The techniques aren’t new. What’s changing is the time, cost, and skill it takes to move from intent to action.

For a long time, time worked in our favor. If your job is protecting people, that’s not a small thing.

An adversary had work to do. They had to identify a target, research it, find useful information, understand relationships, build a convincing pretext, and figure out how to reach the target or an audience. If the intent was more serious, that meant surveillance, planning, access, and capability on top of it.

None of that made an attack impossible. But it created friction. And friction takes time. Time is what lets us notice something and step in before it matters.

AI is taking that friction away.

The Economics Changed

The biggest effect of AI on the threat picture probably isn’t a wave of brand-new threats. Most of what we’re seeing is familiar behavior done faster, cheaper, and at greater scale. It isn’t changing the shape of the attack cycle so much as the speed of it.

Take influence operations.

Meta recently detailed an Iran-based network aimed at U.S. audiences. It ran fictitious personas, including a political scientist, a women’s rights activist, and other credible-looking voices, some using AI-generated profile photos. A second layer of accounts existed mainly to amplify the ones with developed backstories.

The goal was old: build believable identities and manufacture the appearance of real, organic support. None of this is new. Propaganda, fake identities, and social engineering all predate generative AI.

What changed is the cost. One operator with off-the-shelf tools can now do what used to take a team with different skills: build the personas, write the backstories, translate and localize the content, generate the images, and keep all of it active.

Worth noting: Meta said the network got little real engagement before it was taken down. That’s the reminder not to confuse capability with effectiveness. AI makes an operation easier to build. It doesn’t make anyone believe it.

Still, the shift matters. The cost of trying is lower now.

For protective intelligence teams, that means the question isn’t always whether a photo or persona was made by AI. The more useful questions are whether the activity is coordinated, who it’s aimed at, whether it’s gaining traction, and whether it could produce real-world consequences.

From Information to Intelligence

The same dynamic applies to reconnaissance.

There’s always been information out there about executives, public officials, and their families. Property records, corporate bios, social posts, photos, travel, affiliations, family connections. Piece by piece, most of a person’s life is findable online.

For a long time, the protection was that it stayed scattered. The information might be public, but someone still had to find it, confirm it was accurate, connect it to the rest, and decide what was actually useful. Publicly available information and useful targeting intelligence aren’t the same thing. AI is shortening the distance between them.

Microsoft Threat Intelligence reported this year that threat actors are already using AI across the attack lifecycle: persona development, social engineering, malware development, and sorting through compromised environments, among other tasks. Its assessment was blunt. AI reduces technical friction and speeds up execution.

Google Threat Intelligence Group reached a similar conclusion, describing adversaries folding AI into reconnaissance, social engineering, vulnerability exploitation, and malware development. In May, Google reported what it believes was the first observed case of a threat actor using a zero-day exploit developed with AI assistance, a Python script built to bypass two-factor authentication, caught before it could be used at scale.

These developments are usually discussed as cybersecurity problems.

I think that view is too narrow.

What matters more is what happens when that same acceleration hits several parts of a threat pathway at once.

The Attack Cycle gets Faster

In “The Protector’s Edge”, my co-authors and I describe a Hybrid Threat Targeting Cycle:

Reconnaissance → Exposure → Amplification → Physical Action → Converged Crisis

The idea came from something simple. Real threats don’t stay inside the neat categories we build to manage them. Digital exposure feeds physical reconnaissance. A grievance finds an audience online, and that audience amplifies it. Personal data makes someone easier to locate. A reputational problem becomes a protective one. A cyber event ends in physical consequences.

The domains converge.

And AI doesn’t just help an adversary work inside each domain. It reduces the friction between them. Research goes faster. Scattered information is easier to aggregate. Personas, tailored messages, translated content, and troubleshooting the technical pieces all get easier too.

Access to an AI model doesn’t turn someone into an intelligence service. Skill, judgment, intent, and resources still matter. But the whole field moves up a step. Someone inexperienced can do more than before. Someone capable can move faster, and at a scale that used to require real resources. For us, that means the clock can start earlier than we’d expect.

Time is Part of a Protector’s Edge

Protective intelligence is an anticipatory discipline. Its value isn’t only in responding well once a threat shows up. It’s in recognizing the indicators early enough to give leaders options.

Those options are concrete: change a movement, reduce an exposure, look harder at a developing fixation, adjust an itinerary, bring in law enforcement, brief the executive. Sometimes the most valuable outcome is buying enough time to make a better decision.

That’s what makes the compression of the attack cycle a real problem. If AI lets an adversary do in hours what used to take days, we lose some of that decision space.

The answer can’t just be more collection. Most organizations already hold more information than they can use. The work has to move farther left. That means understanding exposure before a specific threat is even on the radar. It means reading trajectories instead of logging each indicator as its own incident, and connecting digital, physical, reputational, and behavioral signals while there’s still time to act on them. It also means treating speed itself as part of the threat.

The protector’s edge has always been anticipation, and anticipation needs time. That’s what AI is quietly taking away. It hasn’t rewritten how people form intent, choose targets, or cause harm. It’s stripping the friction out of the process.

So the question I’d push teams toward isn’t how to respond faster. It’s how to see it sooner.

Sources

Meta, Adversarial Threat Report, First Half 2026 (March 11, 2026) — https://transparency.meta.com/sr/first-half-2026-Adversarial-threat-report/

Microsoft Threat Intelligence, AI as tradecraft: How threat actors operationalize AI (March 6, 2026) — https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/

Google Threat Intelligence Group, Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access (May 2026) — https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access

Randolph, Wackrow, and Burton, The Protector’s Edge: Leadership through Strategy and Action (Routledge/Taylor & Francis, 2026) — https://www.theprotectorsedge.com

This is Part 4 of the “Targeted” series. Part 1 showed how digital exposure initiates the kill chain. Part 2 explored how perception makes people into symbols. Part 3 examined belief as a trigger. Now we consider the corporate angle…when an institution gains a face that becomes a target.

Threats against corporate executives are rising, not because of who they are… but because of what they represent.

On December 4, 2024, Brian Thompson walked down a Manhattan sidewalk. He was not a politician, military leader, or celebrity… he was the CEO of one of the largest health insurance companies in the United States.¹

In the days that followed, much of the discussion focused on the attack itself - the motives, the suspect, the investigation.

Eighteen months later, what still strikes me is something else: the reaction.

For many, Thompson was seen less as an individual and more as the institution’s embodiment. Talks about healthcare costs, claims denials, corporate power, and public frustration quickly merged with commentary on the attack. In some online spaces, sympathy for the victim shifted to criticism of the system he represented.

The distinction matters.

What continues to make this incident noteworthy is not simply the act itself, but the pattern it reflects. This pattern shows that leaders increasingly serve as direct proxies for institutions and as focal points for societal frustration. The key takeaway: executive threats stem more from symbolism than from personal actions.

Institutions Need a Face

Throughout history, violence has often been directed at symbols.

Archduke Franz Ferdinand’s 1914 assassination was not about him as a person. He stood for an empire. His death mattered because of its significance. The same holds for kings, governors, generals, and political leaders throughout history. The person merges with the institution.

Modern organizations often assume they are different.

They are not.

Most people cannot direct their frustrations at a bureaucracy. They cannot confront an algorithm. They cannot argue with a multinational corporation. They cannot hold a conversation with a system.

When trust erodes, the people at the top become focal points for frustration.

People rarely confront institutions directly. Instead, they address their frustrations to those who represent them.

The Era of Resentment

This is one reason I have written previously about what I call the Era of Resentment.

Trust in institutions has declined across society. Confidence in government, media, corporations, and other traditional authorities has dropped. Meanwhile, social media has made it easy to identify, discuss, criticize, and mobilize against individuals.

These trends reinforce one another.

A grievance once private can now reach millions. Frustration once aimed at faceless organizations can now be directed at a person. Narratives spread quickly. Communities form around shared anger…and targets appear.

Most of the time, this takes the form of criticism, ridicule, or online harassment. But sometimes it escalates.

The path from grievance to violence is neither simple nor inevitable. Most people who express anger online never engage in criminal behavior. Most critics never become attackers.

But violence rarely appears without context.

It is often preceded by a process:

• Identification

• Personalization

• Dehumanization

• Justification

• Action

This is the same doctrine we traced in earlier installments of this series. Luigi Mangione didn’t choose Brian Thompson at random. Vance Boelter didn’t choose Melissa Hortman at random. Both moved through identification, symbolism, and belief before they ever moved through physical space.⁴

How Digital Exposure Creates Executive Vulnerability

Leaders have also become more visible than ever.

Corporate executives have public profiles. Their biographies, interviews, photos, and job histories are easy to find. Public records, data brokers, and social media make finding information about them—and their families—easier than ever.

Visibility is often celebrated as a leadership virtue. And in many cases, it is.

Leaders should be accessible. They should communicate. They should engage with employees, customers, and stakeholders.

Yet visibility carries consequences.

The same systems that allow organizations to build trust also create opportunities for targeting.

The challenge is not simply physical security. It is symbolic exposure.

When a leader becomes synonymous with an institution, criticism of the institution becomes criticism of the individual. In extreme cases, hostility toward the institution can turn into hostility toward the person.

What Executive Protection Is Really Protecting

This raises an uncomfortable question: When organizations invest in executive protection, what are they actually protecting?

The obvious answer is the individual. But the issue is larger than that.

Organizations protect leadership continuity, decision-making, and a leader’s ability to engage publicly without fear.

In some respects, they are protecting the connection between institutions and the people who lead them. And that connection matters.

A society in which leaders withdraw from public life because the risks become too great is not a healthier society. Neither is one in which violence becomes an accepted response to disagreement.

The concern is not that executives require security.

The concern is why they increasingly require it.

The New Attack Surface

Security professionals often talk about attack surfaces — networks, facilities, devices, and access points. Those risks remain important.

But another attack surface has emerged, and it is symbolic.

The mix of institutional distrust, public resentment, digital exposure, and personal visibility has changed perceptions of leaders.

For many people, the executive is no longer simply an executive.

The executive is the institution.

That shift helps explain why threats against leaders are increasing across business, government, academia, and public life.⁶

The trend is not really about security. It is about representation.

When institutions acquire a face, that face can become a target.

And that may be one of the defining protection challenges of our time.

What This Means for Security and Risk Leaders

If you lead a protective intelligence, executive protection, or corporate security program, the symbolic attack surface demands you ask different questions:

• Where is your principal being reframed online? From executive to villain, traitor, or proxy?

• What narratives is your organization carrying, and who in leadership has become synonymous with them?

• Are you monitoring symbolic exposure with the same rigor as physical and digital exposure?

The Thompson case isn’t an outlier. It continues to be a marker, the moment the corporate executive entered the same threat doctrine that political figures, judges, and public officials have been navigating for years.

