Security Intelligence

Executive Security During Public Controversy | CloseProtectionHire

Q: "How does public controversy change an executive's threat level?"

"Public controversy increases threat level through two mechanisms: it increases the number of individuals who are motivated to approach, harm, or exploit the executive, and it provides those individuals with detailed intelligence about the executive's identity, organisation, role, and in many cases their public schedule. A CEO whose name and photograph appear in national media coverage of a corporate scandal is immediately identifiable to anyone with a grievance related to that scandal. Their professional social media profile, their LinkedIn page, and the company website may confirm their office location and public speaking schedule. The combination of new motivation and easily available targeting intelligence creates a threat elevation that is not proportionate to the apparent severity of the controversy -- a product recall, a regulatory investigation, or a contentious redundancy programme can generate as much targeted hostility as a major criminal matter."

Q: "What is a fixated individual and how does public controversy create them?"

"A fixated individual is a person who develops an intense, perseverative focus on a particular individual or organisation, which may progress to approach, contact, or attack. The Fixated Threat Assessment Centre (FTAC), the UK's joint police-psychiatry unit, was established in 2006 specifically to assess and manage the risk from fixated individuals targeting public figures. Public controversy creates fixated individuals by providing a named, identifiable target for grievances that may have been diffuse or unresolved. An individual who lost their job in a redundancy programme managed by a specific executive, or who holds a technology company responsible for a personal harm, may develop a fixated focus on that executive when media coverage provides the focal point. FTAC research identifies that fixated individuals often begin with legitimate grievance communications before escalating."

Q: "Should the executive reduce public appearances during a controversy?"

"Schedule management during a controversy should be intelligence-driven rather than reflexively defensive. Withdrawing completely from public appearances may be counterproductive -- it increases media attention, removes legitimate visibility that can be managed securely, and may be professionally untenable. The security response is to elevate the security posture for the appearances that do occur: advance work for venues that did not previously require it, enhanced access control, route variation, counter-surveillance on travel, and potentially a vetted close protection team for the duration of the elevated threat period. Appearances that do not serve a necessary professional purpose should be reviewed for postponement. Appearances with predictable public assembly (shareholder meetings, annual conferences) require specific advance planning during a controversy."

Q: "How is social media monitoring used as a threat assessment tool during controversy?"

"Protective intelligence monitoring of social media during a controversy provides early warning of individuals who are moving from general negative sentiment toward targeted behaviour. The indicators that distinguish fixation from general criticism are: direct name-addressed content rather than general company criticism, reference to the executive's personal details (home location, vehicle, family members), expressions of intent rather than opinion, and posting patterns that suggest a single individual is investing sustained attention in the executive specifically. Specialist threat assessment services (Control Risks, Kroll, Secureworks Digital Risk Protection) provide monitored keyword alerts and human assessment of flagged content. This monitoring should begin at the point of controversy becoming public, not after an incident has occurred."

Q: "What are the residential security implications when an executive becomes publicly controversial?"

"Residential security should be reviewed at the start of any significant controversy. The specific adjustments depend on the threat assessment but commonly include: reviewing whether the residential address is publicly accessible (electoral register, Companies House, social media), increasing CCTV monitoring and alerting sensitivity, briefing domestic staff and family members on the change in threat level and the additional protocols that apply, reviewing the visitor and delivery access control, and in elevated cases, increasing the residential security patrol frequency or adding a temporary static guard. The residence is the executive's most predictable and fixed location, and during a controversy period it may attract approaches that the working environment's access controls would prevent."

When an executive becomes the focus of public controversy, their threat profile changes materially. A security consultant's guide to adjusting the security posture during corporate scandals, activist campaigns, and media crises.

1 May 2026

Written by James Whitfield, Senior Security Consultant

Speak to the Team

When an executive’s name appears in connection with a corporate scandal, a contentious business decision, a product failure, or a high-profile regulatory matter, something specific happens to their threat profile. They become identifiable, they become a focus for grievances, and their professional details – already largely public – become actively used intelligence for individuals who want to approach, confront, or harm them.

