Executive Security in a Rising Threat Environment: The Value of Risk & Vulnerability Assessments

Hugh O’Rourke 
Allied Universal® Enhanced Protection Services, Vice President Consulting

Executive security programs are being asked to address a wider range of risks than ever before. Threats no longer emerge from a single source or follow predictable patterns. Instead, organizations must account for evolving public sentiment, online exposure, targeted activism, workplace violence, insider threats, and other factors that can increase an executive's risk profile.

The shooting of UnitedHealthcare CEO Brian Thompson in December 2024 underscored how quickly these risks can become operational realities and prompted many organizations to reexamine their executive protection strategies. Rather than reacting to individual events, security leaders should view them as reminders to regularly assess vulnerabilities and validate whether existing protective measures remain aligned with today's threat environment.

A comprehensive risk assessment provides the intelligence needed to make those decisions. The following five pillars help organizations identify vulnerabilities and strengthen executive protection programs before incidents occur.

1. Ambient and Specific Threat Assessments

The starting point of any executive security program is to establish the current threat environment through a thorough risk assessment. Organizations must assess both ambient threats and specific threats:

• Ambient Threats: Where is the organization’s headquarters? Where do executives live? What are their paths of travel, commute routines and points of exposure?
• Specific Threats: Are there any direct threats communicated through social media, emails or other channels? Once identified, security teams can investigate these threats, analyzing the severity and geographic implications to determine their acuteness via a formal risk assessment.
   

This foundational understanding provides the intelligence needed to shape protective measures, including physical security, communication protocols and daily routines as part of a broader security consulting effort.
 

2. Public Information Exposure Report (PIER)

A growing vulnerability for executives lies in the vast amount of personal information available online. A Public Information Exposure Report (PIER) helps organizations understand how much sensitive data about their executives is accessible to the public.

Many are shocked to learn how easily details like home addresses, family connections and even itineraries can be uncovered through a simple internet search. Armed with this knowledge, organizations can take proactive steps to reduce their executives’ online footprint, limiting exploitable information exposure as  part of ongoing security consulting and risk and vulnerability assessment practices.

3. Physical and Procedural Security Assessments

Robust physical and procedural security measures are another critical component and should be evaluated within a risk assessment. These measures should be reviewed for corporate facilities and executives’ private residences, which are often overlooked as key areas of vulnerability.

Physical security assessments should focus on intrusion detection systems, surveillance cameras and perimeter access controls. Additionally, procedural security reviews should consider secure transportation protocols, armed drivers, public appearances, and a robust screening and vetting process for anyone with direct access to the high-profile individual. 

Establishing and regularly testing these measures can significantly enhance security while reinforcing a strong deterrence posture that discourages hostile activity.

4. Mailroom Security Assessments

Often overlooked, an organization’s mailroom can be one of the most vulnerable access points for bad actors intent on harming executives. An unsecured mailroom creates opportunities for a multitude of threats ranging from threatening letters to suspicious packages carrying Chemical, Biological, Radiological, Explosive (CBRE) threats. Evaluations must consider mailroom security technology and processes, screener training, the physical mailroom location and response protocols for handling potential threats.

Addressing mailroom security is critical to creating a comprehensive executive security strategy, as the consequences of neglect in this area can extend far beyond inconvenience to serious safety and operational risks. Incorporating mailroom security into a broader security risk assessment reinforces organizational resilience.

5. Recommendations for Engaging Local and Federal Resources

Comprehensive risk assessments should include recommendations for engaging external law enforcement and intelligence resources, which are critical for supporting enhanced threat awareness. These may include the following entities:

• Local Law Enforcement: By establishing a liaison between executive protection personnel and law enforcement, organizations can gain important insight into current and potential threats which will assist with preparedness and response efforts. 
• State Fusion Centers: These information-sharing hubs were established after 9/11 to help local, state and federal law enforcement agencies collaborate on threats. For organizations, fusion centers provide valuable intelligence on a broad spectrum of evolving protest activity, industry-specific threats and other emerging risks.
• Information Security Advisory Committees: At the federal level, these industry-specific groups help businesses stay informed about specific threats targeting their unique industry sector.

Adapting to a Constantly Changing Threat Landscape

Risk and vulnerability assessment programs are most valuable when they provide organizations with a clear understanding of where exposure exists and how security investments can be prioritized. A structured security consulting approach helps validate existing protective measures, identify hidden vulnerabilities that may otherwise go unnoticed, and develop practical recommendations tailored to an organization's people, facilities, operations, and leadership. As risks continue to evolve, regular security assessment work enables programs to adapt with greater confidence and support more informed security decisions over time.

Learn More About Risk and Vulnerability Consulting

About the Expert

Hugh O’Rourke serves as Vice President of Security Consulting for Allied Universal® Enhanced Protection Services. He advises clients on security consulting matters shaped by public-sector leadership, legal training, infrastructure risk, and complex planning environments.

Hugh brings more than 22 years of experience with the New York City Police Department, where he served as a Deputy Inspector and worked in the Office of the Chief of Patrol. He also served as Executive Officer for the department’s first Counterterrorism Division. In that role, he was a liaison between the NYPD and the federal government on intelligence and critical infrastructure matters. His background includes intelligence analysis, information sharing, training, private-sector outreach, and specialized infrastructure initiatives. Hugh also served as a Colonel with the United States Air Force Office of Special Investigations, Retired Reserves.

Additionally, Hugh is a practicing attorney admitted to the bar in New York and Connecticut. He holds a Bachelor’s Degree in Engineering (Electrical) from Manhattan College, a Master’s Degree in Public Administration from Marist College, and a Juris Doctor from the Fordham University School of Law.