Footnotes & Sources

1. “Police search for gunman after UnitedHealthcare CEO Brian Thompson fatally shot in NYC,” The Washington Post, December 4, 2024. https://www.washingtonpost.com/business/2024/12/04/unitedhealthcare-ceo-brian-thompson-fatally-shot-new-york/

2. “How the internet cheered the UnitedHealth shooting suspect as a folk hero,” Axios, December 10, 2024. https://www.axios.com/2024/12/10/luigi-mangione-unitedhealth-ceo-internet

3. Edelman, “2025 Edelman Trust Barometer: Reversing the Descent into Grievance,” January 2025. https://www.edelman.com/trust/2025/Trust-Barometer/reversing-descent-grievance

4. Earlier installments in this series — The New Kill Chain Starts with a Click, The Kill List Is the New Doctrine, The Kill Switch Is Belief — at https://substack.com/@rogue16

5. Electronic Privacy Information Center (EPIC), Data Broker Harms to Public Officials, 2025. https://epic.org/documents/data-broker-harms-to-public-officials/

6. “Fear sweeps the C-suite — companies pour millions into security as threats against executives surge,” Fortune, October 21, 2025. https://fortune.com/2025/10/21/ceo-security-costs-surge

Geopolitical instability lived “over there.”
Corporate risk lived in the boardroom.
Personal safety lived at home.

Those layers no longer hold.

What we are seeing now is not simply an increase in incidents. It is a compression of distance. The gap between global tension and personal consequence is narrowing in ways that are difficult to see in real time but impossible to ignore in hindsight.

The question is no longer whether an event matters to you.
It’s how quickly it does.

The Illusion of Separation

Consider the environment we are operating in.

Ongoing conflict in Ukraine continues to reshape alliances, economies, and information flows. Tensions tied to Iran and its network of proxies introduce persistent uncertainty into global markets and regional stability.

For most people, these are headlines. Strategic concerns. Something to be aware of, but not something that materially affects daily life.

That assumption is becoming less reliable.

Because those same dynamics now express themselves locally and personally:

• Protests in cities far removed from the point of origin

• Cyber disruptions that impact businesses and individuals alike

• Identity-driven harassment tied to geopolitical narratives

What once often took months to translate now unfolds in days. Sometimes hours.

From Issue to Identity

At the same time, the way we experience major issues has changed.

Leaders are no longer just decision-makers. They are symbols—proxies for larger debates and focal points for alignment and opposition.

The public discourse surrounding figures like Sam Altman is instructive here. Not because it represents a direct physical threat, but because it shows how quickly complex institutional issues become personalized—and how individuals become the focal point of broader narratives.

• A policy decision becomes a personality debate

• A technology question becomes a moral dividing line

• An organization becomes an individual

And when that happens, the circle widens.

Employees are drawn into the narrative because of where they work.
Families become adjacent to the conversation whether they choose to be or not.
Individuals find themselves treated as stand-ins for something much larger than themselves.

People are no longer just observing the issue.

They are part of it.

Exposure Without Friction

Layer on top of that a simple reality: many people are far more discoverable than they realize.

The combination of public records, commercial data aggregation, and social media has created an environment where basic information about individuals is accessible with minimal effort.

Not just for executives. For anyone.

• Where you live

• Where you’ve worked

• Who you’re connected to

• What you’ve said, and how it might be interpreted

There was a time when accessing that level of context required time, resources, and intent. Now it requires curiosity.

This is not inherently malicious. But it lowers the barrier for those who are.

And when narrative, grievance, or emotion enters the equation, accessibility becomes a multiplier.

Events Don’t End Anymore

When a high-profile incident occurs, we tend to think of it as a moment. Something happens. It is reported. It is analyzed. It fades.

That is no longer how the cycle works.

Events now feed forward.

They generate immediate reaction, which drives narrative formation. That narrative is amplified, contested, and personalized. It reinforces existing beliefs, creates new ones, and in some cases, inspires action.

The event is not the end of the cycle.

It is an input into the next one.

The Pressure Cooker

If you step back, a pattern begins to emerge.

There are multiple sources of pressure:

• Geopolitical instability

• Economic uncertainty

• Rapid technological change

Those pressures are contained within an environment defined by:

• Constant connectivity

• Real-time information flow

• Algorithmic amplification

Not every pressure cycle results in release. Most dissipate.

But when the system does look for release, it does so through:

• Online harassment

• Reputational targeting

• Doxxing

• And, at times, physical confrontation

This is not a claim that every issue becomes personal, or that every narrative leads to action. But the conditions that allow it are more present, more persistent, and more widely distributed than they have been before.

This Isn’t Entirely New—But It Is Different

It’s important to be clear about what this is and what it isn’t.

Targeting of public figures is not new.
Political violence is not new.
Grievance-driven behavior is not new.

What is different is the convergence and compression of the conditions that enable them:

• Persistent exposure

• Rapid narrative formation

• Ease of access

Individually, these are manageable.

Together, they create an environment where the path from cause to consequence is shorter, less predictable, and harder to interrupt.

What This Means for Leadership

For those responsible for people, organizations, or public-facing roles, this shift matters.

Protective thinking has traditionally focused on identifying threats at the edge—looking outward and assessing what might come next.

That still matters.

But it is no longer sufficient.

Because the edge is not static. It moves. And it moves quickly.

It can form in a comment thread.
In a news cycle.
In a narrative that gains traction faster than it can be contextualized.

And when it does, it doesn’t stay external for long.

A Final Thought

The concern is not simply that threats are increasing. It is that the distance between cause and consequence is disappearing—between what happens in the world and what shows up in your life, between a headline and a decision, between a narrative and an action.

We are no longer operating in a world where risk travels slowly toward us; we are operating in one where it increasingly surrounds us, whether we choose to engage with it or not.

Deepfakes are no longer a novelty.
They are an operational tool.

What began as a fringe capability (impressive, but mostly confined to research labs and internet curiosities) has now crossed a threshold. AI-generated voice and video are being used in real-world operations to impersonate executives, authorize financial transfers, and manipulate decision-making inside organizations.

This is not a future problem. It is happening now.

And it signals something more important than a new type of fraud. It marks a shift in how adversaries create access

.

The Target Is No Longer the System

For decades, security programs have focused on protecting systems—networks, devices, credentials, and infrastructure. Even social engineering, while always a human problem, typically depended on relatively crude deception.

That model is changing.

Deepfakes allow adversaries to bypass traditional security controls by exploiting something far more foundational: trust itself.

In one widely reported case involving Arup, a finance employee participated in a video call with what appeared to be senior executives. In reality, every participant was an AI-generated deepfake. The employee was convinced and executed a series of transactions totaling more than $25 million.

This was not a failure of technology. It was a failure of verification in the presence of a believable authority.

In other cases, attackers have combined AI-generated voice cloning with messaging platforms to simulate urgent executive direction—creating a coordinated, multi-channel deception that pressures employees to act before verification can occur.

These are not technical exploits in the traditional sense. No firewall was breached. No malware was deployed. The attack surface was human perception itself.

We Are Entering the Era of Synthetic Authority

The significance of deepfakes is not just that they are convincing; it’s that they manufacture authority.

Historically, organizations relied on a set of implicit signals to validate identity:

• A familiar voice

• A known face

• A recognized communication channel

• Contextual urgency that “felt right”

Deepfakes collapse all of these at once.

An adversary no longer needs to steal credentials or compromise an account. They can generate a version of a trusted individual—complete with tone, cadence, and presence—and insert that identity directly into a decision-making process. In other words, they don’t break trust. They convincingly simulate it.

The result is a form of synthetic authority: a fabricated but believable signal that carries the weight of leadership.

And when authority is convincingly simulated, process often follows.

The Compression of the Attack Cycle

This is where the risk becomes more strategic.

Deepfakes don’t just create new attacks... they compress the entire attack cycle.

Traditionally, an adversary had to:

1. Gain access

2. Establish persistence

3. Escalate privileges

4. Move laterally

5. Execute

Now, in certain scenarios, they can skip directly to execution.

If a finance executive believes they are on a call with the CEO, the decision may happen in minutes. There is no dwell time to detect. No malware signature to analyze. No alert in the SOC.

The operation succeeds or fails based on whether the deception holds long enough to trigger action.

This is a fundamentally different tempo of risk.

Trust Is Now an Attack Surface

For security leaders, the implication is straightforward but uncomfortable:

Voice and video are at a point where they can no longer be treated as reliable indicators of identity. They are now just another attack surface.

This doesn’t mean abandoning digital communication. It means redefining how trust is established and verified, especially in high-consequence decisions.

Several shifts are already emerging:

1. Cross-Channel Verification
High-risk actions (financial transfers, credential changes, and sensitive disclosures) require validation across independent channels. Not a follow-up on the same platform, but a separate, controlled pathway.

In an environment where authority can be simulated, verification must precede action.

2. Procedural Friction by Design
Speed is often treated as efficiency. In this context, it becomes a vulnerability. Introducing deliberate friction (multi-party approval, predefined verification steps) can interrupt synthetic authority before it translates into action.

3. Behavioral Awareness Training
Traditional phishing awareness is insufficient. Employees must understand that realistic impersonation is now possible, and that urgency combined with authority is a primary indicator of manipulation.

4. Leadership Modeling
Executives themselves must reinforce these norms. If leaders bypass the process in the name of urgency, they inadvertently train their organizations to be exploitable.

From Implicit Trust to Designed Trust

The deeper shift is cultural.

Most organizations still operate on an implicit trust model—where identity is inferred from familiarity and context. Deepfakes erode that foundation.

What replaces it is designed trust: systems and processes that verify identity deliberately, rather than inferring it passively.

This is not just a security adjustment. It is a leadership decision.

Because the question is no longer whether someone sounds like the CEO.

The question is whether your organization is structured to require proof before acting on that authority.

The Takeaway

In a world where reality can be fabricated on demand, trust can no longer be presumed; it must be engineered, verified, and enforced.

Because the next attack is unlikely to break your systems.

It will sound exactly like someone you trust.

If you’re in a fair fight, you planned poorly.

It is often misread as bravado, or worse, as a call for overwhelming force. In practice, it is neither. It is a statement about responsibility. It reflects an understanding that leaders do not control the moment of contact, but they are accountable for everything that precedes it.

In military planning, leaders assume friction. Intelligence is incomplete. Conditions change. People make mistakes under stress. The environment rarely behaves the way it does on a map or in a briefing. Because of that, planners build margin.

The point was never the math. The point was refusing to plan to parity.

Dwight D. Eisenhower put it plainly: “Plans are worthless, but planning is everything.”

A fair fight assumes that conditions will hold, that assumptions will survive contact, and that the other side will behave predictably. Leadership tends to fail at precisely those assumptions. When plans are built for balance instead of margin, there is no room for surprise. One missed signal or one bad day is enough to force leaders into reaction.

A fair fight is not noble. It is fragile.

This principle translates cleanly beyond combat. In security and executive leadership, advantage rarely looks like dominance. It looks like early decisions that quietly shape conditions. Exposure is reduced. Routines are broken. Options are preserved. Decision points are moved earlier, when leaders still have room to maneuver.

I have seen outcomes change not because someone acted heroically in the moment, but because the work was done long before the moment arrived. Advance work. Pattern recognition. Small constraints applied early that denied opportunity later. When those things are done well, nothing dramatic happens. That is usually the point.

