Silicon Valley details are spending on analysts before they spend on bodies

SAN FRANCISCO

SAN FRANCISCO — Close protection practices serving the technology corridor are shifting their spend toward analysts and open-source intelligence work, moving the physical detail from the primary instrument of protection to the final layer of it.

The change is not philosophical. It follows the observation that the useful warning arrives days before the principal leaves the house, and that a physical team with no information can only react to what it sees from the kerb.

What information-led protection means in practice

The model is a cycle, and it runs whether or not a trip is scheduled.

Baseline first: a mapped picture of the principal's published existence, including residential addresses held by data brokers, vehicle records, family names, school and club affiliations, and the professional profiles that connect them. That picture is the adversary's starting point, so it is the defender's too.

Then monitoring. Automated alerts on the principal's name and address across the platforms where exposure appears, review of the accounts and forums where an itinerary is likely to be discussed, and a standing watch on the people around the principal, because the assistant is a more useful target than the chief executive.

Then attribution. When a pattern appears, the question is who is behind it and what they want. A stalker with a fixation requires a different response from a professional reconnaissance, and the physical posture for each is different. Distinguishing them is analytical work, and it is the step most often skipped by teams that arrive at a scene and start looking outward.

Then intervention. Requests to data brokers and platforms for removal, correction of published records, changes to the principal's routine, and, where the pattern justifies it, a law enforcement referral with the evidence needed to be taken seriously: dates, times, vehicles, accounts and screenshots.

Where the detail still decides everything

The elevation of the information function has produced a fashionable claim that physical presence matters less. That claim fails at the moment of contact.

The analyst can tell the officer that a vehicle has followed the principal twice this month. Only the officer can put a car between the principal and that vehicle at a junction. The analyst can identify a hostile account. Only the detail can decide that the entrance being used tonight is the one with a choke point and two exits.

The correct relationship is a loop: the analysis shapes the route, the officer reports what they observe, and the observation returns to the analyst as a new input. A programme where the two functions do not speak is spending twice for half the value.

The staffing question nobody wants to price

An information function requires a person, not a subscription. Threat monitoring software produces alerts, and alerts need a human to read them at the speed of a decision.

For smaller programmes, the honest options are a part-time analyst with a defined remit, a retainer arrangement with a firm that provides the function, or a named officer trained and given time to do it. What does not work is assigning the work to the detail leader between movements, because the work is the first thing dropped when the principal is running late, and it is the work that prevents the reason they are running late.

What to ask a provider

Ask who reads the alerts overnight. Ask what happens between the alert and the principal's first movement of the day. Ask for an example of a pattern that was detected before it became an incident, with the dates. A provider that can answer all three is running an information function. A provider that answers the first two with a platform name is selling one.

USPA Nationwide Security combines corporate risk intelligence with executive protection and estate security, so the analysis and the physical layer are one operation rather than two vendors.

Related coverage

• The hybrid threat: attackers merge digital reconnaissance with physical ambush
• The most dangerous address in the program is the one they sleep at
• The general counsel is now a protectee

An information-led protective programme: (800) 214-1448 or request corporate risk intelligence.