The new ANSI executive protection standard represents an important milestone for the profession. The next challenge is turning those standards into repeatable protective operations. 

I spent much of my professional life as an agent with the United States Secret Service, where I learned that effective protection is rarely defined by what the public sees. 

The agents and officers supporting a protectee are the visible part of a much larger protective system. Behind every movement is a coordinated activity of advance work, intelligence collection and assessment, site surveys, liaison with law enforcement and other security partners, communications, logistics, contingency planning, clearly defined responsibilities, and the continual reassessment of risk. Those activities are ingrained in how we approach the protective mission, and it is not so much an event as it is a continuous process. 

The Secret Service certainly helped establish many of the principles that have influenced modern executive protection, but that legacy is not simply a collection of protective tactics. It is a disciplined approach in which intelligence, planning, operations, coordination, documentation and reassessment continuously inform one another – in other words, a methodology. 

That methodology has taken on even greater importance as the threat environment facing corporate executives has evolved. The December 2024 targeted assassination of UnitedHealthcare CEO Brian Thompson in New York was a particularly stark reminder that corporate leaders can themselves become targets. The incident prompted many organizations to reassess executive risk, protective intelligence and the level of protection afforded to senior leaders and, in some cases, their families. 

But the Thompson assassination should not be viewed as an isolated event. Executives today operate in an environment shaped by increasingly polarized public discourse, online grievances, fixation on individual leaders and companies, misinformation and disinformation, doxxing, and the ability of individuals to move rapidly from online rhetoric to real-world action. For security leaders, the implication is clear: executive protection increasingly requires a more integrated and continuous understanding and management of risk. 

It is against this backdrop that the approval of ANSI/BEPP EPS 2026 – Standard for Providing Executive Protection is particularly timely. 

The private sector executive protection profession now has something it has never had before: a nationally recognized professional standard providing a common framework for how executive protection should be planned, delivered, managed and evaluated. 

The significance of that accomplishment should not be understated. The work behind ANSI/BEPP EPS 2026 required years of effort and building that kind of consensus is difficult to achieve in any industry, and perhaps especially so in executive protection, where practices have historically been influenced by different government agencies, corporate programs, training organizations and individual practitioner experience. The individuals who volunteered their time and expertise to develop the standard deserve considerable credit for moving the profession forward. 

And now with this important standard in place, the question becomes: how should organizations put this framework into practice? 

From Professional Standards to Operational Practice 

ANSI/BEPP EPS 2026 organizes executive protection around eight Domains of Knowledge:

  • Executive Protection Fundamentals
  • Intelligence
  • Information Security
  • Planning
  • Operations
  • Legal
  • Business and Administrative Practices
  • Executive Protection Leadership

Anyone who has spent significant time in protective operations will recognize how interconnected these disciplines are. Intelligence informs planning, and planning drives operations. Operations generate new information, which in turn must be appropriately documented and evaluated. Changes in the threat environment require continuous reassessment. Leadership needs visibility across the entire process while ensuring that policies, resources and operational decisions remain aligned with organizational responsibilities. 

Clearly, these domains cannot operate effectively as eight separate disciplines. Together, they form a protective ecosystem. This is also where technology can play an increasingly important role. 

And while professional standards can establish what good executive protection should look like, security organizations still need a way to translate those principles into repeatable workflows, assignments, assessments and records, all with the goal of supporting operational decisions. 

This is the difference between having a standard and operationalizing a standard. 

Three Pillars of the Modern Protective Mission 

At Kaseware and OSINT Combine, we have been thinking a great deal about this challenge as we prepare to introduce a dedicated Executive Protection tenant within our investigative and intelligence platform. 

Our approach organizes the protective mission around three interconnected operational pillars: 

  1. Protective Operations Planning & Logistics
  2. Real-Time Protection & Situational Awareness
  3. Protective Intelligence & Continuous Monitoring

We developed these pillars around the practical lifecycle of executive protection. What is particularly interesting considering ANSI/BEPP EPS 2026 is how naturally they intersect with the standard’s eight domains. 

Pillar One: Protective Operations Planning & Logistics 

The first pillar encompasses the extensive preparation that occurs before a protective movement or event, such as travel and event notifications, hotel and venue surveys, airport and FBO assessments, itineraries, transportation, communications, hospital surveys, team assignments, resource allocation, contingencies and other operational planning. 

This pillar most directly supports the Planning and Operations domains, while also drawing heavily upon Executive Protection Fundamentals, Legal, Business and Administrative Practices, and Executive Protection Leadership.  

And this is where the EP standards become operational through assignments and actions. Who is responsible for the advance? Has the venue assessment been completed? What vulnerabilities were identified? What resources are required? What contingencies have been established? Who owns each mitigation measure? Have the necessary approvals occurred? 