This is not speculation. The Fixated Threat Assessment Centre (FTAC) was established in 2006 specifically to manage the risk to public figures from individuals who develop a focused, perseverative hostility following a triggering event. Corporate controversy is among the documented triggering events. A CEO whose name and face appear in national media as the individual responsible for a widely criticised decision becomes, for some readers, a named target for grievances that previously had no specific focal point.

This guide covers the security response to public controversy: the threat assessment framework, the specific adjustments to the security posture, and the protective intelligence tools that provide early warning.

How controversy changes the threat picture

Before a controversy becomes public, an executive’s threat profile reflects their general position: seniority, sector exposure, public profile, travel destinations, and the organisation’s own threat environment. This is a manageable, relatively stable picture.

When a controversy breaks:

The audience of motivated individuals expands. A product recall that has harmed consumers creates potential grievants across an entire customer base. A redundancy programme creates actual grievants – individuals who lost income, security, and status as a direct result of decisions the named executive made. A regulatory investigation creates scrutiny from a different direction – journalists, short-sellers, regulators, and the public – some of whom may act in ways that create safety risk.

The targeting intelligence is freely available. The same media coverage that names the executive typically includes their job title, a photograph, the company’s office address, and links to their LinkedIn profile. LinkedIn may confirm their office location, their conference speaking schedule for the year, and their professional network. This is enough targeting intelligence to locate, survey, and approach an executive without any specialist intelligence capability.

Fixation risk increases. FTAC research identifies that individuals who make threatening contact with public figures typically begin with expressions of grievance before escalating. The controversy period is the window during which new fixated individuals form, and the early warning indicators are present before any overt threat is made.

The immediate threat assessment

When a controversy becomes public, the security team or security manager should conduct an immediate threat assessment that addresses:

The grievant population. Who has been materially harmed by the decision or event that created the controversy? Former employees, customers, investors, regulators? The more identifiable and the more direct the harm, the higher the initial threat level.

The executive’s digital footprint. Is the residential address suppressed from the electoral register and Companies House? Is it discoverable through a basic open-source search? (If it is, this is an immediate remediation task – see the executive digital footprint management guide.)

The public schedule. What appearances are already committed? Are any of these in environments with known predictable hostile assembly (shareholder meetings, public forums, protest-adjacent locations)?

The existing security posture. What security measures are currently in place? What additional capability can be activated quickly – a vetted CPO for the elevated period, a close protection vehicle, protective intelligence monitoring?

This assessment should produce a written threat level designation and a set of adjustments to the security posture for the duration of the elevated threat period.

Protective intelligence monitoring

The most practical early-warning tool during a controversy is open-source and social media monitoring for indicators of targeted hostility. The distinction the monitoring is looking for:

General negative sentiment – comments about the company, the decision, or the executive in general terms. This is background noise.

Targeted language – direct address to or about the executive by name, reference to personal details (where they live, their family, their vehicle), expressions of intent rather than opinion.

Fixation indicators – a single account posting sustained, escalating content about the executive specifically over a period of days or weeks, cross-platform activity referencing the executive, and any content that moves from grievance expression to described action.

Control Risks, Kroll, Secureworks Digital Risk Protection, and specialist protective intelligence providers offer monitored keyword alert services with human assessment of flagged content. The monitoring brief should include the executive’s name, close variants (initials, known nicknames), the organisation’s name, and the specific controversy topic.

Monitoring should activate at the start of the controversy. By the time an incident has occurred, the monitoring function has failed in its purpose.

Schedule management during controversy

The objective of schedule management during a controversy is not to eliminate the executive’s public presence – in most cases that would be professionally untenable and might escalate media interest. The objective is to ensure that appearances that do occur are secured at an appropriate level.

For each committed public appearance during the controversy period, a brief advance assessment should determine: the access control arrangements at the venue, the route options, whether a CP presence is appropriate, and whether the appearance can be managed at a modified location (an alternative room, a different entry route) that reduces predictability.

