Protection Starts Before the Detail

The first question I get asked about executive protection is almost always about people. How many agents. Whether the car needs a driver. Whether the residence needs coverage overnight.

Those are reasonable questions. They are also the last questions in the sequence. Answering them first means buying a posture before anyone has established what the posture is for.

What the detail cannot see

I spent 20 years in the Army Infantry, including time on the Personal Security Detail for the U.S. Ambassador to Afghanistan, an environment governed by Diplomatic Security protocol. That environment had more protective resource per principal than almost any private engagement will ever have. The thing that kept the mission intact was not the size of the team. It was knowing the threat environment well enough to move through it deliberately.

Private-sector exposure works the same way, with one difference. The risk rarely lives where the security is. A principal is covered in the building and on the schedule. The exposure sits in the residence, in the routine, in the itinerary that got shared with a venue three weeks early, in the public record that lists a home address, and in the social account belonging to a family member.

A detail assigned before that picture exists is protecting the part of the day that was already the safest.

Where protection sits, and where exposure sits

Usually covered

OfficeScheduled meetingsAnnounced appearances

Usually exposed

ResidenceCommute and routineTravel and hotelsPublic recordsFamily accountsPersonal devices

Threat, vulnerability, exposure, consequence

Every protective assessment I run comes down to four questions, and they have to be answered together.

What is the threat, meaning who has demonstrated interest, capability, grievance, or fixation. What is the vulnerability, meaning where the current posture can actually be defeated. What is the exposure, meaning how much of the principal's life is discoverable and predictable to someone who wants to find it. What is the consequence, meaning what it costs if the event happens.

A threat with no vulnerability is monitoring. A vulnerability with no threat is a maintenance item. Work belongs where all four intersect, and that intersection is different for a founder, a pipeline executive, and a creator with four million followers.

4 questions that define the approach

Threat

Who has demonstrated interest, capability, grievance, or fixation.

Vulnerability

Where the current posture can actually be defeated.

Exposure

How much of the principal's life is discoverable and predictable.

Consequence

What it costs if the event happens.

Threat without vulnerability is monitoring Vulnerability without threat is a maintenance item The intersection is what is prioritized

Predictability is the vulnerability

In the utility and pipeline work I did across the Berkshire Hathaway Energy portfolio, the assets could not move. Substations, compressor stations, and metering sites sit where they sit, and anyone can find them. Protection came from layering: detection, delay, communication, and a response that had been rehearsed. CISA publishes the sector guidance most of that work is measured against.

People are not fixed assets, but most people behave like one. Same gym at the same hour. Same coffee stop. Same gate at the same airport. Same route home. Predictability is what turns general interest into an opportunity, and it is usually the cheapest thing on the list to fix.

The same applies to information. A tour date, a school pickup, a home listing photo, a livestream that shows the street outside the window. None of it looks like a security problem in isolation. Together it produces a pattern.

None of these is a security problem alone

Tour date announcedSchool pickup timeHome listing photosLivestream window viewGym check-inSame airport gate

A locatable, predictable pattern

Creators have a version of this that most executives do not

Public access is part of a creator's business. The audience relationship generates the revenue, so reducing exposure by disappearing is not a real option.

That makes the work more precise. The question is not whether to be visible. It is which details are load-bearing for the business and which ones are simply leaking. A creator can keep the audience and still stop broadcasting location, routine, home layout, and travel in advance.

Intelligence before manpower

When WorldSafe finishes an assessment, protective personnel are one possible recommendation among several. Often the higher-value items are quieter: removing records from broker sites, changing an arrival pattern, fixing who has residential access, writing down what staff do when someone shows up at the gate, and securing the accounts that would let an impersonator do damage without ever being in the same city. The FTC and CISA personal security guidance both cover parts of that ground.

Those items are cheaper than a detail and they work even when the detail is not there, which is most of the time. The same logic drives the Risk Snapshot we run on facilities: find the gaps, rank them, then fix the easy ones first.

Risk also does not hold still. Visibility increases, a residence changes, a tour is announced, a company restructures, someone new gains access, and behaviors of concern escalate. A baseline assessment is the starting point. Keeping it current is the work, which is what Resiliency as a Service exists to do.

Not every high-visibility person needs a protective detail. Every high-visibility person should understand their exposure. Start there and the staffing question answers itself.

Sources and further reading

• CISA: Personal security considerations
• CISA: De-escalation series
• U.S. Secret Service National Threat Assessment Center
• FTC: Privacy and security guidance
• WorldSafe glossary: security and resilience terms