The executive as target: protective intelligence after Thompson
The executive as target: protective intelligence after Thompson
Targeted violence against corporate leaders doubled in 2025. Most attackers are strangers, most attacks are ambushes on predictable routines, and most warning signs appear online first.
By TiNYg Editorial · 6 November 2026
The killing of UnitedHealthcare chief executive Brian Thompson outside an investor conference in Manhattan in December 2024 changed boardroom attitudes to executive protection almost overnight. Two years on, the data shows it was not an isolated event but part of a curve.
What the numbers say
The Security Executive Council’s Executive Targeting Report, published in February 2026 with Mercyhurst University, analysed 424 open-source incidents worldwide from 2003 to October 2025. It found that 2025 incident volumes effectively doubled those of 2024. CEOs were the target in 64 per cent of cases, but attacks on other senior executives are growing, and incidents involving female executives have doubled since 2021. According to analyses of the dataset, about a third of incidents ended in death or injury, roughly three-quarters of attackers were strangers to their target, and residential and workplace targeting have both risen since 2020.
Allied Universal’s World Security Report, based on a survey of 2,352 chief security officers in 31 countries, found 42 per cent reporting a significant rise in threats of violence against executives, and three-quarters saying their company had been targeted by misinformation or disinformation.
Three threat streams, one target
1.Grievance-driven lone actors. The Thompson model: an individual with a grievance against an industry, a policy or a product, who researches routines and attacks at a predictable point. Healthcare, pharmaceuticals, technology, energy and finance are the most exposed sectors.
2.State-directed proxies. In March 2026 German authorities thwarted a Russian-ordered plot to kill the head of a German defence company, echoing the 2024 plot against Rheinmetall’s chief executive. State actors now hire criminals to do this work (see article 3).
3.Politically motivated violence. The assassination of Turning Point USA’s Charlie Kirk in September 2025 showed how quickly public commentary on contested issues can turn into physical risk. Executives who speak publicly on the Middle East, AI, energy or social policy carry more exposure than those who do not.
The professional view
Executive protection is no longer about close protection officers alone. It is primarily an intelligence problem: knowing what is being said about your principals online, how much of their life is discoverable (home address, children’s schools, travel patterns, car registrations), and whether any individual is moving from grievance towards action. Behavioural threat assessment, the same discipline that applies to workplace violence, is the core skill.
The weakest points are almost always the predictable ones: the walk from car to door, the regular gym, the published speaking engagement, the home.
What to do now
■Run a digital footprint audit on each principal and their family; remove what can be removed from data broker sites.
■Monitor for fixation and leakage online, with a clear escalation route into a threat assessment team.
■Vary routines and protect itineraries; treat published event schedules as reconnaissance aids.
■Extend residential assessments to all exposed executives, not only the CEO.
■Prepare a protocol for executives who comment publicly on contested issues, so security is consulted beforehand.
Sources
▪ Security Executive Council: Executive Targeting Report (Feb 2026)
▪ Leader’s Edge: Target CEO (Sept 2026)
▪ Interlira summary of SEC data
The Conversation is TiNYg’s members’ blog. Members and premium partners are invited to respond to, extend or challenge this article. Get in touch to contribute.
The Conversation
No. 1Martyn’s Law: the last six months before the clock starts
No. 2After Leipzig: the drone threat is no longer theoretical
No. 3Sabotage-for-hire: why your company is now on a hostile state’s target list
No. 4Younger, faster, less ideological: the new radicalisation curve
No. 5The chatbot in the attack cycle: what the evidence on AI and terrorism actually shows
No. 6From Heaton Park to HAYI: the state-terror hybrid
No. 7Cars and blades: why low-tech attacks remain the hardest to stop
No. 8The executive as target: protective intelligence after Thompson
No. 9Islamic State’s southern pipeline: why the Sahel is now Europe’s problem
No. 10The hoax as a weapon: this week’s aviation bomb threats
No. 11When the freezer is the target: cyber-physical convergence
No. 12The insider for hire: how criminals and states now buy their way in
