Contents
Brian Thompson was walking to an investor conference in midtown Manhattan on December 4, 2024, with no protective detail, when he was shot and killed. The response across corporate America was immediate. Allied Universal, which serves a large share of the Fortune 500, reported that requests for executive protection assessments ran 10 to 15 times higher than before that date, that its around-the-clock protection business grew 30 percent within two months, and that ad hoc security ordered for executive travel rose roughly 300 percent.
Proxy filings show the same shift in budget terms. An Equilar review of 208 S&P 500 companies that had filed by April 2025 found that 31.3 percent disclosed some form of security perquisite for 2024, with median spending rising from $43,068 in 2021 to $94,276 in 2024. Lockheed Martin's disclosed security spending went from $149,069 to $1,338,056 in a single year. A follow-up analysis covering the 2026 proxy season put the median value at $130,468, another 20 percent increase.
Protective details and hardened residences address the last stage of a threat. Open source intelligence addresses the stages before it.
The Basics Of OSINT And Executive Protection
OSINT means intelligence produced from publicly or commercially available information. For protective work, the relevant sources include social platforms, forums and image boards, alternative and fringe networks, comment sections, paste sites, breach dumps, data broker listings, court records, property and permit filings, corporate registries, local news, and deep and dark web spaces.
Collecting that material produces data. It becomes intelligence after an analyst validates it, assesses it against a stated protective requirement, and delivers it to someone who can change a decision: a route, a venue, a public appearance, an access list, or a residence posture.
Protective intelligence programs usually organize collection around a principal profile. That profile covers the executive's name and known variations, public affiliations, residence and office areas, travel patterns, family members who appear publicly, and the issues that attach controversy to the company. Everything collected gets measured against that profile rather than against a general feed of security news.
Why Executives Have A Target On Them
Senior leaders absorb anger directed at the organization. A layoff announcement, a claims denial policy, a plant closure, a price increase, a political donation, and a public position on a contested issue all produce individual grievance, and the chief executive is the name attached to the decision.
Three conditions make executives reachable. Their schedules are partly public, since earnings calls, conferences, keynote slots, and shareholder meetings are announced in advance. Their biographical details are commercially available, since data brokers aggregate home addresses, relatives, and phone numbers into profiles anyone can buy. Their movements are predictable, because most people travel the same routes at the same times.
The FBI's study of active shooters found that 73 percent had a known connection to the attack site, and that many conducted surveillance beforehand. Preparation of that kind leaves traces, including questions in forums about where someone lives, photographs of buildings, and posts noting an executive's schedule.
Digital Threats Vs Physical Threats: The Role OSINT Plays In Both
The categories overlap in practice, since the same open sources feed both.
On the digital side, the recurring problems are doxing, where home addresses and family details get published; harassment campaigns that recruit participants; impersonation accounts and spoofed domains; credential exposure appearing in breach dumps tied to executive email addresses; and data broker listings that publish residential information continuously. California's Delete Act created the Delete Request and Opt-Out Platform, which opened to residents on January 1, 2026 and requires more than 500 registered brokers to process deletion requests from August 1, 2026, checking the platform at least every 45 days. Removal remains an ongoing task, because brokers reacquire data from other sources.
On the physical side, OSINT supports residence risk assessment, route and venue advance work, protest and demonstration awareness near sites an executive will visit, and credibility assessment of specific threats. Mapping that activity in a situational awareness view puts online signals and physical locations on the same picture, which is where distance and timing become part of the assessment.
The convergence shows up most clearly in sequence. A doxing post publishes a home address. Harassment follows in replies. Someone photographs the house. Each step is reachable through open source collection, and each one changes what the protective team should do next.
Threat Intelligence Monitoring For Executives
Useful monitoring starts from defined requirements rather than broad topics. For a principal, the query set typically includes name variants and misspellings, nicknames used by detractors, the company name paired with violent or threatening language, residence neighborhood and office location references, family member names where they appear publicly, and event names the executive will attend.
