Most business travelers never choose their hotel. A list does, often months before the trip, drawn up when someone checked the property and found nothing wrong: cameras working, a quiet block, no recent trouble. From then on the hotel is trusted on the strength of that one look, and the look expires long before the trust does. A hotel that was safe last quarter can be exposed this one for reasons that have nothing to do with the hotel: a guest it did not choose, or a change on the block outside its walls. The building does not change. What changes is the world at its front door, and an approved list has no way to see it.
Start with what "approved" usually means. For most companies the approved-hotel list is a commercial arrangement: negotiated rates and a finance team's per-diem math. Security may never have touched it. Where a firm does vet for safety, the vetting is a single assessment with a date on it, treated afterward as if it never ages. Either way, the list is a snapshot standing in for a live situation.
A star rating certifies service, not safety
Four stars and a global flag over the door promise a good stay, and they predict one well, but none of it measures where the hotel sits, how a guest reaches the door, or the short walk from the car to the lobby. What a corporate account actually buys is the package: the room, the free breakfast, the laundry, and the executive lounge if the property has one. The lounge is the quiet centerpiece, a complimentary evening hour of drinks and food that lets a traveler come back from meetings and never leave the building again. So the same guests are in the lounge most evenings, on the same rough schedule. It is a comfortable habit, and an obvious one to anyone watching. A traveler whose evening runs to a schedule is easy to find, and the everyday street threats in a Colombian city, robbery and express kidnapping, reward being easy to find.
Concentration is its own risk
When a company routes everyone to the same few approved addresses, those addresses become known for the kind of guest they hold. Most of what that attracts is ordinary and opportunistic: the crews who work a block for robberies gravitate to where paying targets reliably are, and street-level express kidnapping follows the same logic. The rarer, heavier threats, a kidnapping worked over weeks or a targeted attack, choose specific people rather than whichever guest walks out first, but they also begin by learning where a person will predictably be. Kidnapping in Colombia is not a historical worry. Reported cases roughly doubled in 2025 to their highest in a decade, most of it the express kind that runs its course over hours or days. A list built to lower cost quietly raises this exposure, because the thing that makes a hotel efficient to book, everyone in one place, is the thing that makes its guests easy to study.
The exposure is at the curb
The most exposed ground is the short walk from the car to the door. The better properties know it and push security outward: dogs, screened vehicles, a garage that opens only for a vehicle it has cleared, guards who watch the street and not only the lobby. That hardening is real, and it is the one thing the anonymous, unremarkable hotel a cautious traveler might pick to dodge the crowd does not have. But even the best of it is a record of how the property looked the last time someone checked, and none of it reaches the few meters where a stopped car opens and a guest is briefly outside everyone's protection. Colombia is direct about where that danger sits. A frequent method of urban attack is a passenger on a motorcycle who steps off at a doorway or a stoplight and is gone before anyone reacts, common enough that cities now restrict who may ride as a passenger at all: Cali all year and around the clock, Cartagena across its main tourist and hotel neighborhoods, Bogotá in a narrower weekend-night version it ran in 2022 and 2023 and then dropped. When a government regulates who may sit behind a motorcycle driver, it is marking where the danger is.
Vetting with a shelf life
A better list does not fix this. The format is the problem, whatever the entries. Any list records one date and then gets used for months as if nothing has moved. Vetting that keeps up is dull, repetitive work. It is not a walk through the lobby and a handshake with a manager who says what a visitor wants to hear, because an announced inspection gets a performance: the way a kitchen behaves when it knows the critic booked the table, with doors that usually stand propped open suddenly locked and a guard at a post that is normally empty. The useful version is unannounced and repeated, a property seen the way a guest sees it and revisited without notice, re-checked whenever something on the block or in the city moves. That is what we weigh before placing a traveler: where a hotel sits above the name on the door, and the readiness to drop a property the week its situation changes rather than the week after. A hotel that cleared the bar last quarter is only as current as the quarter it was checked.
A traveler can do a little of this without help. Varying the hour and place of the evening meal keeps a schedule from forming. Treating the walk from car to door as exposed ground, and asking the driver to stop at the entrance rather than across the street, closes the most vulnerable moment. A travel program can ask two questions of any property on its list: when it was last checked and by whom, and who is watching it between the program's own bookings. Those help at the edges, but none keeps an assessment current on its own. That is the continuous work: per engagement, we assess and then monitor the specific properties a client uses, and each week our Risk Brief flags the places and routes across Colombia that changed in the last seven days. The list was accurate the day it was made. Whether it is still accurate this week is a separate question, and it is the one that matters.