Modern organizations tend to celebrate response. We measure how quickly teams mobilize, how decisively leaders act, how well systems perform under stress. Those things matter. But response is already a tax. It means something reached a point of concentration that could not be avoided.

Most failures are not the result of being overpowered. They are the result of being predictable.

The drift toward fair fights is understandable. Fairness feels defensible. It feels measurable. It produces visible action and visible effort. Prevention, by contrast, is quiet. It is harder to explain. It rarely produces stories people want to tell. Leaders who rely on recognition and visible wins often struggle to invest in work that leaves no trace.

Building margin requires patience. It requires restraint. It requires a willingness to defend preparation when nothing appears to be happening. This is where leadership actually shows up, in decisions that limit exposure and shape conditions without drawing attention.

Leaders who chase decisive moments eventually manufacture them. Leaders who value preparation work to make those moments unnecessary.

The axiom holds because it points to a deeper truth about leadership itself. Leadership is not proven by how well you perform when the situation becomes unavoidable. It is revealed by how much effort you invested to keep it from becoming unavoidable in the first place.

The best leaders I have known never waited to see how a fight would turn out. They built margin early, shaped the environment quietly, and ensured that the moment everyone else prepared for never arrived.

Writing did exactly that.

The work unfolded in the margins: early mornings, airport lounges, quiet hotel rooms, and the spaces between the demands of a full-day job. I expected the process to be demanding. I didn’t expect how much it would challenge my assumptions about both myself and the profession. In trying to explain protection leadership clearly and honestly, I kept encountering the same realization: we do important work, but we are far less practiced at articulating why it works and how it should evolve.

Experience alone does not mature a profession. Shared understanding does.

We Rely on Experience, but We Don’t Translate It

Protection is rich in experience and poor in transmission.

Much of what makes someone effective in this field lives in judgment, instinct, and pattern recognition developed over time. That tacit knowledge is powerful but also fragile. It travels poorly between teams, organizations, and generations.

Research and writing exposed this gap to me. You cannot rely on shorthand or shared context on the page. You have to explain why something matters, not just state that it does. Many of the insights we pass along informally (through stories, debriefs, or side conversations) lose clarity when removed from lived experience.

If leadership cannot be explained, it cannot be taught. If it cannot be taught, it cannot be scaled. And if it cannot be scaled, the profession remains dependent on individuals rather than institutions.

That dependence is a risk we rarely acknowledge.

We Talk About Convergence, but Still Lead in Silos

Few concepts are discussed more frequently in protection than convergence. We all recognize that physical, cyber, intelligence, and reputational risks now intersect. We invest in tools that promise integration and build structures meant to reflect alignment. Yet when you try to describe how decisions actually get made, the seams show.

Convergence is often treated as a technical or organizational challenge. In practice, it is a leadership role. Intelligence is produced in one lane. Authority resides in another. Accountability is distributed across functions that rarely share ownership of judgment.

When everyone contributes information but no one owns interpretation, decisions slow or default to habit. Writing made it clear how often convergence fails not because of capability, but because no leader is clearly responsible for synthesizing insight into action.

Protection leadership in a converged environment requires comfort operating across domains, translating signals, and accepting responsibility for decisions that do not fit neatly into a single lane. That skill set remains underdeveloped, even as the threat environment demands it more urgently.

We Prepare People to Act, but Not Always to Choose

Protection is built on competence. Procedures matter. Training matters. Discipline matters. These are non-negotiable.

But writing forced a harder question: what guides decisions when the checklist ends?

We invest heavily in preparing people to execute tasks. We spend far less time developing judgment in the face of uncertainty, ethical pressure, and incomplete information. We often assume that experience alone will fill that gap.

Sometimes it does. Often, it doesn’t.

On the page, it became clear how limited our shared language around judgment really is. We describe outcomes, but rarely the reasoning that produced them. We praise decisiveness without examining discernment. We reward technical mastery while leaving interpretive skill largely unspoken.

Tradecraft prepares action. Leadership prepares choice. The space between the two is where many failures occur, not because people lacked commitment, but because they were never taught how to think when rules conflicted, or signals diverged.

We Measure Success by Absence, Not Influence

Protection has long defined success as the absence of anything happening. There is logic in that. Prevention is, by nature, invisible.

But writing exposed how limiting that definition becomes as leadership responsibilities expand. When success is measured only by absence, it becomes difficult to articulate value beyond basic assurance. Influence, confidence, and continuity are treated as secondary effects rather than core outcomes.

In reality, effective protection leadership enables others to act. It creates conditions in which leaders can make decisions, organizations can move forward, and people can operate without constant friction or fear. These effects are not accidental. They are the product of judgment, trust, and alignment.

If we continue to define success solely by what does not occur, we undersell the broader leadership contribution the profession provides, and we limit our own evolution.

What the Writing Process Made Unavoidable

Perhaps the most uncomfortable lesson was how writing brought to light inconsistencies I had learned to live with.

In practice, momentum can hide misalignment. On the page, it cannot. Writing forces you to reconcile what you say matters with what you actually reward. It exposes where language is aspirational rather than operational. It demands coherence between values, frameworks, and decisions.

I learned as much about my own blind spots as I did about the profession’s. Assumptions that felt settled in conversation became unsettled in prose. Ideas that sounded complete revealed weak joints when fully articulated.

The hardest part of the process was not finding answers. It was agreeing on the right questions.

That challenge mirrors where protection leadership stands today.

The Work Ahead

Protection does not lack experience. It lacks shared language, transferable models, and clarity around leadership as a distinct, teachable discipline rather than a byproduct of tenure.

Writing does not solve those problems, but it forces them into view. It slows us down enough to see where instinct ends, and intentional leadership must begin.

If protection leadership is to remain relevant in an era of convergence, speed, and narrative-driven risk, it must move beyond practiced intuition and toward deliberate judgment. That shift will not come from tools alone. It will come from leaders willing to examine how they think, decide, and influence—not just how they respond.

Many of these reflections were sharpened in the process of writing a book on protection leadership, work done in the margins of travel days and between the demands of the day job. The act of slowing down enough to write exposed gaps I had learned to navigate instinctively but had never fully examined. That work continues, as does the responsibility to keep asking better questions of ourselves and of the profession.

He recognized that Rome’s numerical advantage was also its weakness. If he could draw the Roman legions into the center and control the geometry of their advance, the decisive point would form in the place they believed they were strongest. His clarity in that moment created one of military history’s most remarkable maneuvers: the deliberate, controlled collapse of his center that enveloped the Roman line.

Military leaders and thinkers from Napoleon to Clausewitz point to the same idea. Victory belongs to the leader who can see the decisive point while others focus on noise, scale, or momentum. Clarity, not size, becomes the determining factor.

Three axioms help translate that ancient lesson into modern leadership.

1. Identify the true decisive point

Clausewitz wrote that the first responsibility of a commander is to identify the one point in a conflict that has disproportionate influence on the outcome. This is often not the point that appears most urgent or most visible.

In business, the decisive point might be:

• The customer problem no one has deeply examined

• A key behavior inside a team that signals cultural drift

• A strategic relationship that determines credibility in the market

• A single risk that, if ignored, reshapes everything downstream

Leaders lose clarity when they allow the loudest issue to masquerade as the most important. The decisive point is discovered through disciplined attention, not volume.

2. See first and see farther

Xenophon wrote that the leader must be the one who sees the field more deeply and earlier. Hannibal’s assessment at Cannae was not a prediction. It was a trained ability to recognize patterns, terrain, and human behavior before the moment demanded it.

In today’s environment, leaders who see farther are the ones who:

• Notice early indicators of team fatigue

• Detect shifts in customer sentiment before the metrics reflect them

• Read the emotional truth of a room, not just the spoken words

• Anticipate how small operational decisions compound into strategic trends

Clarity is not simply insight. It is the willingness to climb to the figurative high ground and observe long enough for the real picture to emerge. Leaders who see first avoid the reactive cycles that consume weaker organizations.

3. Do nothing which is of no use

Musashi’s instruction appears simple, but it may be the most difficult axiom for modern leaders to follow. The greatest threat to clarity is not lack of intelligence or options, but the constant accumulation of unnecessary commitments.

Hannibal did not attempt every available maneuver. He committed only to what shaped the decisive point and discarded everything else.

In business, this often means:

• Saying no to work that distracts from the core strategy

• Refusing to chase opportunities that dilute focus

• Limiting meetings that drain energy without producing decisions

• Reducing unnecessary reporting so teams can focus on action

• Protecting attention instead of scattering it across tasks

Leaders do not fail at the decisive point because they lack capability. They fail because they arrive exhausted, distracted, or buried in efforts that do not matter. Clarity requires elimination. Presence requires discipline.

The modern operating environment is no different

The lessons from Cannae go beyond history. They surface in every modern organization where leaders face shifting information, internal friction, and competing priorities. The environments have changed, but the dynamics have not. Noise overwhelms. Pressure accelerates. Signals blur. The decisive point still hides beneath layers of urgency and expectation.

It shows up in moments like:

• A sudden change in customer behavior

• A team losing alignment even though the metrics look stable

• A competitor quietly reshaping the market

• An emerging risk that stays invisible until it is almost too late

• A strategic opportunity disguised as a minor detail

What determined outcomes in Hannibal’s time still determines outcomes today. Leaders who can distinguish noise from signal, urgency from importance, and motion from progress maintain the advantage. Clarity remains a form of strength long after the battlefields have disappeared.

Putting philosophy into action

Philosophy gains its value only in practice. The decisive point will not wait for ideal timing or complete alignment. It appears amid everyday pressures: a conversation that reveals a deeper issue, a customer question that signals a shift, a team concern that hints at fatigue, a quiet metric that predicts future risk.

Putting these principles into action means building habits that support clarity:

• Ask what actually determines the outcome, not what demands attention.

• Step back long enough to see patterns others overlook.

• Remove the tasks that dilute energy and reduce your ability to respond.

Clarity becomes a competitive advantage only when it becomes a discipline. The decisive point will arrive. The leader who has trained to see it, name it, and move toward it with purpose is the one who shapes the outcome.

Further Reading

1. Clausewitz’s decisive point

2. Commentary on Xenophon’s leadership insights

3. Analysis of Musashi’s principle of focused action

This essay continues a conversation begun in my earlier Vigilia piece on Kurzweil’s Law of Accelerating Returns and the Red Queen Effect: two frameworks that help explain why the tempo of change and the pressure it places on leaders feel unrelenting.

When I wrote about Kurzweil’s Law of Accelerating Returns—the idea that technological progress doesn’t just grow; it compounds. Each generation of innovation feeds the next, shortening the distance between disruption and dependence. When I paired that with the Red Queen Effect—the evolutionary principle that survival demands constant adaptation—it struck a nerve. Many readers said it finally captured how it feels to lead today: always running, rarely resting, and still wondering if we’re keeping pace.

That feeling isn’t anecdotal. It’s structural.