Appearances that create the highest risk:

Predictable annual events (AGMs, annual conferences, industry awards) where the executive’s presence is expected and their arrival time is known
Events in outdoor or open-access environments where access control is limited
Events near protest assembly points related to the controversy
Appearances where the audience includes individuals with direct grievances (employee meetings during redundancy programmes, public consultations during a controversial project)

For these appearances, a vetted CP officer – operating covertly where appropriate – attending the advance and the event is a proportionate response, not an excessive one.

Digital footprint review

The executive’s digital footprint review should be confirmed as current at the start of the controversy, not planned as a future action. Specifically:

Is the residential address removed from the commercially sold electoral register (edited register opt-out under the Representation of the People Act 2000 Section 9A)?

Is the director’s residential address suppressed at Companies House under Section 1088 of the Companies Act 2006?

Are social media privacy settings set to the appropriate level, particularly for any platforms that tag location or display home-area details?

If any of these are not in place, they should be addressed before the controversy has run long enough to have been researched by a motivated individual.

Residential security during controversy

The executive’s home is their most predictable and fixed location. During a controversy period, the residential security posture should be reviewed against the updated threat level. Common adjustments:

CCTV monitoring and alert sensitivity reviewed and confirmed as functioning. Any gaps in coverage (blind spots, cameras with reduced quality) addressed.

Domestic staff and family briefed on the elevated threat period – specifically what to report and who to call if they observe surveillance activity or receive unusual contacts.

Visitor and delivery access control confirmed – no unannounced access to the residence by unfamiliar parties.

If the threat assessment warrants it: temporary increase in security patrol frequency, or a short-term static guard at the property.

For the residential security infrastructure that underpins this review, see our residential security for executives guide. For the protective intelligence methodology that provides ongoing threat assessment, see our protective intelligence guide. For the corporate crisis management framework that the security response sits alongside, see our corporate crisis management guide. For the specific personal security response when the controversy is driven by an activist or protest campaign – how groups identify executives through Companies House, the escalation pattern from organisational to individual targeting, legal tools under the Protection from Harassment Act 1997 and National Highways v Persons Unknown [2021] EWHC 3081, and the residential protest response – see our guide to activist targeting of corporate executives.

Sources

FTAC: Fixated Threat Assessment Centre Annual Report 2023, Metropolitan Police/NHS England. Control Risks: Threat Assessment During Corporate Controversy 2024. Kroll: Protective Intelligence and Executive Security During Reputational Events 2024. ASIS International: Protection of Assets – Threat Assessment and Management Chapter, 2024. NPSA: Protecting Executives and Public Figures, National Protective Security Authority, 2024. NCSC: Online Safety and Digital Footprint Management, 2024.

Summary

Key takeaways

The threat elevation from public controversy is real and measurable

The Fixated Threat Assessment Centre and Control Risks threat database both document the relationship between public controversy and targeted threat against named executives. This is not a theoretical risk -- it is a documented, recurrent pattern. A security programme that responds to controversy by noting it and continuing the same posture has not conducted a threat assessment: it has ignored new threat data.

Protective intelligence monitoring should activate before an incident, not after

Social media and open-source monitoring for early warning indicators of fixation is most valuable in the window between a controversy becoming public and any actual approach or incident. By the time an incident has occurred, monitoring is forensic rather than protective. Activating a protective intelligence monitoring service at the start of a controversy is a proportionate, early response that costs far less than managing an actual incident.

Digital footprint review is an immediate priority during controversy

When public controversy names a specific executive, their digital footprint -- which was an accepted background risk before the controversy -- becomes an active targeting intelligence resource. The electoral register opt-out, Companies House address suppression, and social media privacy review that should already be in place need to be confirmed as current when a controversy begins, not retrospectively reviewed after a threatening contact has demonstrated they found the information.

