threat intelligence

The Missing Link in Executive Protection: Why Protective Intelligence Services Matter More Now Than Ever

LeMareschal

Those who have been in the business for some time will tell you that executive protection is 90% about preventing threats and only 10% about responding to them. Preparation is key when it comes to protective details, and while physical security measures, highly trained agents, luxury vehicles, and advanced equipment are all critical components of any operation, one often-overlooked asset can mean the difference between proactive protection and reactive response: protective intelligence services.

We can all agree that the world is rapidly changing, and with it, so are the threats, how they materialize, and the individuals behind them. The ways in which hostile actors can reach and harm your clients are constantly evolving. A bodyguard today must consider and prepare for risks and threats that are significantly different from those of 15 or 20 years ago. The digital age has given criminals, stalkers, and hostile actors new tools to track, target, and attack high-profile individuals.  

Protective details are often perceived by the public as a purely physical profession, standing guard outside a client’s hotel room, escorting them from point A to point B, and responding to immediate threats. However, in reality, there is far more happening behind the scenes. A successful protective detail involves more than just the agents’ strength or combat skills. A security team that relies solely on reactive methods rather than proactive strategies is doomed to fail. If your protective team lacks the critical foresight needed to anticipate threats, avoid danger, and prepare before a situation escalates, failure is inevitable and failure in this industry can mean human loss, physical harm, asset loss, or reputational damage.

If you ask executive protection (EP) agents how often they have been provided with necessary protective intelligence by the companies that hired them, the majority will likely tell you they haven’t, unless they worked for a major corporation that either invested in its own intelligence division or sourced intelligence from a third party.

The reality is that most security firms neglect to integrate intelligence gathering and analysis into their protective operations, often citing cost concerns or client unwillingness to fund such capabilities. This short-sighted approach leaves agents in the field operating in a vacuum, exposed to a variety of dangers, limiting their ability to anticipate threats, assess risks, and make informed decisions that could prevent an incident before it happens. These security providers fail to recognize that protective intelligence is now a fundamental part of executive protection, just as advances, risk assessments, and threat assessments are (or at least, should be, for those still neglecting these basics). Intelligence should not be provided only if the client requests it; rather, it must be an integral part of every protective detail.

The Role of Protective Intelligence in Executive Protection Settings

Decades ago, intelligence services were primarily associated with government agencies and large corporations. However, today, with advancements in technology and access to open-source information, intelligence can be integrated into organizations of any size, whether small or large.

Consider this scenario: Your protective team has taken all necessary steps to keep your client’s dinner meeting at an A-list restaurant safe and confidential. They even booked the reservation under an alias. However, another customer at the restaurant recognizes your client and tweets on X, “Guess who’s having dinner at our restaurant?” followed by #YourClientsName.

Now, the location of your client’s dinner is public knowledge, rapidly spreading across X and other social media platforms. Meanwhile, your executive protection (EP) team still believes the visit is confidential, unaware that the client’s whereabouts have been exposed. This is critical information they should have in order to take precautions and act accordingly. But without protective intelligence services, they wouldn’t even know the exposure had occurred.

Now, let’s consider another scenario. One of your clients is on a business trip, staying at a hotel. Nearby, a protest is forming and moving closer to the hotel. As a security provider, you would want to advise your client to stay put until the situation stabilizes. But again, without intelligence services monitoring such developments, you wouldn’t have the necessary information to take proactive measures and you would ignorantly move your client into harm’s way.

Why Intelligence Matters in Executive Protection

Executive protection is not just about reacting to threats, it’s about preventing them from occurring in the first place. This is where protective intelligence plays a crucial role. While general intelligence involves gathering and analyzing information across various domains, protective intelligence is a specialized discipline focused on identifying, assessing, and mitigating threats before they materialize into real dangers.

Many executive protection teams rely solely on physical security measures, such as bodyguards, armored vehicles, and surveillance equipment. However, without an intelligence-driven approach, these teams are operating in the dark, reacting to threats as they unfold rather than anticipating, mitigating, avoiding, and/or neutralizing them ahead of time.

