Security Magazine logo
search
cart
facebook twitter linkedin youtube
  • Sign In
  • Create Account
  • Sign Out
  • My Account
Security Magazine logo
  • NEWS
    • Security Newswire
    • Technologies & Solutions
  • MANAGEMENT
    • Leadership Management
    • Enterprise Services
    • Security Education & Training
    • Logical Security
    • Security & Business Resilience
    • Profiles in Excellence
  • PHYSICAL
    • Access Management
    • Fire & Life Safety
    • Identity Management
    • Physical Security
    • Video Surveillance
    • Case Studies (Physical)
  • CYBER
    • Cybersecurity News
    • More
  • BLOG
  • COLUMNS
    • Cyber Tactics
    • Leadership & Management
    • Security Talk
    • Career Intelligence
    • Leader to Leader
    • Cybersecurity Education & Training
  • EXCLUSIVES
    • Annual Guarding Report
    • Most Influential People in Security
    • The Security Benchmark Report
    • The Security Leadership Issue
    • Top Guard and Security Officer Companies
    • Top Cybersecurity Leaders
    • Women in Security
  • SECTORS
    • Arenas / Stadiums / Leagues / Entertainment
    • Banking/Finance/Insurance
    • Construction, Real Estate, Property Management
    • Education: K-12
    • Education: University
    • Government: Federal, State and Local
    • Hospitality & Casinos
    • Hospitals & Medical Centers
    • Infrastructure:Electric,Gas & Water
    • Ports: Sea, Land, & Air
    • Retail/Restaurants/Convenience
    • Transportation/Logistics/Supply Chain/Distribution/ Warehousing
  • EVENTS
    • Industry Events
    • Webinars
    • Solutions by Sector
    • Security 500 Conference
  • MEDIA
    • Videos
      • Cybersecurity & Geopolitical Discussion
      • Ask Me Anything (AMA) Series
    • Podcasts
    • Polls
    • Photo Galleries
  • MORE
    • Call for Entries
    • Classifieds & Job Listings
    • Continuing Education
    • Newsletter
    • Sponsor Insights
    • Store
    • White Papers
  • EMAG
    • eMagazine
    • This Month's Content
    • Advertise
  • SIGN UP!
Security Leadership and ManagementPhysical SecurityCybersecurity News

Understanding the Convergence Between Online and Real-World Threats

By Jon Gonzalez
cyber-threats
August 1, 2019

What happens online sometimes manifests as a real-world threat. Real-world threats are typically planned, referenced or originated online. Understanding the convergence between online behavior and real-world actions is increasingly important in the corporate security field. Here’s how security professionals can think about identifying and understanding threats in a society that increasingly straddles the virtual and physical worlds.

 

Listen to the noise, but understand the signals

There’s no shortage of angry chatter online. Indeed, without outrage and anger, the internet would be a much quieter place. But malicious actors, whether they’re targeting an event, a company/institution they dislike, or specific people, can be distinguished from the typical online chatter. The more information we have on suspected threats, the better our understanding of the malicious actor and their intent.

By running online searches—both persistent and intermittent—for relevant keywords, phrases, and topics that relate to threats and vulnerabilities, analysts can identify potentially malicious actors. That same search capability can also be used to provide valuable context. Such deep dives in order to understand the malicious actor and their context is similar to the nuts and bolts of investigative work. Consequently, each case is different. However, some commonalities are worth mentioning.

To begin, it’s important to understand where the conversation is taking place. Yes, some malicious actors openly discuss their plans and views on popular social media platforms. But increasingly, those conversations are shifting to the deep and dark web. For example, the gunman who attacked a synagogue in Pittsburgh last year spoke openly and often on Gab, a message board frequented by extremists. A persistent search for anti-Semitic threats would certainly yield results on popular social media platforms, but arguably that same conversation on a deep or dark web message board that’s popular with extremists should raise a red flag for a security analyst.

Once a potential threat is identified, search is also a valuable tool for fleshing out key details about the person or people in question. For example, an analyst can determine who that person regularly engages with online and whether their posts contain information that makes their threats more or less credible. Additionally, a detailed investigation into the online behavior of a potential threat can also clarify their connection to the target. Are they a malcontent who spews hate broadly, or do their online conversations fixate on a specific individual, institution or company? Do they have insider knowledge about the target, or do they appear to be reliant on publicly available information?

Lastly, it’s important for security analysts to determine how, if at all, the potential threat intersects with a real-world target. Here, NFL commissioner Roger Goodell provides a vivid example. Goodell is a lightning rod for online anger, especially during the NFL postseason. But both law enforcement and NFL security can use location to assess the veracity of each threat. After all, a threat who shares menacing plans or views online without moving toward the target probably isn’t as significant as a threat who changes their physical location to be in proximity of a real-world target. Consequently, NFL security can monitor the vocal chorus of fans who routinely express outrage at Goodell while focusing on the much smaller subset who take real-world actions that put them on an intercept course with the target.

 

The best defense is multi-pronged

Unfortunately for corporate security teams, a given target can have any number of vulnerabilities. An airline security team, for example, can monitor its brand’s online persona, track references to key executives and look for mentions of specific company locations. But airlines also work with numerous vendors to perform maintenance, food service, cleaning, and a range of other services. Each one of these vendors represents a vulnerability to the airline. Of course, in this regard, airlines aren’t any different from the vast majority of corporations today.

One way for companies to maximize their security is to insist that their vendors also direct resources to understand the convergence between online and real-world threats. A firm that provides food service to an airline, for example, might not be a household name, but given its proximity to well-known brands, that vendor should be searching the deep and dark web for conversations about their business. Ideally, each vendor in a supply chain will directly or indirectly employ search technology and share information throughout the chain to better understand potential threats.

