Colombia is one of Latin America’s great opportunities. It is also one of the environments where risk changes completely from one municipality to the next. Before sending a person, the question is not whether the country is safe, but where they are going and how they will get there.
When an organisation decides to operate in Colombia —a subsidiary, an infrastructure project, a field campaign, a humanitarian mission or simply a business trip— it takes on a responsibility that begins long before the plane lands: protecting its people. And in Colombia that responsibility has a particularity that sets it apart from almost any other destination: risk is not national, it is territorial. The same person can move from a perfectly manageable environment to a critical one in less than two hours by road.
Duty of care begins before deployment
Duty of care is the obligation —legal and ethical— of every organisation to anticipate, reduce and respond to the risks it exposes its personnel to when it deploys them. It is not limited to taking out insurance: it requires knowing the real risk of the destination, preparing the person before they travel and having a response plan if something goes wrong. In Colombia, meeting that duty means moving down from the “country” level to the “region and route” level.
Colombia combines a growing economic appeal with a deeply uneven security geography. The country is today a hub for nearshoring, energy and infrastructure, but also the world’s largest producer of cocaine, with armed structures financed by illicit economies that compete for territorial control wherever the State’s presence is weakest. Understanding where the opportunity lies and where the risk lies —and that they rarely coincide— is the first act of duty of care.
of the Colombian economy (2026)
of cocaine (UNODC)
with territorial control
Risk in Colombia is territorial, not national
The most expensive reading an organisation can make of Colombia is to treat it as a homogeneous block. Neither is the whole country dangerous nor is any part entirely safe: the level of exposure depends on the region, the route, the timing and the traveller’s profile. A single protocol leaves the person over-protected in some places and insufficiently prepared in others.
Where the opportunity is concentrated
Bogotá, Medellín, the Coffee Region (Eje Cafetero), Barranquilla and Cartagena concentrate corporate activity, foreign investment and most business travel. These are manageable environments with sensible urban protocols, where the predominant risk is common crime, not armed conflict.
Where the risk is concentrated
The border zones, the southern Pacific, the Catatumbo, the Bajo Cauca and large rural areas of the southwest maintain an active presence of armed groups, illicit economies and limited state capacity. There, the risk stops being “crime” and becomes kidnapping, extortion, illegal checkpoints and forced displacement.
The risk map: Bogotá is not the Catatumbo
This is an indicative reading by region. It does not replace an up-to-date risk assessment by destination and route, but it illustrates why the “Colombia level” means nothing operationally.
| Region | Risk level | Key factors |
|---|---|---|
| Bogotá, Medellín and major cities | Moderate | Theft, “fleteo” (armed robbery after cash withdrawal), express kidnapping, scopolamine and micro-trafficking. Manageable risk with urban protocols and a local briefing. |
| Cali and Valle del Cauca | High | Structures linked to drug trafficking, high homicide rates and extortion of businesses and shops. |
| Cauca and Nariño (southern Pacific) | High | FARC-EP dissident groups, illicit crops, drug-trafficking corridors and illegal mining. |
| Catatumbo and Norte de Santander | Critical | Presence of the ELN and dissident groups, border with Venezuela, kidnapping and forced displacement. |
| Arauca | Critical | Armed groups in dispute over territory, border area and attacks on energy infrastructure. |
| Bajo Cauca (Antioquia) and Chocó | High | Clan del Golfo (AGC), illegal mining, control of routes and systematic extortion. |
| Putumayo and the Ecuador border | High | Transnational armed groups, illicit economies and smuggling corridors. |
“The ‘Total Peace’ policy has multiplied negotiating tables, but on the ground it has coincided with the fragmentation and expansion of armed groups, which compete for illicit rents wherever the State has less presence.”
“Colombia remains the world’s largest producer of cocaine. The drug-trafficking economy continues to finance the territorial control of armed structures along strategic corridors of the country.”