The Role of Protective Intelligence

Protective intelligence serves as the foundation of proactive security. It enables security teams to:

–Identify Threats Before They Become a Problem – Protective intelligence involves continuous monitoring of potential threats, including hostile actors, criminal activity, cyber threats, and geopolitical risks. This allows security teams to take preemptive measures rather than relying on last-minute reactions.

–Enhance Situational Awareness – Protective intelligence provides real-time updates on crime trends, civil unrest, and other evolving security threats in locations where clients are traveling or staying. This helps protection teams make informed decisions, adjusting routes and security plans as needed.

–Mitigate Risks Through Social Media Monitoring – We live in a digital world and many threat actors use social media to track, expose, or target high-profile individuals. Protective intelligence includes monitoring online threats, identifying potential leaks of a client’s location, and flagging concerning activity before it escalates into a real-world risk.

–Support Advance Work and Security Planning – Before a client arrives in a city/country location, at a venue, hotel, or meeting location, protective intelligence ensures comprehensive site assessments. Intelligence analysts vet the security of these locations, identifying potential risks and enabling teams to establish backup plans in case of emergencies.

–Provide a Strategic Advantage to Executive Protection Teams – Without protective intelligence, bodyguards and security teams are left to react to threats in real time, often with limited information. With intelligence, they gain a strategic advantage, allowing them to operate proactively and avoid unnecessary risk exposure.

While executive protection agents are considered the last line of defense,  intelligence services can extend their protective reach beyond the immediate environment as they can provide:  

  • Location-based and Situation-based risk assessments – Evaluating crime rates, political instability, and recent incidents at destinations.
  • Live threat alerts – Real-time updates on emerging dangers such as civil unrest, roadblocks, or suspicious individuals.
  • Pre-mission planning – Conducting advances on venues, hotels, and travel routes to preempt potential risks.

Why Small Firms Avoid Intelligence Services

However, despite its undeniable value, or how many will seek education on the topic, many executive protection firms only integrate protective intelligence when a client specifically requests it, and they can charge for it. This is a highly flawed approach because protective intelligence should not be seen as an optional service to add on, but it must be a core component of every security detail!  

A team that operates without intelligence is only providing half of the protection necessary to keep a client safe. In contrast, a security team equipped with protective intelligence is proactive, informed, and always one step ahead of potential threats. The reality is that many small executive protection companies skip intelligence capabilities because they often function on tight budgets and want to prioritize the most visible security measures which are bodyguards, vehicles, and sometimes surveillance equipment without realizing that intelligence is the very foundation upon which these elements should be deployed.

However, waiting for a client to demand intelligence services before integrating them into a security operation is fundamentally flawed. A security company should be advising the client on what is necessary, not the other way around. And when the client does not wish to pay for it, then what? You should have it as part of the services you provide in order to prepare and equip your agents best. The reluctance to invest in intelligence is a classic case of reactive security planning instead of proactive threat mitigation and that comes with a cost.  

The cost of ignoring the use of protective intelligence is exposing themselves to unnecessary risk and liability. A single incident, whether it’s an ambush, a targeted attack, an embarrassing situation, or even a travel or meeting disruption, can severely damage a company’s reputation, not to mention endanger lives and assets. On the other hand, an intelligence-driven approach enhances the professionalism of a firm and gives clients a reason to trust in the protective measures they provide.

Again, consider this scenario: A protective team is escorting an executive to a conference in a foreign city. Without intelligence, they are unaware that the hotel is located near an area experiencing political protests. A sudden outbreak of violence places the client and the team at risk. With an intelligence component, this risk would have been identified in advance, and an alternative plan could have been executed.

Making Protective Intelligence a Standard, Not an Option

Security firms must begin treating protective intelligence services as a standard part of their operations, not an add-on that only high-budget clients receive. Even small firms can develop intelligence capabilities by:

  • Hiring or outsourcing intelligence analysts who can provide actionable insights.
  • Using open-source intelligence (OSINT) to monitor real-time threats.
  • Using technology and proper AI-driven tools to track risk factors across different regions.
  • Training security personnel to integrate intelligence into their daily routines.

Prevention can be more effective than reaction, considering the fact the enemy holds the element of surprise and chooses when, where and how. The primary goal of a protective team is to be able to detect when, where and how and take proactive actions to prevent attacks.  

