Coverage raised around a moment.
A board meeting, a keynote, a filing, a trip. The location is fixed, the attendees are known, and the schedule is public, so the window of exposure is concentrated and so is the attention. Event Monitoring is ThreatWatch pointed at that window: before, during, and after.
The same collection, the same analysts, and the same escalation as the standing watch, concentrated on a date. For a ThreatWatch client it is a change of posture. For anyone else it is a one-time service scoped to the window.
A known date makes a predictable target.
The standing watch reads a wide field at a steady rate. An event collapses that field into one place and one time, and the digital traces of an event arrive before the event does.
The target is scheduled.
An adversary who wants to reach a person usually has to find them. An event removes that work: the venue, the date and the guest list are published, often by the host.
One leak lowers the floor for everyone.
A single compromised attendee, a photographed badge, a forwarded itinerary. The weakest exposure in the room sets the exposure of the room.
The signal comes before the act.
Chatter that names the event, images of the venue, a grievance moving from comment to planning. These appear online first, and they are readable if someone is reading.
What counts as an event.
Anything with a date, a place and a public name attached. Corporate and personal, and the household's occasions as much as the firm's.
| The moment | What is already exposed | What we watch for |
|---|---|---|
| Board and shareholder sessions | Attendee names, the venue, the company's identifiers and the agenda topics are all in circulation before the room fills. | Chatter that names the meeting, activist and grievance organizing around the date, itinerary leaks. |
| Keynotes, panels, public appearances | The date and the stage are advertised. Anyone who wants to be there knows exactly where and when. | Hostile intent attached to the event, surveillance imagery of the venue, impersonation built around the appearance. |
| Filings, verdicts, announcements | A lawsuit, an earnings call, a layoff, a verdict: the moment attention turns toward a name, and the days after it. | Narrative forming around the news, doxxing of the people named in it, escalation from comment to logistics. |
| Travel | A destination, a hotel, travel partners and a schedule, each one findable and each one harmless on its own. | Leaked itineraries, exposure of the people travelling, chatter tied to the destination or the route. |
| Family occasions | Weddings, graduations, memorials. Registries, invitations and photos put the household's location on the record. | Address and date exposure, the household's own posts, anyone paying attention to the client's circle. |
| Launches, openings, galas | Guest lists, sponsors and press make the room public before the doors open. | Protest organizing, counter-event planning, fake accounts and tickets, surveillance of the venue. |
Before, during, and after.
Coverage rises as the date approaches, peaks while the room is full, and stands down with a sweep. What persists past the sweep moves into the standing watch.
Scope and reduce
The window is instrumented: names, venue, dates, agenda, travel partners, organizational identifiers. What is already public is mapped, and what can be removed in time is removed.
Live read
Location-tagged chatter, imagery and hostile signals read in real time by an analyst on call, with a direct line to your security lead.
Sweep and stand down
Residual exposure is found and dealt with: photos, documents, attendee lists, recordings. The window closes with a written record.
Before · from the day we are told
- Scope the window. Who will be there, where, when, and what the public already knows about each of those.
- Map the exposure. Addresses, itineraries, registries, family posts, the venue's own publicity, read as an adversary would read them.
- Reduce what can be reduced. Removals against the records that matter for this date, through Obscurity, with enough lead time to land.
- Scan in rounds. Collection is refreshed as the date approaches, because the chatter that matters tends to arrive late.
- Brief the ground team. The pre-event brief goes to whoever holds the physical plan, in a form they can act on.
During · the day, or the days
- Live coverage. Chatter and imagery tagged to the location or the event, hostile intent attached to a name, the event's own hashtag read for who is using it and why.
- Impersonation and fakes. Accounts, tickets and messages built around the event, caught while they are still new.
- An analyst on call. Findings are read before they are sent. What reaches your security lead states the finding, the confidence and the recommended response.
- Escalation that fits the plan. Agreed in advance with the physical team, so a signal becomes a decision rather than a surprise.
After · the week that follows
- Residual sweep. Photos, documents, recordings and conversations that outlive the event and could create ongoing risk.
- The record. What was seen, what was done, and what was decided, kept in a form counsel and the security team can use.
- Hand-off. Anything still moving goes into the standing watch, or into Groundtruth if a signal has a person behind it worth naming.
A brief before, a line during, a sweep after.
The exposure map and the findings
What is public about the people, the place and the plan; what hostile signal exists around the date; and what the physical team should change because of it. Delivered with time to act on it.
A judgment, not an alert
Nothing reaches you that an analyst has not read. Each escalation is a finding with a confidence and a recommended response, sent to the person who can act on it.
What outlived the day
The residual exposure, what was done about it, and what moves into standing coverage. The window closes on paper, not by lapsing.
Already watched, or not yet.
A change of posture on the watch you have.
Your exposure is already instrumented and your analysts already know the ground. Tell us the date, and coverage concentrates around it with no new onboarding, then returns to the standing rate after the sweep.
One service, scoped to the window.
Event Monitoring stands on its own for a single occasion: a trip, a meeting, a wedding, a hearing. Lead time matters more than anything else about it, because reduction and the early scanning rounds need weeks, not days. The standing watch is the natural next step for anyone whose calendar has more than one such date.
Obscurity
Reduction before the date. Most of what makes an event findable was findable already; the window is a reason to remove it now. Obscurity →
Groundtruth
When a signal has a person behind it, the same team investigates under a private investigator license, and the finding is prepared in a form counsel can file on. Groundtruth →
Physical security
We read the digital terrain so the team on the ground can read the ground. Where you have no physical team, our partner network does. Partners →
The limits, stated.
Event Monitoring is not a guard service and not a substitute for the venue's own security. It reads what circulates where it can be read; a closed channel we cannot see is a gap we will name rather than paper over. It raises how early you know, and how well you understand what you know. It does not promise that nothing will happen.
Tell us the date.
The earlier the window is scoped, the more of it we cover: reduction lands, the scanning rounds have time to run, and the ground team gets the brief before the plan is fixed.
One window. Read by analysts.