We’ve entered a period where the tempo of risk now outpaces the tempo of leadership—and unless we learn to adapt our strategy as quickly as adversaries adapt their tactics, we’ll lose ground without ever standing still.

The Race That Never Ends

As I wrote previously, the Red Queen told Alice she must run as fast as she can just to stay in the same place. That wasn’t just a metaphor for biology—it’s a map for modern leadership.

In evolutionary science, the Red Queen Effect describes co-evolution: predator and prey evolving together, each forcing the other to change faster to survive.

Today, every organization and leader is caught in the same dynamic.

Cyber defense evolves, and so does cyber offense. Deepfake detection improves, and AI-driven deception grows more sophisticated. Physical security hardens, and attackers pivot to data brokers, influence operations, and digital reconnaissance. The more we adapt, the more adaptation is required.

This is no longer a linear contest of innovation. It’s an accelerating exponential feedback loop.

The Velocity Gap

Kurzweil predicted that the twenty-first century would deliver twenty thousand years of progress at the twentieth-century rate. The math is staggering, but the implications for leadership are even more so.

Because while technology compounds, organizations don’t.

Decision hierarchies, budget cycles, and regulatory frameworks all operate at human speed—slow, cautious, deliberative. That makes sense when stability is the goal. But in an era where threats evolve weekly and reputations can collapse overnight, stability through slowness becomes fragility.

The result is what I call the velocity gap—the widening gap between how quickly risks move and how quickly leaders can respond. Every lag in understanding, in approval, in coordination is an opening that adversaries exploit.

Adaptive Strategy Over Predictive Control

Traditional strategy assumes we can forecast, plan, and execute within a predictable horizon. But prediction assumes pace, and pace has been shattered.

Modern leadership requires something different: adaptation at the speed of change.

That means designing systems that learn, not just operate.

It means embedding intelligence into every layer of the organization—so that insight, not hierarchy, drives action.

This is where the protector’s mindset becomes instructive. In protective intelligence, we accept that control is an illusion, but readiness is not. We shorten the loop between detection and decision. We anticipate, simulate, and adapt—because we must.

Leaders who think this way in every domain—business, government, family office—will not just survive acceleration; they’ll harness it.

Tempo Control: The New Leadership Competency

In military design, tempo is everything.

The side that dictates pace controls the fight. The same is true in leadership.

Adaptive organizations don’t chase threats—they design feedback loops that compress time between sensing and acting.

They treat intelligence as a strategic function, not a staff activity.

They rehearse crises before they occur.

And they build what I call resilient agility—the ability to move fast and stay grounded in purpose.

The most effective leaders I know aren’t the quickest movers or loudest voices. They’re the ones who create calm in acceleration—who can look at a situation spinning at digital speed and still discern what matters most.

Leadership in the Acceleration Curve

Here’s the paradox: the faster the world moves, the more essential stillness becomes.

Stillness is not inertia; it’s clarity—the mental reset that allows us to think, not just react.

As risk leaders, we can’t outpace every threat. But we can reduce friction in our decision-making cycles, enhance our foresight, and align our teams around intelligence-led action.

The Red Queen teaches us that survival isn’t about speed alone—it’s about evolution.

And evolution for leaders means learning to adapt your strategy as quickly as the environment demands.

The Next Move

The Red Queen is winning—for now. But that’s not defeatist; it’s diagnostic.

She reminds us that pace, not power, defines modern competition.

That every advantage is temporary.

And that leadership today is less about predicting the future than designing for acceleration.

The faster the world spins, the steadier we must learn to move.

Most leadership failures don’t begin with poor execution.

They begin with poor framing.

I’ve sat in enough crisis rooms to recognize the pattern. The problem appears; the tempo accelerates. Plans emerge before understanding does. People want action — slides, metrics, a direction. The faster we move, the more it feels like progress. But the truth is more complicated: most motion in uncertainty is just momentum without meaning.

In the military, we were taught a different way. Before planning came design. Before decision came understanding. It wasn’t about producing orders; it was about producing sense… clarity in the fog of complexity. We called it the Army Design Methodology, though that name hardly captures what it really was: a discipline of thought.

Years later, as an executive, I find myself returning to it. Not as doctrine, but as philosophy. Because while the terrain has changed, from battlefields to balance sheets — the need for disciplined sensemaking has not.

The Battle Before the Battle

Design begins with humility. It forces a leader to acknowledge: I don’t yet understand what I’m looking at.

In a military context, that meant mapping the operational environment: who the actors were, what systems interacted, and where tension lived. In a corporate context, it means the same thing: understanding the field before committing the force. Competitors, regulators, markets, technologies... these are the new battlefields.

Most organizations skip this step. They rush from problem to plan without stopping to examine the system that produced the problem. We call it “strategic planning,” but often it’s just tactical scheduling dressed in PowerPoint. Design, by contrast, slows us down just enough to see. It asks the first and most complex question: What is really going on here?

Framing the environment is not an academic exercise. It’s the act of establishing reality when everyone else is guessing. It’s walking into a room of executives debating symptoms and asking, “What if none of these are the real issue?”

That question changes everything.

Finding the Real Problem

Good strategists are rarely the smartest people in the room — but they are usually the most curious.

Design teaches that before you can solve a problem, you have to frame it. And framing is moral work. It demands intellectual honesty about what’s broken and what’s not.

In combat, we learned that “enemy activity” wasn’t the same as “enemy intent.” A firefight on the flank didn’t necessarily mean the enemy’s main effort was there. In business, the same principle applies. Declining sales may not be a marketing issue; it might be a trust issue. High turnover may not be a talent problem; it might be a leadership problem.

The courage to name the real problem — to admit what’s underneath the numbers — separates design thinkers from planners. Planning begins where certainty exists. Design begins where certainty fails.

Designing the Approach

Once the problem is framed, the next instinct is to fix it. But design cautions restraint. The goal is not yet the plan; it’s the approach.

The operational approach (as we called it) is the conceptual bridge between understanding and execution. It connects vision to action, purpose to movement. It’s the point where a leader begins to think in lines of effort rather than projects, in cause and effect rather than task lists.

For a Chief Strategy Officer, this is where the craft lives. You take the organization’s disparate efforts — growth, risk, customer experience, talent — and weave them into a coherent narrative of transformation. You design momentum with meaning.

The strategist’s art is not inventing new initiatives; it’s ensuring every initiative shares a logic of intent, because a company without coherence is just a collection of smart people moving in different directions.

Reframing: The Mark of an Adaptive Leader

The final discipline of design is reframing. In the field, we called it “learning faster than the enemy.” In business, it’s learning faster than the environment.

Reframing is not failure — it’s growth. It’s the moment a leader admits that new information has rendered the old picture incomplete. Most executives resist it because it appears indecisive. But in truth, it’s the essence of strategic agility.

To reframe is to lead with curiosity instead of ego. It’s the act of revisiting assumptions, of asking again, “What’s changed?” and “What still holds?” It’s how leaders keep the organization alive — intellectually, morally, and competitively.

From Process to Philosophy

When I teach or mentor leaders now, I rarely talk about design as a step-by-step method. Instead, I describe it as a way of being — a mindset that treats thinking as a form of leadership.

Planning organizes what we know.

Design wrestles with what we don’t.

Planning requires control; design requires curiosity.

Planning lives in certainty; design thrives in ambiguity.

And in a world defined by volatility, it’s the design thinker who endures.

This doesn’t mean every executive needs to draw systems maps or read doctrine. It means they need to pause—to create space between stimulus and response. That space is where judgment lives. It’s where the strategist earns their title.

The Protector’s Mind

For those of us who came up in protection or intelligence, this mindset feels natural. The protector is always designing — scanning, sensemaking, anticipating. The work is never purely reactive; it’s architectural.

The modern Chief Strategy Officer operates no differently. The risks may be reputational, fiscal, technological, or geopolitical. Still, the discipline is the same: understand the terrain, frame the problem, design the approach, and stay humble enough to reframe when the world shifts.

In the end, leadership is protection — of people, of purpose, of possibility.

The Pause Between Seeing and Doing

If I could leave leaders with one practice, it would be this: design before decision.

Not because process is sacred, but because perspective is.

Because in the pause between seeing and doing, between assumption and action, leadership actually happens.

Design is the modern leader’s reconnaissance — the act of observing before engaging, of asking before answering. It is less about certainty than stewardship; less about control than coherence.

And when everything around you accelerates (the markets, the media, the noise) the leader’s power is not in keeping up… It’s in slowing down.

Long enough to see the field clearly, long enough to understand what truly matters, and long enough to design.

“We live in an age that confuses motion for progress.”

Aristotle taught that all human work falls into three kinds: Theoria (to know), Praxis (to act), and Poiesis (to create). Together, they form a complete map for leadership — how we think, decide, and build in a world that demands all three.

Yet our modern environment, driven by urgency and performance, rarely allows for balance. We live in constant motion, mistaking speed for insight and productivity for creation.

I. Theoria — The Work of Understanding

Theoria is the work of intellect — contemplation, discernment, and foresight. Aristotle considered it the highest form of work because it seeks truth for its own sake.

For leaders, Theoria is the discipline of pausing long enough to see clearly. It’s the map work before the march, where principles are tested and priorities emerge.

McKeown’s reminder is Aristotelian at its core. The essentialist leader protects Theoria... time to think deeply before acting. Without it, action devolves into reaction.

But McKeown also highlights an imbalance. Most of us stop at Theoria and Praxis — we think and we do — but we rarely reach Poiesis, the act of making something that lasts.

II. Praxis — The Work of Action

Praxis is ethical action — where ideas collide with reality. Aristotle placed it between thought and creation because it’s where judgment, choice, and character are tested.

Writing in his seminal work How to Be a Leader, Plutarch warned that when action loses virtue, it collapses into ambition.

The Greek philosopher and moralist, who turned biography into a study of character, taught that self-command is the first duty of command itself.

As Plutarch taught, a leader should be an example of moral goodness, not a spectacle of success.

Praxis demands more than competence; it requires moral grounding. Every decision reveals who we are — not just what we know.

Modern leadership often lives entirely in Praxis: endless meetings, updates, initiatives, and “outputs.” We celebrate speed, yet rarely ask whether our motion produces meaning. Praxis without Theoria becomes busyness; Praxis without Poiesis becomes burnout.

III. Poiesis — The Work of Creation

Here lies the forgotten frontier.

Poiesis means bringing something into being — the act of creation. It’s not production or output; it’s the synthesis of thought and action into form. The architect designs, the poet writes — and the leader shapes systems, cultures, and legacies that outlast them.

This is where McKeown’s critique lands hardest: our world celebrates creation... but selectively. We reward innovation that scales and products that perform, yet neglect the slower, quieter creation of systems that endure. We glorify the what, but rarely the why or how.

The result is a leadership culture fluent in commentary (Theoria) and relentless in activity (Praxis), yet hesitant to invest in Poiesis — the deliberate making of trust, culture, and purpose that outlasts the quarterly report.

