But that doesn't solve the problem of porous security abroad, particularly in places where counter-intelligence is weak and local law enforcement cannot be counted on in the case of a heightened threat.

The Indian press reported that two months before the Mumbai attacks, local police gave the Taj hotel a list of 22 needed security improvements, including placing a grill gate over the back entrance where the attackers gained access. The hotel reportedly relaxed security just before the bombings.

A spokesperson for the Taj wouldn't comment on the company's security procedures, but in a televised interview, Ratan Tata, the chairman of the Taj hotel group, blamed poor intelligence and ill-equipped law enforcement for the fatalities.

Many large chains hire security consultants such as Hospitality Risk Controls, Kroll, and the Annapolis-based global security firm iJet Intelligent Risk Systems to audit their hotels to detect security lapses.

iJet also provides clients, typically Fortune 500 companies and rich people, with detailed country profiles and daily travel alerts reported by staff around the world, many of whom are retired intelligence and military officers. The company audits about 500 hotels annually, and those that pass its rigorous safety checks and covert inspections land in a database available to subscribers (subscriptions start at $5,000 a year).

"There's such a range of players out there," says iJet president Bruce McIndoe. "Some recognizable brands don't know how to spell the word security. They don't even have anyone in charge of it. Other have sophisticated global operations," he says. "Hotels need to do better. The industry doesn't have standards, and the brands don't have control."

What Hotels Are Doing Now

Any increase in such safeguards will be a deterrent to would-be attackers, says Grenier. "If they see an obvious upgrade in security, they'll find other targets," he says.

Cement blockades at the checkpoint of the Islamabad Marriott reportedly saved hundreds of lives when the hotel was attacked last year, and the Sheraton Karachi, where 13 people were killed in a 2002 suicide bombing, recently publicized its "security enhancements."

The days of keeping mum on security so as not to frighten guests may be over as safety measures actually become a marketing tool—particularly in a competitive economy.

The Starwood chain, for one, works with two security firms. "Several years ago, we overhauled our existing emergency and crisis procedures to address terrorism-related events as well as traditional crises," says Starwood spokeswoman K.C. Kavanaugh. Access to its Mumbai properties is now restricted to guests.

What the Future May Bring

In extreme cases, hotels may limit lobby access to registered guests and require key cards for once-open doors—a measure that Hilton and Marriott have instituted at their Jakarta properties.

But until the industry makes dramatic changes, says Susan Gurley, executive director of the Association of Corporate Travel Executives, guests must be increasingly self-reliant. "You need to take ownership of your trip. You have the right to get on the phone and ask questions of the hotel." [See "Sleep Tight."]