This converging landscape has shifted executive protection from a reactionary and operational pursuit to an intelligence-driven mission. The keys to making this transition are the organization's Global Security Operations Center (GSOC) and Protective Intelligence support. 

Executive Protection — A Focus on the Past. A Look to the Future. 

Traditionally, executive protection focused on providing the protective force around executives who might be confronted by criminal activity, demonstrations, protests or isolated individuals driven to extremes. However, the current risk ecosystem is much more complex and challenging. Corporate executives are frequently symbolic targets as a result of their role within an organization that draws global scrutiny of actions pertaining to anything from business decisions regarding layoffs, environmental policies, mergers and acquisitions, or product and services technology development, political leanings and labor or international relations disputes. As such, this brings heightened risk with regard to: 

• Geopolitical instability 
• Political polarization 
• Violent extremism 
• Activist campaigns 
• AI-enabled misinformation 
• Doxxing/online harassment 
• Insider threats 
• Emerging mental health challenges 
• Cyber-physical convergence 

It is not an exaggeration to cite the murder of UnitedHealthcare CEO Brian Thompson, my former UnitedHealth Group colleague, in Manhattan in 2024, as evidence of just how real executive threats can be. In that instance, personal grievances evolved into targeted violence with disturbing swiftness, despite a well-executed protective plan. Consequently, no longer can organizations afford to view executive protection in isolation from broader enterprise intelligence, risk management, cybersecurity, and crisis management frameworks. 

Leveraging the GSOC As Your Organization’s Central Intelligence Engine 

While a common function found on most security floor plans, modern Global Security Operation Centers have grown well beyond the status of alarm monitoring centers. Today, and as represented by well-established security enterprises, GSOCs serve as intelligence-fusion centers, bringing together critical information from diverse sources to provide a comprehensive and shared view of the operational landscape. These resources may include Protective Intelligence, Open-Source Intelligence (OSINT), social media intelligence, travel risk intelligence, cyber threat intelligence, physical security technology monitoring and management, international news media surveillance, geopolitical intelligence, weather event management, and crisis management operations.  

Working synergistically instead of in silos, these disparate information feeds collectively form an effective tool to identify and address potential threats prior to incidents occurring. In essence, a functional and intelligence-led GSOC must always ask and answer the following critical questions before making any protective decisions: 

• What’s going on? 
• Why does it matter to the enterprise? 
• Who or what is at risk? 
• What actions should our Corporate Security or the organization take? 

This approach enhances rapid decision-making during dynamic situations. 

Understanding the Difference with Protective Intelligence 

Protective Intelligence is distinctly different from traditional investigation as its primary goal is not to discover how someone already committed a crime but to predict potential future risk by identifying behavior that indicates an intent for future targeting. A proven component of behavioral threat assessment is the fact that targeted violence rarely occurs spontaneously; individual behaviors typically evolve to demonstrate a move toward targeted acts. These indications may include: 

• Fixation with an individual or organization 
• Escalation of perceived grievances 
• Disclosure of violence in some form 
• Pre-incident surveillance 
• Requests for personal information 
• Testing the boundaries
• Increases in online abuse or vitriol directed at an individual or organization
• Indications of travel planning 
• Plans to acquire weapons 
• Attempts at unwanted or unauthorized contact 

Individually, a single clue may be of no great consequence, but collectively, when reviewed through the lens of a formal behavioral threat assessment model, these behavioral indicators can significantly enhance an organization's probability of mitigating risk before it results in targeted violence. Protective intelligence offers the ability to convert random information points into assessable intelligence. 

Putting Intelligence to Work to Shape and Enhance Executive Protection Planning and Execution

An executive team that must travel to or relocate to an unstable area will naturally need to consider secure transportation and hotel vetted to the highest standards, thorough planning of routes, emergency medical planning, and local law enforcement collaboration. However, the need of an intelligence-led protective program transcends the planning and logistics. The GSOC may identify potential risks such as planned protests near upcoming meeting sites or relevant venues, new cyber threats targeting the upcoming attendees, the current geopolitical environment at the destination, potential threats targeting an organization by one or more activist groups, developing patterns of criminal activity or known threats associated with local destinations, or even impending severe weather patterns.  

Protective intelligence will then determine if the executive is known to the threat, and if so, to what degree. With respect to potential new threats, the intelligence team will continue monitoring their activities, social media conversations and planning that could be indicative of harm or intent against the protected principals, generating an update to the current executive risk profile for before, during and after travel. 

Artificial Intelligence Offers the Protective Advantage, But Humans Are Still Required 

Machine learning and artificial intelligence are rapidly transforming protective intelligence, with algorithms increasingly able to assist analysts by identifying potential trends, summarizing information, and correlating various data sources. The goal of AI is to augment the work of skilled intelligence professionals by helping them: 

• Prioritize vast volumes of incoming information 
• Discern subtle but potentially important threats
• Identify behavioral shifts 
• Summarize lengthy reports 
• Draw connections between seemingly disparate data sets 
• Automate recurring monitoring tasks 
• Expedite travel security analysis  
• Aid in the analysis of human behaviors 

AI should complement, not replace, human intelligence specialists. Nuance, intent, credibility, cultural context, and the psychological factors underlying a threat often require the experience and understanding that only human analysis can provide. The firms or companies that will win the battle against emerging threats will be those who best integrate cutting-edge technological capabilities with experienced human insight. 

Looking toward the future, executive protection is becoming less an operation and more an intelligence function built on a strong operational foundation. With growing geopolitical uncertainty, increasing speeds of data dissemination through AI, and the convergence of digital and physical threats, relying on historical protective strategies will eventually leave organizations exposed. Organizations must focus on an integrated approach that includes Global Intelligence operations, behavioral threat analysis, advanced data analytics, and tactical protection to keep pace with ever-changing threats to corporate leaders. 

Today, executive protection is about proving value to executive leadership not by how the team reacts in crisis but how well the organization anticipates, assesses, and prevents the crisis from happening to begin with.