The American Founders understood this. Washington’s restraint, Hamilton’s financial architecture, Madison’s system design... all acts of Poiesis. They built not just a government but a framework capable of self-correction. Aristotle might have called it creative prudence: the art of shaping systems that reflect moral vision.

Leadership that does not create will eventually consume itself.

The Balance of Leadership

In today’s organizations, the imbalance is unmistakable:

• We over-index on Praxis — relentless action.

• We glorify Theoria — endless analysis and commentary.

• We neglect Poiesis — the work of building what endures.

The leaders who harmonize all three —those who think deeply, act rightly, and build enduringly —are rare. But they are the ones who leave marks that last.

“The measure of a leader is not what he inherits, but what he leaves.” — Plutarch

Seen this way, Poiesis becomes the highest expression of leadership. It fuses vision and virtue into something tangible.

Theoria sharpens perspective.

Praxis tests integrity.

Poiesis gives both form.

Toward Poietical Leadership

To reclaim the poietical dimension is not to add more work, it’s to elevate the kind of work we value.

A leader in Theoria studies the system.

A leader in Praxis steers it.

A leader in Poiesis shapes its future form.

These aren’t phases, but modes — a rhythm, if you will. The strongest leaders know when to move between them, when to step back, and when to step in.

Aristotle began the conversation.

Plutarch refined it.

The Founders lived it.

McKeown reminds us how far we’ve drifted from it.

The work of leadership, in any century, is to bring them back into alignment and move from knowing to doing to making.

Because leadership, at its best, is not what we know or do - It’s what we build.

The true test of modern leadership is not in velocity, but in composition — the ability to think clearly amid noise, act rightly amid pressure, and create something that outlasts both.

That’s the balance Aristotle mapped more than two millennia ago... and the work still before us.

I’ve previously discussed Ray Kurzweil’s Law of Accelerating Returns — the idea that technology doesn’t just evolve, but the rate of evolution itself accelerates. What we’re seeing now is that law colliding with the Red Queen Effect: the evolutionary arms race where organisms must run faster and faster to avoid losing ground. For today’s security leaders, that race isn’t metaphorical. It’s the lived reality of asymmetric threats, where adversaries exploit acceleration and imbalance to turn minor inputs into major disruptions.

Asymmetry on the Red Queen’s Treadmill

Most executives imagine the threat race as symmetric — organization vs. organization, budget vs. budget. But in practice, it’s asymmetric:

• Low-cost, high-impact attacks

  Criminal groups don’t need a billion-dollar lab. With a commodity GPU or a $49/month subscription, they can generate synthetic voices or deepfake videos that erode your trust infrastructure. Your multimillion-dollar controls are neutralized by a handful of adversarial prompts.

• Digital to physical crossover

  A cloned “voice of the boss” convinces an assistant to change travel plans, cancel a protection detail, or redirect a delivery. The initial exploit is digital, but the consequence is physical — a gap in protective coverage, a rerouted cargo shipment, a misinformed facility guard.

• Tempo advantage

  Offense requires a single successful innovation. Defense requires patching dozens of possible gaps. The asymmetry lies in tempo: adversaries exploit acceleration while defenders struggle with bureaucracy, compliance, and slow procurement.

This is the Red Queen Effect in action — adversaries forcing defenders to run faster to remain in place, and punishing those who pause to catch their breath.

The Physical Dimension of Accelerating Threats

It’s tempting to silo deepfakes, AI, and data-broker exposure as purely “cyber” problems. But the real-world consequences are increasingly physical:

• Access control: AI voice impersonation challenges biometric or voice-based facility access.

• Executive protection: Synthetic calls alter motorcade routes or hotel check-ins, creating exploitable windows.

• Critical infrastructure: Operators tricked by synthetic instructions can trigger physical cascades — from delayed shipments to operational downtime to safety incidents.

The digital-to-physical pipeline is shortening. In 2019, deepfakes were curiosities. By mid-2026, they will be operationalized into fraud schemes, reputational takedowns, and executive targeting. This is Kurzweil’s acceleration compounded by the Red Queen’s treadmill, and it moves risk out of the server room and into the street.

Why Standing Still Is Losing

The consequences for organizations that fail to adapt are severe:

• Reputational collapse: An executive impersonation that makes headlines undermines investor confidence, even if no money is lost.

• Operational drag: Patchwork defenses pile up, brittle and costly, while attackers iterate freely.

• Regulatory exposure: New laws are pushing accountability for synthetic fraud, AI misuse, and data exposure onto boards and executives.

• Resource burnout: Teams stuck in incident response loops rather than proactive adaptation burn out, while adversaries exploit fresh vectors.

Resilience alone — the ability to “bounce back” — is no longer sufficient. Leaders must cultivate adaptive capacity, optionality, and tempo agility: the ability to detect, decide, and act at the pace of the threat.

A Framework for Leaders: Running Faster, Smarter

How do you operationalize Red Queen thinking? Four moves:

• Adopt Rolling Horizons

  Move away from static annual plans. Institute 90-day foresight scans — feeding new scenarios directly into risk dashboards.

• Design for Optionality

  Preserve unused but available capacity — cross-trained staff, flexible contracts, rapid external partnerships. In an accelerating race, slack is strategy.

• Measure Velocity, Not Just Outcomes

  Time-to-detect, time-to-decide, and time-to-recover matter as much as “number of incidents.” Track the speed of your defensive metabolism.

• Cross the Silos

  Train teams for converged incidents — where a deepfake isn’t “cyber,” but an executive protection/Insider Risk threat vector. Treat digital, physical, and reputational signals as one fused attack surface.

The Infinite Middle Game

Kurzweil’s accelerating returns describe the tempo of change. The Red Queen Effect describes the consequences of falling behind. Together, they explain why today’s asymmetric threats are so difficult, and why leaders can no longer rely on linear planning or siloed defenses.

Winning this race is not about crossing a finish line. It’s about developing the stamina to run indefinitely — faster, smarter, more adaptively.

Because in the Red Queen’s world, standing still isn’t neutral…

It’s checkmate.

Suggested Sources and Further Reading

Farnam Street, “The Red Queen Effect: Avoid Running Faster to Stay in the Same Place.”

Kurzweil, R. “The Law of Accelerating Returns.” Writings by Ray Kurzweil.

Pindrop. “Deepfake Fraud Could Surge 162% in 2025.” Fraud trends and implications.

Zhang, B. et al. (2025). “Audio Deepfake Detection: What Has Been Achieved and Where to Go.” Sensors Journal. Link

Concentric AI. “Avoid the Red Queen Effect in Data Access Governance.”

At first, that phrase can feel like a contradiction. Why plan if the plan won’t hold? Why invest in details if they’re bound to unravel? But that’s the wrong way to hear it. The point isn’t that planning is useless—it’s that adaptability is priceless. The value of the plan lies in the discipline it fosters, the preparation it demands, and the mindset it cultivates. Once the first shot is fired, the map is less important than the leader’s ability to reorient, improvise, and move forward.

The Leadership Trap of Over-Planning

In corporate life, I see leaders fall into the same trap we fought against in uniform: mistaking the plan for the objective. Hours are poured into strategies, slide decks, and roadmaps. Leaders comfort themselves by believing they’ve reduced uncertainty to manageable steps. But when reality shifts—and it constantly shifts—those elegant plans reveal their fragility.

The danger isn’t in planning. It’s in rigidity. Leaders cling to the script because they’re afraid of appearing indecisive. Teams freeze because the playbook doesn’t tell them what to do when the variables multiply. What was once preparation becomes paralysis.

Great leaders don’t worship the plan—they honor the process of planning. They use it to think critically, to align teams, to anticipate pressures. But they also hold it lightly, knowing that leadership is less about following the script than writing the next chapter in real time.

The Real Test of Leadership

I once served under a battalion commander who modeled this perfectly. During a field exercise, everything that could go wrong did. Communications broke down. Units became separated in dense terrain—the plan we’d spent weeks refining dissolved in hours.

Most commanders would have tightened their grip—doubling down on control, demanding updates, punishing deviations. Instead, he did something different. He pulled his staff together and calmly said, “The plan is gone. The principles remain. Secure your people. Regain contact. Move toward the objective.”

That moment was a masterclass in leadership. He didn’t need the plan to keep us moving. He needed clarity of intent and trust in his teams. We adapted, improvised, and got back on track. The lesson stayed with me long after: leadership isn’t about preventing disruption. It’s about absorbing it without losing momentum.

Translating the Lesson

For leaders outside the military, “no plan survives first contact” is just as relevant. The first contact may not be with an enemy—it may be with a new market force, a competitor’s innovation, or an unexpected cultural shift inside the organization.

The common thread is this: reality will never perfectly match your assumptions. Plans will break. The test is whether your leadership does.

To lead in these moments requires three things:

1. Clarity of intent – Make sure your people know the “why” behind the mission. When the plan fails, intent gives them a compass.

2. Empowered adaptability – Build teams that are trusted to improvise. Don’t punish initiative just because it wasn’t in the original script.

3. Calm under pressure – When everyone else is looking for certainty, your job is to project steadiness. You don’t have to know every answer—you have to model confidence that the team will find a way forward.

The Paradox of Preparedness

So, should we stop planning? Absolutely not. The irony is that the best improvisers are usually the most disciplined planners. The process of planning forces leaders to think broadly, test assumptions, and prepare resources. That preparation doesn’t create certainty—it creates adaptability.

What makes the maxim true is not that planning is futile, but that leadership is contextual. A good plan gets you to the starting line. A good leader carries the team across the finish line when the plan collapses.

Takeaway for Leaders

If you’re a leader, ask yourself:

• Do I treat the plan as gospel or as a tool?

• Have I prepared my team to adapt when reality breaks the script?

• Am I rewarding flexibility, or punishing it?

• Do my people know our intent so well that they can act without waiting for orders?

The phrase “No plan survives first contact” isn’t an indictment of preparation. It’s a reminder that leadership is not about control—it’s about clarity, trust, and adaptability.

Ultimately, the best leaders don’t just survive initial contact; they thrive. They revel in it because they know the mission is bigger than the plan, and the people are stronger than the script.

-Out.

For years, we’ve spoken of convergence, hybrid threats, and asymmetric risk. They’ve been staples of conference agendas, board updates, and strategic reviews. We all agreed that someday these forces would collide in ways that demand new thinking from security leaders.

That “someday” is now.

It’s not a forecast — it’s the reality unfolding in cascading incidents that leap from one risk domain to another before we even know the first domino has fallen.

This isn’t a new conversation. It’s one we’ve had for decades. The difference today is that the cost of not acting is no longer theoretical. We saw this coming, we named it, but the leadership structures to manage it have lagged behind.

Yesterday’s Discussion

We’ve had the vocabulary for years. We just didn’t embed it.

After 9/11, government agencies learned that intelligence must cross domains to be effective, investing in fusion centers and joint task forces. In corporate security, we acknowledged the lesson but largely kept cyber in IT, physical in the GSOC, and reputational risk in marketing’s lane.

