Protective intelligence: spotting threats to people before they act

The most cited study of attacks on public figures in the US examined 83 people who attacked or came close to attacking a prominent person. None of the 43 who carried out attacks had made a direct threat to their target. Fewer than one in ten of all 83 had threatened the target or law enforcement, yet about two thirds had spoken or written in ways that suggested they were considering an attack.

The lesson for companies is that waiting for a threatening letter is not enough. People who make threats and people who pose threats are often different groups, so a program has to look at behavior, grievances and intent, not just words aimed at the target.

Targeted violence usually follows a path: a grievance, then ideas about violence as a solution, then research and planning, then preparation such as acquiring weapons or watching routines, and finally the approach. Each step can leave signs, and each is a chance to step in.

Leakage is one of the most useful signs. It is when a person tells friends, coworkers or online audiences about their intent or plans. Unusual interest in an executive's schedule, home or family, repeated attempts at contact, and fixation on a company decision are others.

A protective intelligence program brings concerning information into one place: letters and emails to executives, social media mentions, reports from staff and security, and incidents at offices and events. Analysts triage each item, investigate the person behind it, assess whether they are on a path toward violence and open a case where needed.

Cases are managed, not just logged. Responses range from monitoring, to a conversation, to legal steps, to changes in an executive's routine or protection. The program works closely with human resources, legal, communications and the executive protection team, and it feeds the threat assessments that set protection levels.

Events far away can create threats at home. Companies tied in public debate to a war, a sanctions dispute, energy prices or a major layoff can become targets for activists, lone actors and online campaigns. In 2026, the Gulf conflict and energy shock have put shipping, energy and defense companies in that spotlight.

Protective intelligence also supports travel. Before an executive visits a country, analysts review local unrest, crime, kidnap risk and any targeting of foreign businesses, and keep watching while the trip is under way.

Monitoring must respect privacy, employment and human rights law in each jurisdiction. Set clear rules with counsel on what is collected, from where, who can see it and how long it is kept. Focus on behavior linked to a credible concern rather than broad surveillance of staff or the public.

Good documentation protects both the company and the people involved. It shows why a case was opened, what was assessed and why a response was proportionate.