 

Why convergence matters

We tend to think of security in terms of the worst case scenario. A threat that goes undetected results in the loss of life or property. Obviously, all security professionals want to avoid these catastrophic outcomes. But understanding the convergence between online and real-world threats isn’t just about avoiding the worst case scenarios, it’s about building a more effective holistic security operation.

From a planning perspective, a clearer understanding of the convergence of online and real-world threats can inform decisions about where to deploy resources in the short run and where to invest in countermeasures for the long term. A security team at a power plant, for example, might choose to invest in drone countermeasures even when there’s no credible threat because they’re seeing a proliferation of drone video footage of their installation posted on the deep and dark web. Conversely, that same power plant might choose to ratchet down their response to local protestors because a better understanding of those online conversations indicates a low propensity to violence.

Understanding the convergence of online and real-world threats also puts the security team in a better position to advise clients about the actions they need to take in advance of a threat. Canceling an event or closing an installation comes with costs that can be especially burdensome if the threat lacks credibility. Along similar lines, actions taken in response to perceived threats can have reputational costs as well.

Ultimately, there’s no such thing a crystal ball. But the more we know about the convergence between online and real-world threats, the better off we are in a noisy, scary world. Because while the number of threats is disproportionately lower than the volume of menacing posts on the deep and dark web, it’s our understanding of that online context that safeguards our companies, locations, events and people.

This article originally ran in Today’s Cybersecurity Leader, a monthly cybersecurity-focused eNewsletter for security end users, brought to you by Security Magazine. Subscribe here.

KEYWORDS: cyber threats cybersecurity social media monitoring

Share This Story

Looking for a reprint of this article?
From high-res PDFs to custom plaques, order your copy today!

Jon gonzales pic
Jon Gonzalez is VP of Babel Street.

Recommended Content

JOIN TODAY
To unlock your recommendations.

Already have an account? Sign In

  • Security's Top Cybersecurity Leaders 2024

    Security's Top Cybersecurity Leaders 2024

    Security magazine's Top Cybersecurity Leaders 2024 award...
    Cybersecurity
    By: Security Staff
  • cyber brain

    The intersection of cybersecurity and artificial intelligence

    Artificial intelligence (AI) is a valuable cybersecurity...
    Columns
    By: Pam Nigro
  • artificial intelligence AI graphic

    Assessing the pros and cons of AI for cybersecurity

    Artificial intelligence (AI) has significant implications...
    Cybersecurity
    By: Charles Denyer
Subscribe For Free!
  • Security eNewsletter & Other eNews Alerts
  • eMagazine Subscriptions
  • Manage My Preferences
  • Online Registration
  • Mobile App
  • Subscription Customer Service

More Videos

Sponsored Content

Sponsored Content is a special paid section where industry companies provide high quality, objective, non-commercial content around topics of interest to the Security audience. All Sponsored Content is supplied by the advertising company and any opinions expressed in this article are those of the author and not necessarily reflect the views of Security or its parent company, BNP Media. Interested in participating in our Sponsored Content section? Contact your local rep!

close
  • Crisis Response Team
    Sponsored byEverbridge

    Automate or Fall Behind – Crisis Response at the Speed of Risk

  • Perimeter security
    Sponsored byAMAROK

    Why Property Security is the New Competitive Advantage

  • Duty of Care
    Sponsored byAMAROK

    Integrating Technology and Physical Security to Advance Duty of Care

Popular Stories

Pills spilled

More than 20,000 sensitive medical records exposed

Laptop in darkness

Verizon 2025 Data Breach Investigations Report shows rise in cyberattacks

White post office truck

Department of Labor Sues USPS Over Texas Whistleblower Termination

Computer with binary code hovering nearby

Cyberattacks Targeting US Increased by 136%

Internal computer parts

Critical Software Vulnerabilities Rose 37% in 2024

2025 Security Benchmark banner

Events

September 29, 2025

Global Security Exchange (GSX)

 

November 17, 2025

SECURITY 500 Conference

This event is designed to provide security executives, government officials and leaders of industry with vital information on how to elevate their programs while allowing attendees to share their strategies and solutions with other security industry executives.

View All Submit An Event

Products

Security Culture: A How-to Guide for Improving Security Culture and Dealing with People Risk in Your Organisation

Security Culture: A How-to Guide for Improving Security Culture and Dealing with People Risk in Your Organisation

See More Products

Related Articles

  • The Unstoppable Convergence Between Physical and Cybersecurity - Security Magazine

    The Unstoppable Convergence Between Physical and Cybersecurity

    See More
  • real estate contract

    Understanding cyber risks in the real estate industry

    See More
  • iPhone

    Find the balance between security and privacy in a BYOD world

    See More
×

Sign-up to receive top management & result-driven techniques in the industry.

Join over 20,000+ industry leaders who receive our premium content.

SIGN UP TODAY!
  • RESOURCES
    • Advertise
    • Contact Us
    • Store
    • Want More
  • SIGN UP TODAY
    • Create Account
    • eMagazine
    • eNewsletter
    • Customer Service
    • Manage Preferences
  • SERVICES
    • Marketing Services
    • Reprints
    • Market Research
    • List Rental
    • Survey/Respondent Access
  • STAY CONNECTED
    • LinkedIn
    • Facebook
    • YouTube
    • X (Twitter)
  • PRIVACY
    • PRIVACY POLICY
    • TERMS & CONDITIONS
    • DO NOT SELL MY PERSONAL INFORMATION
    • PRIVACY REQUEST
    • ACCESSIBILITY

Copyright ©2025. All Rights Reserved BNP Media.

Design, CMS, Hosting & Web Development :: ePublishing