Early signs of cyber-physical convergence were easy to dismiss. Social platforms used for targeting? “That’s PR’s problem.” Coordinated disinformation campaigns against brands? “That’s marketing.” We knew better — but our incentives and structures kept us siloed.

The result: our language evolved, but our leadership models remained unchanged.

Today’s Dilemma

We’ve built an unbalanced view of threats.

We pour resources into the risks we know how to manage — firewalls, access control, guard contracts — while neglecting the ones that move fastest and cut deepest: hybrid, cross-domain, and narrative-driven threats.

Consider the Salt Typhoon campaign in 2024. State-linked actors compromised multiple U.S. telecom networks for nearly a year, breaching routers, core systems, and even National Guard networks. What began as a cyber incident rippled across national security.

Or the hybrid criminal case where a fake recruiter on LinkedIn lured a corporate employee into downloading malware while coordinating physical intimidation. Digital, physical, and psychological tactics in one operation.

These aren’t edge cases. They’re becoming the baseline. And adversaries ,whether criminal, activist, or state-sponsored, often understand the seams in our organizations better than we do.

The Convergence Gap

Talking about convergence is not the same as leading for it.

Many of us can articulate the need for integration. Far fewer have built the relationships, operational rhythms, and governance to make it happen. And that gap is exactly where modern threats thrive.

Why?

Because our org charts work against us. Cyber reports to CIO. Physical to COO. Legal sits alone. Comms is embedded in marketing. We end up with no unified operating picture, no common rhythm of information flow, and no rehearsed playbook for a hybrid incident.

I’ve seen organizations with the intelligence to stop a threat early… but the dots weren’t connected in time. Not because the data didn’t exist, but because the structure wasn’t designed to act on it.

Breaking the Silos

The modern CSO must be a coalition builder.

That means:

• Unified intelligence across cyber, physical, comms, and legal — as a standing practice, not a crisis measure.

• Cross-functional rehearsals that run hybrid threat scenarios before they happen.

• Shared ownership of risk, so the enterprise understands the brand, operational, and safety implications of every vector.

This is more than coordination. It’s deliberately closing the seams that attackers exploit.

The Asymmetric Mindset

Asymmetric actors win by exploiting tempo, surprise, and blind spots.

As the former U.S. Army Asymmetric Warfare Group explained, its mission was to ‘identify critical asymmetric threats… through global first-hand observations,’ enabling rapid adaptation in a shifting threat environment. That’s the same level of insight security leaders should demand—whether from small teams or entire corporations.

They don’t respect your categories. They will hit you digitally, physically, and reputationally in whatever sequence maximizes confusion and slows your response. They’ll use low-cost tools to cause high-cost damage: small moves, outsized effects.

The Russian hybrid operations expected around the 2025 NATO Summit — from undersea cable sabotage to coordinated disinformation — are a geopolitical reminder: threat playbooks are fluid, objectives cross domains, and speed is a weapon.

To lead security in 2025, shift from incident response to threat interception. That requires:

• Thinking like an adversary.

• Anticipating cross-domain consequences.

• Making agility in decision-making a core leadership skill.

Revolution, Not Reform

Reform tweaks. Revolution rewires.

Reform is adding a liaison between cyber and physical.

Revolution is creating a single intelligence and operations hub that treats threats as fluid, not fixed.

A revolutionary CSO:

• Fuses protective intelligence directly into operational decisions.

• Designs governance that forces convergence thinking into daily operations.

• Measures success by what doesn’t happen — because it was intercepted early.

This isn’t just about defense. In an era where resilience and trust are competitive advantages, converged threat leadership is a differentiator.

The Call

The future we debated is the reality we navigate.

Our choice as security leaders is clear:

• Lead the integration — or let the seams in our organizations become the entry points for the next crisis.

• Treat convergence as the operating model — or be left managing yesterday’s threats while tomorrow’s attack unfolds.

The threats are asymmetric.

Our leadership must be, too.

As with each of these dinners, the goal is simple: create space for meaningful dialogue among leaders, operators, and builders in our field. No keynotes, no slide decks, no social performance metrics. Just a shared table, a strategic question, and the time to sit with it.

For D.C., the framing prompt was this:

“In your view, what do you see as the most pressing challenge facing our industry today—and how are you managing or thinking about it?”

What followed was off-the-record, but several clear themes emerged that deserve a wider audience. Not as headlines or takeaways—but as signals.

The mission is shifting. Are we?

The environments we operate in—public and private—are colliding in new ways. Geopolitical volatility, domestic unrest, disinformation, and hybrid threat actors have pushed intelligence and security teams into unfamiliar territory. And yet, too often, our organizational structures and success metrics are still tied to yesterday’s risks. We know the mission is evolving. The question is whether we are evolving with it—or simply reacting slower each time.

Collaboration remains critical, but complicated.

Public–private cooperation is still more talking point than playbook. Legal constraints, cultural friction, and asynchronous timelines keep trust fragile. One repeated insight: we cannot build connective tissue during a crisis. Relationships must be built before they're needed—and nurtured when no one is watching.

The bench needs building.

This came up often, and with urgency. The next generation of protective intelligence and security professionals needs more than tradecraft. They need business fluency, geopolitical literacy, and the ability to lead teams that sit at the intersection of threat, brand, and enterprise risk. We need to stop recruiting for the past and start developing for the future.

Convergence is happening—whether we’re ready or not.

Call it convergence, integration, or just “how the job works now,” but the silos are cracking. Cyber, physical, intel, geopolitical risk—these aren’t separate disciplines anymore. The best teams are operating as fused systems. Everyone else is still debating org charts.

And then someone asked the question that stayed with us all night:

“Five years from now, what will you regret professionally?”

The answers were quiet but heavy.

— Not being bold enough in our current roles.
— Sticking with legacy structures too long.
— Failing to act on what we already understand.
— Seeing the problems… and still talking about them five years from now.

That’s the kind of question that lingers.

Looking ahead

Deep thanks to the U.S. Chamber of Commerce Foundation and the team at INTELAB for making this possible—and for investing in the community this industry needs.

To those who reached out but couldn’t attend: we’ll be back in D.C. soon for Round 2.

On deck: Chicago, San Francisco, Atlanta.

We’ll keep the tables small, the questions sharp, and the conversations real.

—Chuck

Vance Boelter acted alone—but not in isolation. He acted with conviction, driven by a belief system that made him feel part of something larger.

In his mind, the plan was sanctioned. Justified. Tactical.

He believed the Governor of Minnesota had ordered him to assassinate Senator Amy Klobuchar—a delusional claim documented in a letter to the FBI, found after the attack. ¹

There was no plot. No handler. No coordination. But there was a story. And Boelter believed it.

That's what makes this final stage of the modern kill doctrine so dangerous; It's not just about access or exposure. It's about belief becoming permission. It's about narrative as a trigger.

Narrative as Doctrine

We've spent years investing in physical security and cyber risk. But we're still underestimating the threat that moves between them: the story.

Stories—particularly false ones—are shaping action faster than any breach or badge swipe. Boelter isn't the first to act on belief. He's the latest in a growing pattern of self-deputized actors who absorb grievance and assign themselves a mission.

These actors don't wait for orders. They believe they've already been given one through a post, a meme, a podcast, or a comment thread. They're not organized by people; they're organized by story. ²

The Permissionless Operator

This new adversary doesn't seek approval. They seek confirmation.

They believe they're a:

...soldier fighting tyranny

...protector—defending children

...patriot—delivering justice

And the current ecosystem inadvertently supports them:

• Algorithms feed their mission.

• Fringe communities validate their logic.

• Online content provides tactics, maps, and "moral" language. ³

This is how belief becomes a kill switch. It doesn't just motivate violence. It justifies it. And once justification (real or perceived) is in place, the last restraint drops.

A Doctrine Without a Commander

There is no operational cell in place, and no centralized plan exists.

What we're facing is an insurgency of narrative. Permission doesn't come from a leader, it comes from belief—belief that action is righteous, even inevitable.

Boelter's story was deeply personal, but not unique.

Luigi Mangione, who murdered UnitedHealth CEO Brian Thompson, left behind rambling notebooks, digital maps, and ideological rants. ⁴ The Buffalo supermarket shooter. The Christchurch attacker. The Pittsburgh synagogue shooter. They all pointed to a belief system, framed as moral or defensive.

They didn't need a network. They had a story—and a justification loop. ⁵

What This Means for Security

This is the final layer in the modern attack cycle. Not just data. Not just visibility. But belief.

And if you're tasked with protecting people or systems, this has real consequences:

Narrative monitoring must become part of protective intelligence.

• Who's telling the story?

• Who's believed?

• Who is primed to act?

Narrative velocity matters as much as physical escalation.

• If a target is being reframed online as a villain, traitor, or abuser—that's a flashpoint.

Disruption must happen before belief hardens into mission.

• Once someone believes they're the hero in a justified story, intervention becomes exponentially harder.

Disrupting the Kill Switch

The solution isn't mass censorship. It's an early recognition of belief architecture:

• What symbols are gaining traction?

• What patterns of grievance are accelerating?

• Where is language shifting from disagreement to dehumanization?

This is a job for security leaders, yes—but also communicators, technologists, and policymakers. Because the new insurgency isn't just kinetic, it's narrative led.

Final Word

The modern kill chain doesn't end with a weapon. It ends with a story—and a decision to act on it.

Boelter believed he was fulfilling a mission and what he lacked in support, he made up for in story. And that belief, unchecked, became a doctrine.

The next one is already online.

Already watching.

Already listening.

What they believe will determine what they do. Our job is to understand that belief before it becomes an act.

Footnotes & Sources

1. https://www.startribune.com/vance-boelter-letter-klobuchar-walz-mn-assassination/601376682/

2. https://www.dhs.gov/ntas/advisory/national-terrorism-advisory-system-bulletin-november-30-2022

3. https://www.theguardian.com/technology/2025/jun/21/political-violence-online-murder-tradecraft

4. https://nypost.com/2025/06/04/us-news/luigi-mangione-manifesto-brian-thompson-unitedhealth-killing/

5. https://www.rand.org/pubs/research_reports/RR1091.html

We often talk about lone actors. But the truth is, few of them operate in isolation. They may act alone—but a system (however convoluted) informs them. They follow a doctrine. Sometimes, that doctrine is ideological. Sometimes it’s tactical. Increasingly, it’s both.

When authorities apprehended Vance Boelter after his targeted shootings in Minnesota, they discovered something chilling—but no longer surprising: a list. Dozens of names, addresses, affiliations. Lawmakers, abortion providers, and national political figures. It was meticulous. It was digital. And it wasn’t the first.¹

We need to stop treating kill lists as anomalies.

They’ve become a feature of modern violence, not an exception.

From Click to List

In Part 1, I wrote that the kill chain starts with a click. Most targeting in today’s landscape begins online—via search engines, data brokers, breach dumps, or something as simple as Zillow or Instagram.² But what comes next is just as important.

The list.

After gathering sufficient open-source intelligence, many threat actors begin to build a roster. Not one just of people they dislike—but of people who represent something they resent. The kill list becomes a convergence of data, narrative, and identity. It’s not just “who do I want to hurt?” It becomes “who embodies the thing I want to destroy?”

