have 35 people, which includes contractors and a design team, and you can only turn so many screws. So, when you get hit with a double state application process, we can only take on some of the people.”

The team is composed of a small staff of employees in addition to the contractors. “We have three people in the Dallas office,” said Gallo. “We also have people in Austin, our 35 contractors spread across the United States, and we even have one writer that lives in Spain, because we can do a lot of the work remotely.”

Sapphire has a really good contract pool of people, he added. “We have two main groups: content writers and designers. The content writers write the security section of applications, or they help with city planning or SOPs, whatever you would think you would write for security. Then we have the application designers, which are like artists in some ways, because they look at the floor plan and make it look presentable to the city or state to give approval. And then we have our construction designers, and they’re the ones that show you where the cameras are going to go. The artist will put the camera in the room, but it may not be exactly where it needs to go. The state approves it, and then the construction team actually designs it.”

Gallo added that Sapphire just did the second adult-use cannabis shop to open in New York City. I asked him if the work required contractors to be on the ground at every facility. “Not necessarily,” he said. “When it comes to the design processes, what usually happens is an architect will design the floor plan, we might give them some input, and then we put the security on that floor plan, which they submit to the state and city for approval. When they get approval and they’re ready to build it out, that’s when somebody goes back, and they may move a wall, or they talk about where the fixtures are going to go, or is there stuff hanging from the ceiling, and then they work with the security construction team to actually install where that camera will go in that room, and then they work with the state or the city if they have to get approval for any changes that they’ve made. The application floor plan design almost never looks like the construction floor plan design.”

Sapphire Risk also has its share of repeat cannabis customers. “We have clients that we’ve done 12 projects for already throughout the United States, companies that started off when they were small MSOs, or small companies in, say, California that are now grown into bigger MSOs,” he said. “If you listed a lot of the major companies, we have some sort of relationship with them, and what happens now is that when a state opens up, we have this core group of about a dozen clients that say, ‘Okay, we’re going to do Texas now. Okay, we’re going to do Florida now. Okay, we’re going to do New Jersey now.’ And they know we have a good track record. In Florida, we were one of only two security firm with a perfect security score in the last round of the Florida application, so you can imagine the people that showed interest in what we do.”

Has that meant bringing on more contractors in anticipation of states adding licenses or facilities?  “Yes,” said Gallo. “Not only have we brought on people that work for Sapphire to help as consultants from our end, but we’ve also helped a number of people who started with us and have moved on, and they’ve grown and developed and started their own their own security companies. These are people who at one time we helped or guided, and that’s fine. Having been doing this for almost 30 years, one of the things I pride myself on is that there are six people in my career that have become head of security for various companies, like Brooks Brothers and West Marine, and I find it to be a very positive thing, in my opinion, that we can help people.”

Gallo used New Jersey as an example of the potential work load. “Currently, we have 130 clients of all different sizes in New Jersey. Some are in application rounds, some have won their application, some are building out, and we have already opened several of them. Some are major companies, but the point is that we may have 130 clients, which sounds fantastic, but there are over 1000 people applying in the state.

“That means we’re not getting everybody, and as long as the other [applicants] are getting good people, I don’t have a problem,” he added. “But what I do have a problem with is that there are a lot of carpetbaggers in this industry, and sometimes the [applicants] spend a lot of their own hard-earned money, and that is different than you would see in other industries. I worked for Sears, I worked for Macy’s, and I was very interested in making sure we did a good job, but it wasn’t my money, and if things went bad I would get yelled at, but it still wasn’t my money.”

I asked Gallo how Sapphire Risk goes about recommending particular vendors. “We do what’s called an RFP, a request for proposal,” he said. “We designed the security for the location, video, alarms, access control for the construction, we identify what kind of equipment we would like to see, certain camera manufacturers, or ones that we don’t want you to use for various reasons, and once we get that put together, we put that RFP out to bid.