Those terms need maintenance. Detractor communities invent shorthand, substitute characters, and migrate to new platforms, so a query set written a year ago drifts out of coverage. Threat monitoring and alerting against a maintained set keeps volume reviewable, and deep and dark web search extends into spaces where content moves after removal from mainstream platforms.
Triage then separates expression from intent. Most hostile content about a public figure carries no capability, no specificity, and no proximity. The posts that warrant escalation tend to show a shift from grievance to planning, name a specific location or date, reference surveillance or travel toward the principal, or come from someone with a prior history in the file. Judging that shift means tracking the rate of change rather than the volume of mentions, which Liferaft's work on threat escalation velocity addresses directly.
Attribution turns an alert into an assessable subject. Investigations and identity resolution connects an account to a person, which determines whether the threat comes from a former employee two miles away or an anonymous account on another continent. Findings then belong in case management, with timestamps and source URLs intact, so the record supports a protective order application, a law enforcement referral, or the next analyst who sees the same subject.
Are Impersonation Threats An Issue For Executives?
Impersonation causes financial damage at a scale that physical incidents rarely reach. The FBI's 2025 Internet Crime Report recorded $20.877 billion in total reported losses, with business email compromise accounting for $3.046 billion across 24,768 complaints. The bureau logged 22,364 complaints with an AI nexus and adjusted losses near $893 million, including more than $30 million in BEC specifically tied to AI, and warned that voice cloning is used to impersonate executives and request wire transfers.
Impersonation takes several forms that protective teams can monitor. Fake social profiles using an executive's photograph solicit money or sell fraudulent investments to employees, customers, and the public. Spoofed domains and lookalike email addresses support payment fraud. Cloned audio and video target finance teams during urgent transfer requests. Fabricated statements attributed to a leader move markets and provoke harassment.
Detection relies on continuous monitoring for the executive's name and likeness across platforms, paired with a documented takedown process and, for the financial variants, a verification procedure that does not depend on recognizing a voice.
Executives At Events: Using OSINT For Event Security
Public appearances concentrate exposure, since the time, place, and attendee list are known in advance.
Advance work using open sources starts several weeks out and covers who has publicly objected to the executive or the company, whether any group has called for action at the venue, what the venue's layout and access points look like from published sources, and what has happened at comparable events there. Collection narrows in the final week to arrival logistics, parking and entrance details circulating publicly, and last-minute mobilization calls.
Monitoring continues through the event itself, because reaction inside a venue often reaches social platforms before it reaches the security radio. Our guide to AI and OSINT for event security covers that live layer in more detail.
Conference agendas, speaker pages, and social posts from organizers routinely publish more scheduling detail than a protective team would choose to release. Checking what is already public about an executive's appearance is part of the advance, and requesting changes to published material is often the cheapest mitigation available.
How Monitoring Services Can Help
Few corporate teams can staff continuous coverage on their own. Threats surface at night and on weekends, across languages and time zones, on platforms that change constantly.
Managed monitoring addresses the coverage gap, supplying analysts outside business hours, language capability, and familiarity with platforms that an in-house generalist sees rarely. Platform tooling addresses the collection and correlation gap, maintaining query sets across sources, clustering related activity, and routing alerts to the right person.
Decisions stay with the organization in either model. Whether to add a detail, change a route, cancel an appearance, or contact law enforcement involves tradeoffs around cost, disruption, and the executive's willingness to accept restrictions, and those judgments sit with the people accountable for them. Programs also carry duty of care obligations that extend past the principal to the staff traveling with them.
Securing Executives With Liferaft
Liferaft, a Securitas company, supports more than 200 organizations worldwide with continuous monitoring across social media, forums, alternative networks, and deep and dark web sources, built around principal profiles rather than generic threat feeds.
The workflow runs from detection through decision. Alerts surface threatening and escalating activity tied to an executive's name, residence area, or scheduled appearances. Identity resolution connects personas to real actors so credibility and proximity can be assessed. Geospatial mapping places activity against travel plans and venues. Case files hold evidence, assessments, and history, so a recurring subject is recognizable the next time the name appears.
Teams can read more about our approach on the executive protection use case page, or book a discovery call to walk through how this fits an existing protective program.