That’s where the doctrine takes hold.

Perception Is the New Targeting Logic

You don’t end up on a kill list because of who you are. You end up there because of what someone believes you represent.

In Boelter’s eyes, Melissa Hortman wasn’t just a legislator. She was a stand-in for everything he thought was wrong with the system. Amy Klobuchar wasn’t just a senator. She became a proxy for federal corruption. These weren’t people—they were symbols.³

This kind of symbolic targeting is accelerating. Executives, health officials, journalists, public servants—when exposure meets grievance, and that grievance gains narrative traction, you get a list.⁴ And someone starts planning.

Meanwhile, the symbolism plays out on both sides. On the same day, Boelter appeared in court, requesting relief due to the lack of sleep in jail⁵; citizens gathered to honor the Hortmans—Melissa, Mark, and their dog Gilbert—as they lay in state at the Minnesota Capitol.⁶

He made a list to erase meaning. We stood in line to affirm it.

The Doctrine of the Self-Tasked Insurgent

Kill lists used to belong to terror groups or organized actors. Today, they’re compiled by individuals who self-assign a mission. No chain of command. No operational cell. Just a grievance and a goal.⁷

Increasingly, these actors believe:

• They’re soldiers in an invisible war.

• Their actions are righteous, even divinely ordained.

• Violence is not an escalation—it’s a correction.

Boelter’s wife, Jenny, said she was “completely blindsided” by his actions.⁸ That’s not uncommon. Doctrine grows quietly. These actors often radicalize in silence, in forums, in feeds, and in the dark. Until the day they act.

In this case, that silence hid a kill list with up to 70 names.¹

That is not a grudge. That is a framework.

How the List Is Built

These lists aren’t scribbled in notebooks anymore. They live in Notes apps, spreadsheets, encrypted folders—and increasingly, they’re scaffolded by online “tradecraft.” Extremist forums and Telegram groups now circulate DIY assassination guides, surveillance tips, and target datasets.⁹ These are not just lists. They are tools—modular, scalable, and weaponized.

Most include:

• Full names and public titles

• Residential or office addresses

• Family members, routines, social media profiles

• Ideological tags: “globalist,” “traitor,” “baby killer”

What makes them dangerous isn’t the format—it’s the intent behind them and how easily they’re weaponized. These aren’t artifacts. They’re tools.

And like any doctrine, they’re modular. Scalable. Transferable.

What This Means for Security and Business Leaders

If you’re in a protective, security, or risk leadership role, you need to treat kill lists not just as evidence—but as early warning systems for doctrine in motion.

Ask yourself:

• Are we monitoring our people’s inclusion in threat lists or doxxing packets?

• Are we auditing exposure across personal and professional domains?

• Are we mapping perceived symbolism, not just actual authority?

The question is no longer, “Are they important enough to be targeted?”

It’s “What meaning might someone attach to them—and what story does that enable?”

Closing the Gap

Boelter didn’t just build a kill list. He followed one.

He moved from digital observation to physical action. From narrative to violence. From target acquisition to execution. And as he sits in jail—fighting for bail, citing sleep deprivation under suicide watch¹⁰—the doctrine continues to unfold.

His kill list didn’t end with the attack. It echoes into courtrooms, headlines, and grieving communities.

What he started with a list, we counter with resolve.

Because that’s what lists are now: a doctrine of modern violence.

And if we want to prevent what’s next, we’d better start reading them for what they are.

Footnotes & Sources

1. https://www.washingtonpost.com/nation/2025/06/27/vance-boelter-melissa-hortman-court-hearing/

2. https://cybernews.com/security/billions-credentials-exposed-infostealers-data-leak/

3. https://www.startribune.com/vance-boelter-letter-klobuchar-walz-mn-assassination/601376682/

4. https://time.com/7294891/political-violence-rise-america/

5. https://www.kare11.com/article/news/local/courts-news/vance-boelter-tells-judge-he-hasnt-slept-in-almost-two-weeks-since-arrest/89-8ab888e8-b6e4-4263-bdd8-1d904c64cd72

6. https://apnews.com/article/1558dffabc9bbf087a4e45f9cf868b09

7. https://www.dhs.gov/ntas/advisory/national-terrorism-advisory-system-bulletin-november-30-2022

8. https://people.com/wife-of-suspected-minnesota-lawmaker-shooter-speaks-out-completely-blindsided-11762075

9. https://www.theguardian.com/technology/2025/jun/21/political-violence-online-murder-tradecraft

10. https://www.startribune.com/vance-boelters-detention-hearing-continued-amid-reports-of-poor-jail-conditions/601377784/

This wasn't a sophisticated cyber breach or insider plot. It was a premeditated act of violence enabled by legal access to personal data—an attack assembled entirely in the open.

Political violence expert at the University of Chicago Dr. Robert Pape, recently wrote in a New York Times guest essay, "We may be on the brink of an extremely violent era in American politics."¹ —For those in the protection, intelligence, and privacy space, that statement doesn't feel speculative. It feels overdue.

The Weaponization of Public Data

Data brokers—also called people-search services—have become normalized in modern life. Need to reconnect with a relative? Want to screen a potential tenant? The language makes them sound like convenience tools for responsible consumers.

But that's not how they're always used.

In the Minnesota case, authorities found a handwritten list of 11 such services in the attacker's car. One was marked with a star. He had done his homework. The kill list was organized, sourced, and acted upon using only data that any other consumer could have accessed.

This is the modern OSINT threat: a lawful service used to enable unlawful action. And it's happening across the board—from political actors to fixated individuals to disgruntled insiders. Data aggregation has outpaced data governance with lethal consequences.

The new kill chain doesn’t start with a weapon—it starts with a search bar.

As investigative journalist Byron Tau writes in his book Means of Control, "In China, the state wants you to know you're being watched. In America, the success lies in the secrecy."² The real surveillance threat is not just government overreach—it's the silent, private-sector tracking systems that operate in the background, unrestricted and largely unnoticed.

"Legitimate" Threats from Legitimate Services

The data broker industry operates in a regulatory vacuum. Most companies are governed by outdated consumer protection laws, with opt-out systems designed to frustrate rather than protect. A user may need to submit identity verification documents, manually request removals, and repeat the process every quarter—to keep their personal data from being resold.

Meanwhile, anyone with a motive and a credit card can access your address, voting history, property records, and even the names of your spouse and children.

And the threats are becoming less ideological and more opportunistic. Pape's research points to a dangerous normalization: "Today's political violence is occurring across the political spectrum — and there is a corresponding rise in public support for it on both the right and the left." ¹

Executives, public officials, general counsel, judges—none of them are being targeted for who they are personally. They're being targeted for what they represent. And the path to reach them is made frictionless by an unregulated data economy.

The Electronic Privacy Information Center (EPIC) recently published a report titled Data Broker Harms to Public Officials, warning that "violence against public officials and their families is on the rise."³ The exposure of home addresses and family affiliations isn't just an abstract privacy concern—it's a vector for violence.

As Politico reported in its coverage of the Minnesota attack, "Boelter used online people-search services to find the home addresses of his intended targets."⁴ This wasn't a flaw in national security infrastructure. It was a consequence of unrestricted access to commercial data.

The Converged Risk Landscape Is Already Here

Security leaders deal with converged risk every day—the collapsing of cyber, physical, and reputational threats into a single operational picture. What used to be viewed as distinct domains are now inseparable from one another.

In this case, the attacker didn't need malware, or a firearm purchased through illicit means. He used public records, rental cars, and a law enforcement disguise. The threat didn't start at the front door - It started online.

This is the reality of modern targeting. Your address, your family members, your routines—these are all accessible to those who know where to look and how to connect the dots. Whether it's a violent actor with political motivations or someone radicalized online, the process begins with digital reconnaissance.

Digital exposure is no longer an abstract risk—it's an accelerant.

What Leaders Must Do Now

Privacy is not just a bullet point conversation—it's a security imperative.

Here are three actions leaders and security teams must take immediately:

• Audit digital exposure

  Know what's publicly visible about you and your organization's key leaders. Data broker listings, social media remnants, and personal identifiers must be accounted for and evaluated as part of threat posture.

• Engage in persistent removal

  Opting out once is not enough. Brokers respider and re-list. Protection requires a rolling removal strategy supported by tools and experts who specialize in adversarial search and data suppression.

• Integrate digital risk into protective intelligence

  Threat actors don't separate the digital from the physical. Your security posture shouldn't, either. Intelligence teams must fuse online footprint analysis into route planning, residential security, and event assessments.

This Isn't About Fear. It's About Friction.

No protective strategy is perfect. But the goal isn't perfection—it's friction.

If we make it harder to identify, locate, and track high-risk individuals, we add resistance to the threat actor's plan. And in protection, resistance buys time. Time for detection, time for intervention, and time to prevent tragedy.

The private sector, like the public one, can no longer afford the luxury of viewing privacy as someone else's problem. Security professionals must own this domain, and leaders must resource it accordingly.

Final Thought

The Minnesota attack wasn't new, in kind. It was new in clarity.

It revealed how openly accessible information can be stitched into a plan for violence. It reinforced what we've been warning for years—that digital visibility is physical vulnerability.

Boards should be asking questions. Security leaders should be briefing on exposure, and executives should assume that they are already discoverable until proven otherwise.

Unfortunately, this won't be the last incident like it. But it can be the one that shifts us from reactive regret to proactive response.

Footnotes

1.Robert A. Pape, "Political Violence Is Rising. This Is What We Can Do to Stop It," New York Times, June 16, 2025.

2.Byron Tau, Means of Control: How the Hidden Alliance of Tech and Government Is Creating a New American Surveillance State, Crown, 2024.

3.EPIC (Electronic Privacy Information Center), Data Broker Harms to Public Officials, 2025.

4."Alleged shooter found Minnesota lawmakers' addresses online, court docs say," Politico, June 16, 2025.

And it's not just one site.

Following the United Health Care CEO's murder, digital chatter across platforms such as Reddit, Mastodon, and encrypted channels surged with content glorifying Mangione. One Reddit thread called him the "MLK of anti-corporate America." Meme pages framed his attack as "accountability by other means." Fundraisers for his legal defense attracted thousands of supporters before being pulled offline.

This is a new playbook:

• Target the symbol, not just the system

• Elevate the aggressor as a moral actor

• Use digital infrastructure—data brokers, breach dumps, LinkedIn, Zillow—to expose and shame

• Frame visibility as both protest and punishment

The endgame? Not reform, but disruption, intimidation, or withdrawal.

Digital Exposure as the First Strike

Doxxing was once a tactic associated with fringe forums and hacktivist collectives. Today, it's inching toward mainstream legitimacy in certain online subcultures. Sites like luigiwasright.com use public records and scraped data to create searchable databases of executives, making it easy for anyone with a grievance to find a target.

Let's be clear: This is not civil discourse. This is operational targeting.

While not explicitly encouraging violence, the site (and those like it) lowers the barrier for those who do. It invites a kind of open-source vigilantism, where outrage is converted into action through the availability of information.