Protective Intelligence services allow for:
-Early threat detection – Monitoring and identifying potential threats before they become direct dangers.
-Predictive risk analysis – Understanding patterns of criminal activity, protests, or hostile surveillance.
-Strategic planning – Knowing the safest routes, venues, and contingency plans in advance.

An intelligence-informed protective team doesn’t just protect, it ensures their client never even faces the threat in the first place. Protective intelligence should not be seen as merely an expense but an investment in the effectiveness and credibility of a security detail. The most successful executive protection teams are those that blend physical security with actionable intelligence, ensuring they stay ahead of threats instead of merely reacting to them. When a protective team has access to protective intelligence, they elevate their role from a “security presence” to a “security strategist.”

It is time for executive protection companies, especially the smaller firms, to rethink their approach. Intelligence is not a luxury; it is an operational necessity that must be built into every protective detail, regardless of client expectations. If the goal is truly to protect, then intelligence must be at the core of every mission.

Chris Grow, Managing Partner, LeMareschal LLC

Identifying Suspicious Behavior: Essential Pre-Attack Indicator Training for Executive Protection Agents

LeMareschal

An article by Bob Duggan, Founder & President, Executive Security International

Senior executive protection professionals will all agree that the number one goal when performing protective details is to prevent a threatening or embarrassing situation before it becomes a reality for your client. Now, we all know that the majority of EP schools are highly invested in the ‘’cool guy skills’’. They spend hundreds of hours training in martial arts, firearms, evasive driving, etc. While those skills are important for anyone involved in the executive protection industry, we should not forget that equally important are the skills that will provide these agents with the necessary knowledge and tools of how to prevent a threatening situation.

Identifying suspicious person in a crowd

After more than 6 decades in this profession and having taught thousands of students, I can never highlight enough how important it is to have the ability to identify suspicious behaviors and clues to dangerousness. It is safer for both the client and the security team if the agents have a more proactive mindset rather than a reactive one. We all know by experience,  and from the hundreds of case studies, that no matter how skilled you are in martial arts or how great of a sharpshooter you are, when the moment comes and you have to respond to an attack, it doesn’t matter how many bad guys you can fight or shoot, or how fast or skillful you can drive. Because at that moment, the result of the fight will be determined by many factors other than your skills in fighting or shooting. How an attack toward your client will end depends on numerous variables such as the method of attack, the number of attackers, how well equipped they are, what kind of weaponry they are using, the attack area or “The X”, and most importantly, each one of the EP team member’s mental preparations to respond. Remember, the bad guys have done their homework, and they know your weak spots, and how and when to attack. So, they do have the upper hand in the surprise. Always keep in mind…They only have to get it right once…You have to get it right all the time.

And let’s not forget that while you are fighting or shooting publicly in the open, your client is quite exposed, could be seriously harmed, and will undoubtedly be scared emotionally for life! The fact that you could not foresee and/or plan to prevent a situation that put them at such risk is considered a failure. So, wouldn’t it be safer for everyone, and your job, to be able to prevent a threat instead of merely reacting to it? Again, the senior executive protection professionals will say over and over that the best protective details are not those based on force, numbers, or use of firearms, but those based on foreseeing an upcoming threat or embarrassing situation and preventing it. In the highly demanding and fast-changing world of protective details, the difference between a secure environment and a potentially dangerous situation is purely based on the agents’ ability to preemptively recognize and respond to suspicious behavior.

For more than 4 decades, at Executive Security International (ESI) we have been teaching thousands of students behavioral intelligence and how to identify clues to dangerousness. In simple words, we have been educating them on how to understand an attacker’s behavior, what are pre-attack indicators, and how to identify clues to dangerousness and suspicious behaviors.

Pre-Attack Indicators – Clues to Dangerousness

Pre-attack indicators are specific behaviors or actions that precede an attack, or illegal/bad act, and can serve as a warning to the observant protection agent that something wrong is going to take place. These indicators can vary widely but often include unusual patterns of body movements, facial expressions, gaze, overt interest in security measures, or attempts to breach the personal boundaries of the protectee. In the milliseconds prior to an attack, human predators quite often assume the physical features of apex predator animals as they close in on their prey/target. Being able to identify and understand these indicators requires the proper training on behavioral clues and a psychological insight into the mindset of potential attackers.

