Three Years of Data Reveals Where Threats to Executives Are Concentrating
Insights from TorchStone Global show how executive threats are evolving and where protection teams should focus
For executive protection teams, the most consequential threats rarely arrive as a clear, direct warning. They develop through patterns: a grievance taking shape online, repeated unwanted contact, a residence that is easy to locate, or activity that seems disconnected until viewed alongside other signals.
That is the central finding from more than three years of reporting by TorchStone Global, an Ontic partner and protective intelligence firm. Through its monthly Executive Protection Report, TorchStone tracks open-source incidents involving business executives, government officials, celebrities, and other high-profile individuals. The reporting includes attacks that make national news, as well as disrupted plots, stalking, threatening communications, and other incidents that receive less public attention.
Taken together, the data offers a clearer picture of how executive risk is changing.
4 Shifts Reshaping Executive Risk
01
The residence remains the primary point of exposure
Across TorchStone’s reporting, residences are the most common location for incidents involving high-profile individuals. That pattern is intuitive, but it carries an important operational implication: residential security cannot be an afterthought to travel protection.
A home is a predictable location, and determined actors can often identify it with relatively little effort. TorchStone analysts note that addresses can be pieced together through county property records, business filings, LLC registrations, social media posts, and other open sources. In TorchStone’s own assessments, analysts can independently locate a high-profile individual’s residence about 90% of the time.
The risk is broader than targeted violence. TorchStone has documented dozens of residential burglaries over the past three years, including incidents in which offenders exploited unprotected glass doors and windows or homes with alarm systems that were not activated or properly connected. Public travel schedules can create additional exposure when they reveal that a home is likely to be unoccupied.
For protection teams, the takeaway is practical. Conduct residential assessments, test alarm coverage and use, account for large glass entry points, and make sure principals, family members, and household staff have the means to report suspicious activity. A recurring visitor, an attempted contact, or a person who appears repeatedly near a property may be a small detail, but it can become meaningful when connected to other intelligence.
02
Threat activity is moving from fame to function
TorchStone’s data also points to a shift in who is being targeted. Traditional risk frameworks have often concentrated on highly visible people: celebrities, billionaires, and national political figures. Those individuals remain at risk, but recent incidents show that visibility alone no longer explains exposure.
Executives and public officials can become targets because they are perceived as the human face of an institution, industry, or issue. A utility leader can become associated with energy costs. A mayor can become associated with local crime trends. A defense executive can become associated with a geopolitical conflict. In each case, a broader grievance attaches to an organization, then to the person seen as representing it.
That expansion has consequences for security programs. Protective decisions should account for a principal’s role, company activity, public profile, policy positions, and emerging controversies, not simply name recognition. Teams should also look beyond their own organization. Threats against peer companies, industry leaders, facilities, or local officials may reveal a grievance that could transfer to their principal.
03
The most useful signals are often indirect
Direct threats warrant immediate attention. But TorchStone’s reporting shows that they are only one part of a developing threat picture. In many cases, concerning behavior appears first as fixation, escalating grievance, repeated commentary, or a narrative that seeks to justify harm.
Threatening communications are rising across social media, public comment sections, online forums, email, and direct messages. These channels can help analysts understand who a person is angry with, why they feel aggrieved, and where they may be in a pathway toward action. They can also reveal location, intent to travel, or a shift from broad rhetoric to more focused interest.
The goal is to identify concerning patterns early enough to intervene before a protection team is responding to a crisis. That requires analysts to examine context, rather than treating each post or report as an isolated event. A generic online threat, for example, may become far more serious when it aligns with a principal’s scheduled appearance, a particular venue, or evidence of fixation.
04
Protective intelligence must drive protection planning
The value of this approach is clear when incidents are disrupted before anyone is harmed. TorchStone’s reporting captures those quieter successes, which may not receive the attention of an attack but offer equally important lessons for practitioners.
One recent example involved a social media threat connected to a university commencement where a CEO was scheduled to speak. The threat did not initially name the executive. Authorities identified it, obtained a warrant, and took the suspect into custody, allowing the event to continue as schedules. In another case, security personnel at a corporate headquarters identified and detained an armed individual shortly after he entered the campus while senior executives were gathered for a meeting.
These outcomes are the product of preparation. Intelligence should inform the earliest stages of a trip, event, or residential security plan. Teams need to understand what is being said about the principal, their organization, their industry, the destination, and the venue. That insight can shape staffing, coordination with local law enforcement, venue planning, and communications with the principal.
Turning intelligence into action with TorchStone and Ontic
TorchStone’s Executive Protection Report gives practitioners a view beyond headline events and into the broader patterns shaping risk. Its analysts bring that external context together with client-specific intelligence, using Ontic to centralize information from social media, news, field reporting, local law enforcement, residential staff, and other sources.
Connecting those inputs allows teams to build cases, associate incidents with the appropriate principals, map activity near residences and other key locations, and share relevant reporting with executive protection, residential security, and corporate security stakeholders. It also supports the ongoing intelligence cycle: as teams become more effective at recognizing and acting on risk, stakeholders are more likely to report the details that help analysts detect the next issue earlier.
Technology helps make that work scalable, but it does not replace judgment. TorchStone’s approach underscores the importance of experienced analysts who can distinguish between noise and a meaningful escalation, then give protection teams the context they need to make sound decisions.
What to prioritize now
The last three years of TorchStone data point to a few priorities for executive protection leaders:
- Treat residences as core protective environments, with the same rigor applied to travel and event security.
- Assess risk based on a principal’s function and the grievances attached to their organization or industry, not just their personal profile.
- Monitor for fixation, narrative, and behavioral escalation alongside direct threats.
- Bring digital, physical, and human-source reporting into a single operating picture.
- Use disrupted incidents and near misses to strengthen planning before the next threat emerges.
Threats to executives are more persistent and more connected than they may appear in isolation. TorchStone’s reporting provides the broader pattern. Combined with Ontic’s platform for organizing, contextualizing, and operationalizing intelligence, teams can move earlier, make better-informed decisions, and strengthen protection where it matters most.