What Does This Mean for Corporate Security?

It means that traditional security models are inherently flawed.

Executive Protection is a significant line of effort for any organization. Its future lies in converged risk, where cyber, physical, and reputational domains are integrated and monitored continuously. It's not enough to secure the residence or staff a close protection detail. If the CEO's home is listed on a data broker site, their personal email is in a breach dump, or their children's school appears on social media—they're not secure.

Companies need to operationalize digital risk as a form of protective intelligence.

Key imperatives:

• Preemptive Data Reduction: Scrub executive PII from public records, people-search sites, and breached datasets.

• Sentiment & Threat Monitoring: Track digital chatter for escalation patterns—particularly those framed in moral or populist language.

• Cross-Team Integration: Align physical security, cyber teams, and comms around an executive threat model.

• Education & Simulation: Train principals and comms teams on what to do in the event of a doxxing or swatting incident.

The Moral Fog Ahead

We are entering an era where the threshold for justified outrage is collapsing—and where the tools of exposure are democratized. That doesn't mean every threat is credible. But it does mean the pathways to violence are shorter, quieter, and more ideologically charged than many organizations realize.

Activism once asked questions. Now, it increasingly arrives with answers—and a target.

Some no longer see executives as distant stewards of enterprise. They are symbols, villains, and, in some corners of the internet, legitimate objectives. If luigiwasright.com is any indication, the goal is no longer to petition power but to destabilize it.

We can't stop outrage from manifesting online. However, we can close the visibility gap before it becomes something irreversible.

Lately, I’ve asked myself: Is Moore’s Law still enough?

In our converged world, where digital, physical, and reputational threats are interconnected and the timeline between innovation and exploitation is shrinking, it’s no longer just about raw processing power. It’s about the compounding velocity of change, which led me to another framework: Kurzweil’s Law of Accelerating Returns.

It’s not as widely adopted in security circles—yet.

But it’s just as applicable, and perhaps even more urgent, as we prepare for the next phase of hybrid risk and the response to it.

A Quick Primer: Moore’s Law and Its Role in Security Thinking

Moore’s Law originated with Gordon Moore, co-founder of Intel, who predicted in 1965 that the number of transistors on a chip would double approximately every two years. That prediction proved remarkably accurate for decades, becoming the foundation for how we’ve come to expect consistent, linear (yet steep) advances in computing.

In the security profession—especially cyber—we’ve often referenced Moore’s Law to frame the challenge of keeping up. Faster processors meant more powerful tools for both defenders and attackers. This law influenced everything from encryption standards to surveillance capabilities, AI acceleration, and threat modeling. In executive protection and corporate security, Moore’s Law helped us contextualize the digital expansion of the threat surface: more devices, data, and speed.

But here’s the catch: Moore’s Law is linear. It doubles, yes—but steadily.

The world we’re in now? It’s no longer steady. It’s compounding.

Enter Kurzweil’s Law: The Acceleration of the Acceleration

Ray Kurzweil’s Law of Accelerating Returns suggests that the technological progress rate is accelerating—and doing so exponentially. In simple terms, the curve isn’t just steep—it’s getting steeper, faster.

Kurzweil noted that each new generation of technology builds on the previous one, shortening the time between breakthroughs. It’s not just faster chips; it’s speedier evolution across the board: AI learning curves, automation, biological tech, sensor fusion, and adversarial innovation. Every improvement creates the foundation for the next leap—and the lag time between discovery and disruption shrinks with each cycle.

In security, we’re seeing this play out in real time. Deepfakes weren’t a mainstream concern five years ago—now they’re a factor in threat assessments. AI-driven surveillance was once reserved for nation-states—now startups are selling it as a service. Executive threat actors no longer need to manually track a principal’s location—they can scrape it from fitness data, smart devices, or leaked metadata. This isn’t Moore’s environment anymore. It’s Kurzweil’s.

Why This Matters for Converged Security

In a converged environment—where cyber, physical, and informational domains overlap—Kurzweil’s Law gives us a more accurate lens to assess risk and plan response.

Here’s why:

Threats No Longer Evolve in Silos

Gone are the days when a security team could cleanly separate physical surveillance from cyber recon or reputational manipulation. Threat actors use cross-domain tactics, often leveraging digital signals to enable physical attacks. And because innovation now ripples across domains simultaneously, the time between “new tech” and “new threat” collapses.

Kurzweil’s model forces us to anticipate convergence, not react to it.

Timelines Are Collapsing

The reconnaissance phase of the attack cycle used to take weeks or months. Today, much of it can be automated and completed in hours. Think of adversarial use of AI to scan social media, pull property records, analyze movement patterns, or spoof identities.

Protection planning and threat intel cycles must adapt to this compressed tempo. That requires strategic foresight, not just tactical readiness.

Innovation Is No Longer a One-Way Street

For decades, security professionals had the advantage of technology trickling down slowly. Today, adversaries get access to generative AI, OSINT tools, and surveillance kits at the same time (or before) corporate defenders do. The returns on innovation apply equally to threat actors. Kurzweil’s Law reminds us that every leap forward can be weaponized faster.

“We won’t experience 100 years of progress in the 21st century—it will be more like 20,000 years of progress at today’s rate.”
—Ray Kurzweil

What Does This Mean for the Modern Security Leader?

It means we need to recalibrate how we think about the future. Not just faster, but differently.

Security leaders can’t operate with yesterday’s assumptions about risk velocity or linear response. In the boardroom and the field, we need to communicate and plan through the lens of accelerating returns. That means:

• Building adaptive threat models that evolve with tech, not just tactics.

• Investing in anticipatory intelligence—fusing cyber, HUMINT, and behavioral signals into a real-time picture.

• Elevating digital executive protection to the first line of defense—not the last.

Most importantly, it means shifting from a control mindset to a learning mindset. In Kurzweil’s curve, the only constant is compounding change. Static SOPs and legacy playbooks will be outrun. Continuous learning—organizationally and individually—is the only sustainable edge.

A Final Thought

Moore’s Law served us well. It gave us a frame to understand the march of technology and the demands it placed on our defenses. But it’s no longer sufficient to explain the world we’re operating in.

Kurzweil’s Law isn’t just a futurist’s dream—it’s a pragmatic model for security professionals navigating an era of compound volatility. For those responsible for protecting people, assets, and reputation across converged domains, it offers both a challenge and a call to action.

It’s not just that things are changing fast.

It’s that the change is accelerating.

And the leaders who internalize that—who build for it, plan for it, and communicate it—will be the ones who stay ahead.

In December, a moment of subtle—but significant—strategic signaling occurred at a quiet summit in Geneva. Wang Lei, a senior Chinese official, stopped short of a formal confession but made China's involvement in the Volt Typhoon campaign clear enough for those in the room to understand. [1] It marked a shift—not just in attribution but in posture.

The acknowledgment wasn't about confession—it was about communication. The message was directed not only at governments but also at systems, sectors, and the global infrastructure networks that underpin modern economies.

Infrastructure as Strategic Terrain

The Volt Typhoon campaign, as detailed by U.S. intelligence and reporting, was not about espionage in the traditional sense. It was about embedding persistence within critical U.S. infrastructure—ports, utilities, and telecom systems. [1][2] In effect, it was a quiet occupation of strategic terrain.

This changes the calculus for multinational corporations operating in or adjacent to these sectors. Infrastructure is no longer merely a national asset or logistical function—it has become a geopolitical lever central to executing grand strategy. Whether a company owns, operates, or merely depends on it, it is now a stakeholder in a broader strategic contest.

Cyber Operations as Grand Strategy

Historically, cyber campaigns were treated as espionage or criminal activity, with clear boundaries separating public and private sector responsibilities. However, the Volt Typhoon and the broader Salt Typhoon campaigns are different. These are not standalone attacks—they are strategic positionings.

The logic is familiar to students of statecraft: shape the environment in peacetime to gain an advantage in crisis. As China's posture hardens around Taiwan, its cyber presence in U.S. infrastructure becomes a quiet form of deterrence—not through retaliation but embedded risk—demonstrating that any escalation could trigger consequences far from the battlefield and deep within civilian systems.

Cyber is no longer just a domain of conflict—it's a form of strategic signaling. Multinational companies must learn to read those signals as early indicators of intent, risk, and potential disruption.

Strategic Ambiguity: Risk Without the Flash

The challenge is that cyber threats don't announce themselves with shock and awe. They operate in ambiguity. Their impact is cumulative, and their disruption is latent until activated. For businesses, this ambiguity translates into operational risk that may not register until it's too late.

Consider the implications: What if your manufacturing capacity depends on regional power grids? What if your customer access hinges on telecom infrastructure that's been quietly compromised? What if your logistics platform can be disrupted in parallel with a diplomatic crisis?

These are no longer hypothetical risks. They are persistent features of a globally contested environment.

In this environment, companies must adopt their version of 'defending forward'—anticipating disruption rather than just reacting to it.

The Corporate Response: From Risk to Readiness

Multinational corporations—especially those in energy, transportation, and communications—must reevaluate how they manage infrastructure dependencies. The question is not whether you are a target but how your operational continuity fits into another nation's strategic equation.

Key questions to consider:

• Have we mapped our dependencies on national and regional infrastructure?

• Do our incident response plans account for state-level hybrid disruptions?

• Have we built relationships with public sector stakeholders for intelligence and rapid response coordination?

• Are we prepared for geopolitical events that trigger cascading infrastructure failures across sectors?

Boardrooms must now integrate infrastructure resilience into enterprise risk management frameworks—not only as a business continuity issue but as a competitive and reputational imperative.

A New Role for Private Sector Security

The U.S. response to these developments has been uneven. Shakeups within NSA leadership and potential cuts to cybersecurity staffing have created uncertainty at a time when consistency and coordination are most needed. [3] For companies, this suggests an increasing need to build private-sector capability to detect, assess, and respond to strategic cyber threats. This is particularly true for multinational companies operating in both Western and emerging markets, where infrastructure can be more vulnerable and geopolitical influence more variable.

The implication is clear: corporate security teams must be fluent in geopolitical risk and cyber threat intelligence, not as adjuncts to IT or siloed risks but as core global operations functions.

Final Thought: From Awareness to Strategy

The Geneva meeting highlighted the intersection of statecraft now and infrastructure—and, by extension, corporate continuity. Companies that understand this will move faster, invest smarter, and position themselves more securely in an increasingly volatile strategic environment.

The question is not whether infrastructure will be targeted—that's been answered—but how soon private-sector leaders will recognize that their companies are part of the strategic calculus.

The signal has already been sent. The only question is how we are preparing.

References

[1] Dustin Volz, "In Secret Meeting, China Acknowledged Role in U.S. Infrastructure Hacks," The Wall Street Journal, April 10, 2025.

[2] Reuters, "China's Salt Typhoon cyber operations into U.S. telecom networks included those belonging to AT&T," April 2025.

[3] New York Post, "China acknowledges its role in years of cyberattacks against US over support of Taiwan," April 2025