The five most common mistakes when deploying personnel to Colombia
Most incidents affecting deployed personnel do not come from an improbable ambush, but from avoidable preparation mistakes. These are the five most frequent.
| Mistake | Frequent? | Why it matters |
|---|---|---|
| Treating Colombia as a homogeneous country | Yes | Risk changes completely between Bogotá and the Catatumbo. A single protocol over-protects in some places and under-protects in others. |
| Not adapting the traveller to urban risk | Yes | “Fleteo”, express kidnapping and scopolamine affect travellers without a local briefing even in areas considered safe. |
| Underestimating road travel | Yes | Illegal checkpoints, “miracle fishing” (pescas milagrosas) and extortive kidnapping make road transport the point of greatest exposure. |
| Not training personnel before deployment | Partial | Without hostile-environment training (HEAT), the person does not know how to react to a checkpoint, an express kidnapping or an evacuation. |
| Lacking a response and evacuation plan | Yes | When the incident happens, improvising costs time and lives. Duty of care requires a tested plan, not a reaction. |
Road travel: the most underestimated risk
Most corporate travellers and organisations focus their attention on the security of the accommodation and the destination city. But in Colombia the moment of greatest exposure is usually the journey: the stretch of road between the airport and the project, or between a capital and a rural area. That is where state control dissolves and illegal checkpoints, extortive kidnapping and so-called “pescas milagrosas” (miracle fishing) appear, in which armed groups stop vehicles at random to select victims. As an operational rule, night-time road travel outside the major cities should be avoided whenever possible.
Criminal practices every traveller should know
An effective security briefing is not meant to frighten, but to help the person recognise the threat before it materialises. These are the four most common that affect travellers in Colombia.
Fleteo
Armed robbery, usually from a motorcycle, targeting people who have just withdrawn cash from a bank or ATM. It is mitigated by avoiding visible cash, varying routes and not operating alone in public.
Paseo millonario (express kidnapping)
Express kidnapping via taxis or unverified vehicles: the victim is held for hours and forced to empty their accounts at several ATMs. It is prevented by using only trusted, previously verified transport.
Pesca milagrosa and illegal checkpoints
Checkpoints set up by armed groups on secondary roads to hold travellers and demand ransom. It is the main argument against unplanned road travel in high- or critical-risk areas.
Scopolamine (burundanga)
A substance used to incapacitate the victim and rob them —or make them act against their will— after administering it in a drink or through contact. It especially affects those who socialise with strangers; the local briefing is the best defence.
The most common framing error
Understanding security as a cost and not as part of duty of care. The organisation that reduces security to travel insurance assumes that risk is a remote probability it will manage “if it happens”. But duty of care is not met by reacting: it is met by anticipating. Assessing the destination, training the person and having an evacuation plan is not an optional expense; it is the difference between a resolved incident and a crisis with legal liability for the organisation.
Duty of care: what it requires of organisations sending personnel to Colombia
Duty of care is not a best-practice recommendation: it is an enforceable obligation. Organisations that deploy personnel to high-risk environments —companies, NGOs, media, institutions— are legally liable for the harm their people suffer when they failed to adopt reasonable preventive measures. The legal key is precisely that: reasonableness. After an incident, the question will be whether the organisation did what any diligent operator would have done: assess the risk of the destination, inform and prepare the person, and have a response protocol in place.
Hostile Environment Awareness Training (HEAT) as part of compliance
No protocol replaces a prepared person. Hostile Environment Awareness Training —HEAT— equips personnel with the ability to recognise threats, react to a checkpoint or an express kidnapping, apply first aid in critical incidents and make decisions under pressure. For an organisation sending people to Colombia, HEAT training is not an extra: it is one of the clearest pieces of evidence that duty of care was met before anything happened.
Does your organisation have real visibility of the risk before sending personnel to Colombia?
ACK3® supports organisations operating in Colombia or deploying personnel to the country, combining open-source intelligence, risk analysis by destination and route, personnel training and on-the-ground operational capability from our office in Bogotá.
| ACK3® Service | What it includes |
|---|---|
| Travel Risk Management | Risk analysis by destination and route, threat levels by region, and recommendations on itinerary, accommodation and movement protocols. |
| Hostile Environment Awareness Training (HEAT) | Practical preparation of personnel for kidnapping, checkpoints, civil unrest and evacuations, with first aid in critical incidents and decision-making under pressure. |
| On-the-ground security | Operational support from our office in Bogotá: trusted drivers and vehicles, close protection and verification of local counterparties and suppliers. |
| Monitoring and Response | Tracking of the security situation, real-time alerts and activation of response and evacuation protocols in the event of incidents. |
In Colombia, the real risk is not the one in the headlines: it is the one that is not anticipated. It is on the road that should not have been taken, in the briefing that was not given and in the evacuation plan that was never tested. ACK3® operates where