The security response to controversy should be proportionate, not paralysing

Excessive security measures during a controversy can be as damaging as insufficient ones. An executive who is visibly surrounded by security personnel at every public appearance during a regulatory investigation creates a narrative and an image that may be counterproductive. Covert security elevation -- unmarked vehicles, plainclothes CPOs, discreet advance work -- achieves the protective objective without amplifying the visual story. The security team should be briefed on the reputational sensitivity as well as the operational requirements.

Family security must be elevated in parallel with the executive's security

Individuals who become fixated on an executive during a controversy may also approach family members -- either to obtain information about the executive or to cause harm as leverage or expression of grievance. Family members should be briefed on the change in threat level, the specific protocols that apply during the elevated period, and the indicators to watch for (unfamiliar callers asking about the executive, unusual approaches near the home or school). The family briefing should happen at the start of the controversy, not after a family member has been approached.

FAQ

Frequently Asked Questions

Public controversy increases threat level through two mechanisms: it increases the number of individuals who are motivated to approach, harm, or exploit the executive, and it provides those individuals with detailed intelligence about the executive’s identity, organisation, role, and in many cases their public schedule. A CEO whose name and photograph appear in national media coverage of a corporate scandal is immediately identifiable to anyone with a grievance related to that scandal. Their professional social media profile, their LinkedIn page, and the company website may confirm their office location and public speaking schedule. The combination of new motivation and easily available targeting intelligence creates a threat elevation that is not proportionate to the apparent severity of the controversy – a product recall, a regulatory investigation, or a contentious redundancy programme can generate as much targeted hostility as a major criminal matter.

A fixated individual is a person who develops an intense, perseverative focus on a particular individual or organisation, which may progress to approach, contact, or attack. The Fixated Threat Assessment Centre (FTAC), the UK’s joint police-psychiatry unit, was established in 2006 specifically to assess and manage the risk from fixated individuals targeting public figures. Public controversy creates fixated individuals by providing a named, identifiable target for grievances that may have been diffuse or unresolved. An individual who lost their job in a redundancy programme managed by a specific executive, or who holds a technology company responsible for a personal harm, may develop a fixated focus on that executive when media coverage provides the focal point. FTAC research identifies that fixated individuals often begin with legitimate grievance communications before escalating.

Schedule management during a controversy should be intelligence-driven rather than reflexively defensive. Withdrawing completely from public appearances may be counterproductive – it increases media attention, removes legitimate visibility that can be managed securely, and may be professionally untenable. The security response is to elevate the security posture for the appearances that do occur: advance work for venues that did not previously require it, enhanced access control, route variation, counter-surveillance on travel, and potentially a vetted close protection team for the duration of the elevated threat period. Appearances that do not serve a necessary professional purpose should be reviewed for postponement. Appearances with predictable public assembly (shareholder meetings, annual conferences) require specific advance planning during a controversy.

Protective intelligence monitoring of social media during a controversy provides early warning of individuals who are moving from general negative sentiment toward targeted behaviour. The indicators that distinguish fixation from general criticism are: direct name-addressed content rather than general company criticism, reference to the executive’s personal details (home location, vehicle, family members), expressions of intent rather than opinion, and posting patterns that suggest a single individual is investing sustained attention in the executive specifically. Specialist threat assessment services (Control Risks, Kroll, Secureworks Digital Risk Protection) provide monitored keyword alerts and human assessment of flagged content. This monitoring should begin at the point of controversy becoming public, not after an incident has occurred.

Residential security should be reviewed at the start of any significant controversy. The specific adjustments depend on the threat assessment but commonly include: reviewing whether the residential address is publicly accessible (electoral register, Companies House, social media), increasing CCTV monitoring and alerting sensitivity, briefing domestic staff and family members on the change in threat level and the additional protocols that apply, reviewing the visitor and delivery access control, and in elevated cases, increasing the residential security patrol frequency or adding a temporary static guard. The residence is the executive’s most predictable and fixed location, and during a controversy period it may attract approaches that the working environment’s access controls would prevent.

Get in Touch

Request a Consultation

Describe your security requirements below. All enquiries are confidential and handled by licensed consultants.