“Reading suspicious behavior”

One may ask, “Is it possible and easy to read others? Especially when it comes down to suspicious behavior?” Based on scientific evidence and real-life incidents, we can testify that it is possible and if trained properly, it is easy to do so. As with all skills, being able to read others and the environment around you requires constant training and good observation skills. After all, we can’t process the information we don’t see, correct?

Humans are emotional creatures, and what they feel (anger, fear, stress, happiness, embarrassment, etc.) can be seen through their body language or facial expressions. We can all tell why a child who is confronted by his parents is hiding his hands behind his body, or why some people are pacing back and forth in a hospital waiting room. In the same way, you can learn to identify suspicious behaviors and stop an attack before it takes place by simply observing peoples’ behavior, like someone who is going to commit an attack, either a suicide bomber or an attacker. They will display either stress, fear that they may be caught and fail their mission, or be under the influence of drugs. Being taught how these emotions are expressed through body movements and facial expressions can help you identify clues to dangerousness.

After the Manchester Arena terrorist attack that shook British society and the whole world, one of the event security guards, Kyle Lawler, said that the terrorist was reported by a member of the public who, he himself thought the person looked ‘’dodgy’’, and one of Showcase’s stewards also had a look at the terrorist minutes before he detonated his bomb. As Lawler continued with his testimony to the police, and according to The Guardian article, we read that:

“As Ali (Showcase steward) turned to have a look he’s (the terrorist) clocked that we are looking at him. He’s become fidgety with his hands. No sudden movements. He was watching us, watching him.“He would kind of look, slightly look away and look back at us.”In his statement to police, Lawler said: “I just had a bad feeling about him but did not have anything to justify that.”He said Abedi was “fidgety and sweating” and he said he panicked slightly and was “conflicted” because he thought something was wrong but could not put his finger on it, the inquiry heard.”

What we see in this horrific incident is that at least three people were aware of a suspicious presence/behavior. A member of the public who saw “something wrong” reported it to a security guard and an event steward. According to the description, we see a very usual behavior by someone who is going to do something bad. “He’s become fidgety with his hands” because he was stressed, “He would kind of look, slightly look away and then look back at us” because he wanted to make sure he wasn’t caught or somebody had spotted him, and he was “fidgety and sweating”, because he was showing signs of stress.

Looking at the last statement made by the security guard, he found a specific behavior wrong, and he felt conflicted because he didn’t know how to interpret it. Here again we see the importance of training Executive Protection professionals (and anyone related to the security industry) behavioral intelligence and clues to dangerousness. The sad part of this situation is that three people, without training, spotted something they knew was wrong and if they had been trained properly, they would have known why something looks wrong and how to deal with it. Perhaps, in this particular case, the outcome would have been significantly different with quite a lower number of casualties.

Another incident, definitely worth mentioning and studying is that of the on-camera assassination of Russian ambassador to Tukey, Andrey Karlov, who was shot dead at an Ankara gallery by a Turkish policeman who wanted to protest Russia’s involvement in the Syrian war. By watching the video, one can see the clear pre-attack indicators of the assassin, minutes before he starts shooting. For those of you who have seen the video, we invite you to watch it again and this time pay attention to the following findings:

  • His pacing in the background shows signs of stress.
  • When he stands still his feet are planted wider than his shoulder’s width which shows a person who is ready to get physically engaged.
  • He has interlocked his fingers with his thumbs touching each other which shows an elevated level of stress.
  • He touches his jacket frequently, which is a sign of soothing movement.
  • He is also seen to be checking his firearm. And at one point, beginning to go for the firearm, he regrets it and seconds later he touches his face, which is another sign of stress. Blood is gathering around the mouth and nose area.
  • His face shows contempt, which is very frequent with terrorists.