“Now we’re asking several vendors,” he added. “It could be ADT, it could be Secure Task, or it could be a local vendor that we have done a project with before, and we’ll get three bids. They have the RFP, they get back to us on it, we review the bid based on the budget and with the client, and then we will decide. We liked this one, they’ve done a good job before; we liked that one because they are local, or the price is better. And then they make a selection, ‘Okay, we’re going to use this vendor,’ and we turn that vendor over to the general contractor who will do the build-out.”

Securing Grows and Delivery

Sapphire Risk also provides security for cannabis and hemp cultivation sites of all sizes and types. “The biggest grow we ever did was 450,000 square-feet in Nevada,” said Gallo. “We’ve also done 200,000 square-foot grows, but the average grow runs somewhere between 30,000 and 50,000 square-feet. It’s not that different from any kind of security design that you’re doing other than that the public doesn’t have access to the facility. Most of the time, it fits the wheelhouse of what I’ve done for 30 years, whether it’s a warehouse environment, a distribution center, a gold processing facility, they all fall pretty much in the same category as a cultivation site.”

Would that include sites with a large perimeter and several buildings? “Yes,” said Gallo. “New York let anyone who had a hemp farm grow one acre of cannabis, so we’ve designed security for them on one acre out there in the field. We also do a lot of greenhouses. We’ve done most of our build-outs of grows in California, we’ve done about five in Desert Hot Springs-Palm Springs area; we’ve done Carpentaria, L.A., Santa Barbara. We’ve done outdoor grow facilities. We have one project up in the Humboldt County area, Lake County that I think covers two mountains and something like 1200 acres.”

Gallo noted that Sapphire Risk will also take a role with security guards. “We’ll get involved with the security guard to help put together what’s called post orders,” he said. “Those are the rules of engagement for the guard, what they should and shouldn’t be doing, and we will also recommend a guard agency that has cannabis experience. If you’re designing a retail dispensary and you’re going to use a guard, usually you only need them for business hours. You shouldn’t really need a guard after business hours unless the city requires it, but most don’t, because that’s why you designed your security system. If your security system requires a guard to be there at night, you didn’t really do a good job designing the security system. Same thing with cultivation. That’s a little different because it’s more of a guard post that checks people in and out, or someone’s going to be doing patrols, but we do a lot of work across the United States when it comes to in-house security after they’re ready to open.”

I asked Gallo if most breaches of the security system are avoidable. “Maybe not the breach, but the aftermath of the breach is avoidable,” he replied. “For instance, with a dispensary, you build a secure storage room, and that’s where your cannabis and your money is stored at the end of the night, but the design has a flaw if it has a nice door, but right next to the door is a sheet rock wall, or the door is a wooden door and not a good door. So, a lot of times, if you do have an incident that occurs, the fault may not be that you allowed it to occur, but it may be that they were able to get something, which means they’re going to return.

“We do robbery work,” he added. “I’ve done over 2000 retail armed robbery investigations in my career, and one of the things I learned from day one is that robbers look at locations from the outside in. They don’t come in and decide to rob the location; they look at the outside of the location. So, robbery prevention 101 is to remove graffiti from the building, clean the parking lot, and make sure you have good lighting. A lot of times we’ll do what’s called risk assessment. We’ll go to a location that had a robbery or a break-in and they want someone to look at their security, and we’ll identify and say, ‘I would rob this place, too, and let me show you why.’”

Delivery would seem to be particularly vulnerable to theft, but Gallo said it presents many of the same issues as retail. “If you look at the cannabis industry,” he explained, “there are two types of delivery services. One we call the pizza model, and one we call the ice cream truck model. The pizza model is that you order cannabis from a location, let’s say a dispensary, and someone comes and delivers it to your house, much like a pizza. The ice cream truck model is there’s a truck that has cannabis already in it from the morning, and then they get an order, and they deliver it to you like an ice cream truck would.

“We get involved in designing the security for both those type of models and how a delivery location would look,” he added. “But again, delivery is very similar; how they secure their product at the end of the night, how they go about tracking that vehicle to make sure it’s not deviating, or what kind of camera system or alarm system they would need? We’ve done all the business lines in cannabis over the years – cultivation, manufacturing, processing, retail dispensaries, delivery, we’ve done it all.”

