From boardrooms
to backyards.

Why it matters

Executives tend to dismiss assassination risk as remote. They are not heads of state. But recent cases show the line between online hate and physical action has thinned. Social media mobilizes strangers and AI deepens grievances, so targeted violence can escalate from rhetoric to reality faster than a traditional security team can react.

Adversary behaviour

Attackers no longer need inside help. They stitch together open-source fragments, an exposed address here, a leaked flight detail there, into a digital attack map that sets timing and location.

Digital triggers

• Data broker sites publishing home addresses and property records.
• Conference agendas and LinkedIn posts that pinpoint time and place.
• Chatter in fringe forums, usually dismissed until after the attack.

Counter-moves

• Suppress. Remove home addresses, property filings and related family data from people-search and broker sites.
• Monitor. Track open, deep and dark web chatter for escalation that names the principal.
• Compartmentalize. Obscure travel patterns, limit agenda disclosures, and separate communications so an itinerary cannot be pieced together.

Why it matters

Corporate offices are hardened. Residences are not. Executives often own several homes, a penthouse, a vacation property, a rural retreat, and each new address widens the attack surface. For an adversary, the softer perimeter makes the residence the easiest place to strike.

Adversary behaviour

Criminals no longer need to follow an executive home. They map entry points and confirm occupancy from digital leaks. Vacation properties are the most exposed: empty for months, lightly watched, easy targets.

Digital triggers

• Property records exposed on people-search sites.
• Real estate listings and satellite imagery that confirm the layout.
• Family posts geotagging a secondary residence.
• Utility contractors and service vendors leaking client details.

Counter-moves

• Suppress. Remove property addresses from brokers and real estate archives.
• Audit. Review secondary and vacation homes with the same rigour as the primary residence.
• Deceive. Obscure occupancy patterns, lights, utilities and travel disclosures, so there is no easy window.

Why it matters

Kidnapping is a low-frequency, high-severity risk. Uncommon in the US, but an executive travelling internationally, or a family at home, faces real exposure. Kidnappers are motivated by ransom, revenge or politics, and their planning is increasingly digital.

Adversary behaviour

Target selection starts with perceived vulnerability, and the family is often the softest flank. Attackers harvest digital signals to time an abduction: a child's soccer schedule, a spouse's flight delay, a vacation post confirming no one is home.

Digital triggers

• Children's Instagram or TikTok posts revealing school, routines or vacations.
• School addresses indexed on people-search sites.
• Travel announcements in press releases or family posts.

Counter-moves

• Erase. Suppress family records, especially a minor's school and extracurricular details.
• Educate. Train family members to recognise what not to post.
• Protect. Use covert travel protocols and vetted transport for international trips.

Why it matters

Before an attack there is obsession. Stalkers and harassers test boundaries digitally long before they escalate in person. This is less about one catastrophic event and more about chronic exposure that erodes safety, sanity and reputation.

Adversary behaviour

Harassers thrive on access. Every contact detail is another way in: calls, texts, direct messages, a visit to the doorstep. For many the harassment is the attack. For some it is rehearsal for something physical.

Digital triggers

• Leaked personal phone numbers and email addresses.
• Oversharing on social media, by the executive or the family.
• Doxxing events where private details are published.

Counter-moves

• Monitor. Continuous sweeps for doxxing incidents, leaked numbers and impersonation.
• Take down. Rapid suppression of personal data before it spreads.
• Redirect. Controlled communication channels that contain a harasser and cut the escalation path.

Why it matters

Swatting has moved from internet prank to targeted attack on executives, judges and politicians. A false 911 call weaponizes the local police, bringing armed responders to the front door. Even when no one is harmed, the trauma, the reputational fallout and the strain on security are real.

Adversary behaviour

Attackers use the exposed address and a hacked or spoofed caller ID to stage a convincing emergency. Law enforcement, acting in good faith, becomes the vector. An executive with several residences has several addresses to weaponize.

Digital triggers

• Home addresses exposed on data broker sites.
• Spoofed phone numbers built from breach dumps.
• Published names tied to residential locations.