A significant point to also consider is that he was an off-duty officer, showing up at an event he had no business attending, and being in close contact, was somehow allowed to place himself behind the victim in a live event. This in combination with the rest of the signs should have been a big red flag for what was about to unfold.

politician greeting crowd

The majority of the assassinations, terrorist attacks, and other physical attacks, could have been prevented if security personnel were trained in how to identify clues to dangerousness. Effective protective operations are those where the agents anticipate potential scenarios and prepare accordingly, rather than merely reacting to events as they unfold. The role of an executive protection agent is more about preventing incidents than it is about responding to them.

We started implementing our studies and experience, on behavioral intelligence and body language, into our Executive Security International’s executive protection courses since the mid 80’s. From the early days of my career, I have been fascinated by, and at the forefront of exploring how, someone’s body language and movements within a crowd can serve as crucial indicators of intent, in particular, nefarious intent to harm our clients. After years of protecting celebrities and high-net-worth families, both abroad and in the U.S., my observations led me to investigate and study further about body language and microexpression clues and how, by observing them, one can identify suspicious behavior.

In 1985, I came across the groundbreaking work and research of Dr. Paul Ekman, whose studies on facial expressions and emotions deepened my understanding of deception detection. Although Ekman’s research wasn’t directly linked to aggression, it convinced me that trained observers/executive protection agents could spot the pre-indicators of assault and guide these agents toward strategies of preemptive intervention and therefore, prevention.

It’s important to highlight here that much of today what training institutions teach security personnel about situational awareness (SA) seems to be superficial. Five years ago, we realized that in practice, SA terminology often means the agent is merely waiting for something to happen. Still, many use ‘Situational Awareness’ as a reactive intervention strategy, which leads to late reactions, resulting in client harm or embarrassment. It is crucial for anyone interested in learning more about this field to understand that, while observing behavioral cues is critical, the key is to preemptively engage by confronting the Person of Interest (POI) through soft entry or hard contact. Preemptive Intervention now means engaging the POI, communicating with team members, and seeking a resolution before any actual contact with the client. Going back to our reference on the Manchester Arena terrorist attack, if the security guard was trained in how to engage with a suspicious person for that “first interview”, most likely he would have gotten a good idea that there was something wrong that needed to be reported and investigated further BEFORE that person/visitor could proceed further into the event facility. We will analyze this method in a topic that we will develop in depth in our next article.

Today, when we talk and teach about Behavioral Intelligence, Clues to Dangerousness and Predator Hunting/Preemptive Intervention in our ESI classes, we teach with knowledge that is backed up with both real-life experience and thorough research since the early 80’s. We are very passionate about this topic because we genuinely believe in its highly proactive approach. The skill to read behavioral clues has been tested and it has been proven that it works, and the ability to “read others and the environment around you” remains the cornerstone of effective security and protective measures.

Bob Duggan

Founder & President

For those interested in learning more about behavioral intelligence and clues to dangerousness, please visit www.esibodyguardschool.com 

Intelligence On the Go for All-Anytime You Need It

LeMareschal

In today’s fast-paced world, intelligence is not just a luxury — it’s a necessity. But who said it has to be unattainable or break the bank? At LeMareschal, we believe that every business, regardless of its size, deserves access to top-notch intelligence services.

We provide Customized Intelligence Reports:

  • Up-to-date information on security threats.
  • Risk management strategies.
  • Insights into global events.
  • Social Media Monitoring.

✔ Tailored for Every Business: Whether you’re a budding startup or an established enterprise, LeMareschal is here to ensure you’re always informed. Our dedicated team of intel analysts is committed to providing bespoke Intelligence Reports tailored just for you.

✔ Global Reach, Local Impact: Leveraging our global network, we offer real-time, relevant intelligence that empowers you to stay ahead of the curve. Our easy-to-read reports are designed to equip you with the information you need to make confident and secure decisions.

✔ Expertise You Can Trust: Our diverse team comprises seasoned security and intelligence professionals. Trained to the highest standards and with the latest intelligence platforms and tools, they are adept at delivering exceptional report products that stand out in clarity and precision.

✔ Comprehensive Intelligence Reports: Stay updated with our easy-to-read reports that cover a wide spectrum—from security threats and risk management strategies to global events. Our global network ensures you receive timely, accurate, and detailed insights, empowering you to stay a step ahead.