The Future of Cannabis Security

I asked Gallo if the passage of the SAFE Banking legislation would have made cannabis as safe as any comparable industry? “Well, let’s compare cannabis,” he said. “There are more robberies in convenience stores, there are more robberies in pawn shops and jewelry stores than there are in cannabis. So, the perception of cannabis as not being safe really isn’t there to begin with. What I think will greatly help the cannabis industry when it comes to understanding and reducing their losses from a security point of view, is the training of their employees. We see that being a big deficiency; the budtenders and other workers not fully understanding what I call the why. What’s the why? Why do we have to have security, and what is the benefit of the security, and I think a lot of them miss that why.”

Other changes are coming, added Gallo. “Our number one business right now is application writing, which we call phase one,” he explained. “Phase two is built-out designs, and phase three is day-to-day policies and procedures. I see that percentages changing greatly over the next few years. As more and more cannabis facilities become established, and they’ve been doing this for three years or five years, the need for phase three and actually having a better program to control your margins is becoming more prevalent for us and there are more requests for those services. So, right now, the highest percentage is applications, second would be build-outs, and third are day-to-day policies and procedures when it comes to security. I see that all flipping in the next few years, with phase three becoming a higher revenue percentage than phase one.”

Some MSOs are retreating from states that are under-performing for them. I asked Gallo if there was also a security component to unwinding businesses. “I would say so,” he replied. “If you look at industries that have low profit margins – like Best Buy and companies like that – they have to be very on top of that to make sure that they’re profitable. I think the cannabis industry was a little unfortunate because they didn’t have that, and they were making money regardless of how well they ran their business. So, there are a lot of MSOs that would never have survived anywhere else, but they did here because they were the only game in town. Well, they’re not the only game in town if you look at states like Oklahoma, which has more cannabis licenses than the state of California, but Oklahoma has a population of 1 million people and California has a population of 40 million people. So how are you making money in Oklahoma when there’s a dispensary every block?”

Will people start cutting back on security as a result? “I actually see the cannabis industry increasing their security because they want to focus on their margins,” said Gallo. “Let’s just take Cookies. If I’m selling a sweatshirt for $80, I don’t really care how many get shoplifted because I’m selling an $80 sweatshirt that cost me $5 or $10. But now it’s eating into my margins, so they want security to prevent the number of sweatshirts that are being stolen, or deal with employee theft. If I have trimmers in my growth facility, and they steal a little, but we made it up in other ways, now they’re going to tighten down on that and say, ‘You really can’t steal anymore. It’s unacceptable.’ So, I see the security industry growing in the cannabis industry because there is more focus on the margins than there ever was before.”

Does Sapphire Risk have international aspirations? “We’ve had inquiries from people in Germany, Portugal, Brazil, and Colombia, but we actually haven’t done any of the work,” replied Gallo. “We do some work in Canada, but mostly in the United States, where we stay focused. It’s not because we can’t work other countries, but we’re just busy right now in the United States. We wouldn’t be opposed to it, but we haven’t found one that fit and we’re not aggressively pursuing.”

What are his ambitions for Sapphire Risk? “What I desire is to be the premier security consultant company for the application round, and continue to grow that business and bring in support to do that,” said Gallo. “It’s nice to be able to say we did Alabama, where we wanted 10 clients and we had 17. It’s nice to be able to say we had a perfect score in Florida in the last round applications, and that we had perfect scores in Illinois. So, while I would like to grow and be that go-to person for applications, I think that the growth of Sapphire Risk is really going to be in the policies and procedures, the day-to-day security, the phase three part of the business I mentioned, because that’s where you see a lot of growth in normal retail – in the Kohl’s and the Home Depots – and that’s where a lot of my vision is focused, looking at how to grow phase three, how to grow the day-to-day policies and procedures, much like any other retail company would.”