Counter-moves

• Pre-brief. Work with local police so the address is flagged against false reports.
• Suppress. Remove residential addresses from data brokers to reduce the targeting opportunities.
• Protocol. Set a family plan for an emergency response: who answers the door, who calls counsel, who notifies security.

Why it matters

Executives are most exposed in transit. Airports, hotels and conference centres are unfamiliar environments with thin perimeters. Itineraries are easier to find than most executives realise, and attackers exploit the predictable routine.

Adversary behaviour

Adversaries look for the gap in the schedule. A flight delay means hours in an unsecured lounge. A conference agenda says when the executive will be on stage. Nobody has to follow anyone; the breadcrumbs lead the way.

Digital triggers

• Flight data, sometimes scraped from public tracking services.
• Conference agendas and speaking slots posted online.
• LinkedIn updates and photos that confirm a location in real time.

Counter-moves

• Compartmentalize. Separate personal and professional travel channels to reduce leakage.
• Delay. Post travel details after departure, never live.
• Cover. Use controlled communications and burner devices abroad to limit metadata exposure.

Why it matters

The family is the open flank. Children, spouses and relatives have digital footprints of their own, usually unprotected and usually overlooked. Threat actors know a family member's exposed data is as valuable as the executive's own.

Adversary behaviour

When the principal is hardened, attackers pivot to the family. They monitor a child's social media, track a spouse's travel, or use an in-law's address. The family becomes the pathway into the executive's life.

Digital triggers

• Venmo or Cash App transactions exposing real-time location.
• Instagram or TikTok stories showing the daily routine.
• People-search records listing relatives and their addresses.

Counter-moves

• Audit. Extend footprint scans beyond the principal to the whole family circle.
• Train. Teach family members what not to post, what to lock down, and why.
• Shield. Monitor continuously for family-targeted doxxing or exposure.

Why it matters

Shareholder meetings, earnings calls, industry conferences: an executive cannot avoid the spotlight. Public events draw activists, protesters and opportunists, and one breach at an event can undo years of careful security.

Adversary behaviour

Attackers do not guess. They monitor online discussion, coordinate protests, and use digital signals to predict exactly where and when an executive will appear. Event disruption is usually staged online weeks in advance.

Digital triggers

• Publicized event locations and times.
• Activist chatter on forums and Telegram channels.
• Travel leaks confirming the executive's presence.

Counter-moves

• Sweep. Pre-event monitoring of social platforms, dark web chatter and activist forums.
• Blend. Compartmentalize itineraries and control disclosures to limit public targeting.
• Respond. Train event staff in rapid threat response tied directly to the intelligence feed.

Why it matters

Executives are surrounded by employees, contractors and consultants with access to routines, spaces and systems. Most are loyal. Some are not. A disgruntled insider does not need to hack in. They already know the passwords, the layouts and the shortcuts.

Adversary behaviour

Insiders exploit trust. They combine what they know with what has leaked, a credential, a shared floorplan, to pass barriers an outsider struggles with. Many act after termination, when anger runs hot and access has not yet been revoked.

Digital triggers

• Employee credentials leaked on the dark web.
• Online grievances from current or former staff.
• LinkedIn posts exposing roles, responsibilities and access.

Counter-moves

• Monitor. Track leaked employee credentials and insider chatter online.
• Audit. Enforce rapid offboarding and least-privilege access.
• Probe. Run red-team scenarios that assume an insider is already inside.

Why it matters

Executives rely on drivers, contractors, household staff, medical providers and third-party vendors, and each one is an entry point. A weak link in that chain can expose access to homes, offices, even medical records.

Adversary behaviour

Attackers target the overlooked layer. Instead of the armoured SUV, they approach the driver at his side job. Instead of the CISO, they breach a vendor with weaker defences. The chain is only as strong as its weakest subcontractor.

Digital triggers

• Contractors naming executive clients on their websites or LinkedIn profiles.
• Vendor invoices that leak addresses and schedules.
• Medical and wellness staff posting about their celebrity clients.

Counter-moves

• Vet. Audit vendors for digital hygiene and confidentiality.
• Restrict. Limit how contractors handle or publish anything tied to the executive.
• Monitor. Extend the digital sweeps to vendors with proximity to the principal.