Intelligence isn’t just data – it’s a tool. A tool that equips you to make confident, secure decisions. With our risk briefings, you’re not just informed, you’re prepared. In a world where information is power, don’t let your business be left in the dark. Intelligence reporting isn’t just an add-on, it’s an integral component of a robust security plan.

What Makes Our Intelligence Division Unique? It’s not just about intelligence— it’s about understanding its application. Our analysts are not only skilled in intelligence analysis but also have hands-on experience in protective operations and security services. They know what’s crucial for protective and security teams, ensuring you get actionable insights.

Partnering with LeMareschal for your Intelligence needs you receive:

✔ Dedicated Intel Analysts: A team of intel analysts assigned just for you.

✔ Multi-Disciplinary Expertise: Our analysts are trained in both intelligence and protective services.

✔ Affordable Packages: Intelligence shouldn’t be a luxury, it’s a necessity we make affordable for all security companies.

Intelligence is The Cornerstone of Your Security Plan. Reach out to us to discover how LeMareschal can elevate your security and intelligence game.

Intelligence is valuable, and with LeMareschal, it’s within your reach!

#IntelligenceForAll #GlobalIntelligenceReports #SecurityThreatsInsights

#BespokeIntelligence #RiskManagementStrategies #SocialMediaMonitoring

#LeMareschalIntel #IntelAnalystsExpertise #ProtectiveServicesInsights

#AffordableIntelligence #ProtectiveIntelligence #ThreatIntelligence

Intelligence and Threat Monitoring Services For Corporations and Security Companies

LeMareschal

At LeMareschal, we specialize in providing top-tier intelligence analysis, intelligence reports, threat monitoring, and social media monitoring and investigations. Our team of highly skilled analysts, equipped with state-of-the-art technology and cutting-edge methodologies, works tirelessly to deliver accurate, actionable intelligence tailored to your specific needs.

Here’s why our services will be an invaluable asset to your security company or organization:

👉 Unparalleled Expertise – Our team is comprised of seasoned intelligence professionals with extensive backgrounds in law enforcement, military intelligence, and private security. With years of experience in various domains, we possess the knowledge and skills necessary to tackle complex security challenges head-on.

👉 Proactive Threat Detection – Our intelligence analysis services go beyond merely reacting to incidents. We adopt a proactive approach by constantly monitoring open-source intelligence, analyzing patterns, and utilizing advanced algorithms to identify potential threats before they materialize. By staying one step ahead, we help you minimize risks and prevent security breaches.

📝 Customized Intelligence Reports – We understand that every client’s needs are unique. Our intelligence reports are meticulously tailored to your specific requirements, providing you with the information you need to make informed decisions. Whether you require in-depth threat assessments, competitor analysis, or geopolitical risk reports, we deliver concise, accurate, and timely intelligence to support your decision-making process.

💻 Comprehensive Monitoring Solutions – In today’s digital age, social media platforms, and online channels play a significant role in shaping events and influencing security landscapes. Our social media monitoring and investigations help you stay ahead of potential risks by identifying early warning signs, tracking trends, and monitoring relevant conversations. By leveraging cutting-edge technology, we sift through vast amounts of data to deliver actionable insights.

🔐 Confidentiality and Privacy – We understand the sensitive nature of intelligence analysis and take utmost care to maintain client confidentiality and privacy. Our team adheres to strict ethical guidelines and operates with the highest level of professionalism, ensuring that your sensitive information remains secure and always protected.

💲 Cost-Effective Solution – Investing in our intelligence analysis and monitoring services allows you to optimize your security resources. Instead of allocating valuable personnel and time to gather and analyze information, you can rely on our expertise to deliver comprehensive intelligence, freeing up your team to focus on strategic decision-making and operational execution.

☎ Contact us today to schedule a consultation and see how our services can transform your security operations.


#threatintelligence #intelligencesolutions #threatmonitoring #protectiveintelligence #osint #intelligencereports #intelligenceanalysis #socialmediamonitoring #socialmediainvestigations #competitoranalysis #geopoliticalreports #geoint

Photo by Christina Morillo on Pexels.com