Those questions may sound administrative, but collectively they represent something much more important: operational discipline and accountability. 

Pillar Two: Real-Time Protection & Situational Awareness 

Once a protective operation begins, the environment becomes dynamic. Schedules change, routes change, demonstrations emerge, weather affects planned movements, a person of concern appears near a venue arrival point, a security incident occurs at a hotel or corporate facility, or intelligence received during an operation may change the risk picture. 

The second pillar, therefore, aligns closely with the ANSI/BEPP domains of Operations, Intelligence, Information Security, and Executive Protection Leadership. The objective is to give the protective team an operational picture while maintaining appropriate controls over sensitive information. 

Situational awareness has limited value unless it can inform operational action. Information needs to reach the right people, at the right time, and in the right context. Significant developments also need to be captured so they can inform key decisions and future operations. 

Pillar Three: Protective Intelligence & Continuous Monitoring 

The third pillar may represent one of the greatest advancements in modern executive protection. 

Protection doesn’t begin when the motorcade moves or when the protectee arrives at an event. Today’s protective environments require a continuous understanding of the threats involving the protectee, family members where appropriate, residences, workplaces, travel destinations, event venues and other locations associated with the protective mission. 

The heightened threat environment makes this particularly important. Threats that begin online can develop well before a protective movement is planned. A grievance, threatening communication, fixation on an executive, unusual interest in a company event, or activity surrounding a residence or workplace may represent pieces of a larger threat picture. The ability to identify, connect, assess and appropriately escalate those pieces has become an increasingly important component of the protective mission. 

This makes Intelligence the most obvious ANSI/BEPP domain associated with this pillar, but it also intersects substantially with Information Security, Planning, Operations, Legal, and Executive Protection Leadership. 

Within the Kaseware and OSINT Combine environment, this can include executive risk profiles, persons of concern, threat assessments, investigative information, open-source intelligence, location-based continuous threat monitoring, and workflows for escalating information requiring further assessment or protective action. 

Importantly, protective intelligence is not simply about collecting more information. It is about connecting information in a way that supports critical decisions. 

The Protective Lifecycle 

These three pillars should not be viewed as independent capabilities. Together, they form a continuous protective lifecycle: 

Intelligence – Plan – Protect – Document – Assess – Adapt 

With the above in mind, consider something as fundamental to executive protection as a protective advance. 

During a protective advance, vulnerabilities may be identified and the subsequent mitigation measures are incorporated into the operational plan. Open-source intelligence collection may identify a person of concern with an exaggerated interest in the protectee or event. That in turn changes the threat assessment, which may require resources, procedures or other elements of the plan to change as well. And during the event, additional information may emerge, and that information becomes part of the operational record and informs future assessments. 

The cycle begins again, but each time it is informed by both historical and real-time information. That kind of interconnectedness is one of the most important lessons I carried from the Secret Service into the private sector. ment information sharing is not simply to move more data between organizations. It is to make relevant information usable across organizational boundaries while maintaining appropriate security, access control, and accountability.

The Digital Advance 

For decades, executive protection professionals have generated enormous amounts of information through the advance process: site surveys, maps, emergency contacts, routes, hospitals, intelligence data, schedules, assignments, communications plans and contingencies. 

Historically, much of that information has resided in binders, spreadsheets, emails, shared drives and, perhaps most importantly, in the institutional knowledge of experienced personnel. Our modern threat environment increasingly makes that approach inadequate. 

An advance should not simply produce a document. It should create an operational record connecting the protectee, itinerary, locations, intelligence, persons of concern, vulnerabilities, assignments, mitigation measures, incidents and subsequent assessments. 

And that record shouldn’t be static. It should evolve as the protective environment changes, with the lessons and information from one operation helping to inform the next: a digital advance.

A System of Record for Executive Protection 

This concept is central to what we are building at Kaseware and OSINT Combine. 

Our objective is not to replace the judgment or experience of trained protective professionals. Technology itself cannot conduct an advance, evaluate human behavior or make the nuanced decisions required during a rapidly changing protective operation. What technology can do is help support and enable good protective practices. 

A dedicated Executive Protection platform can provide a system of record for the protective mission, connecting intelligence, planning, operations, people, locations, assessments, tasks, incidents and decisions within a collaborative operating environment. 

This becomes particularly important as organizations consider the implications of nationally recognized executive protection standards. While ANSI/BEPP EPS 2026 is voluntary, the existence of a nationally recognized standard introduces an important consideration for corporate executive protection programs: the ability to demonstrate not only what was done, but how protective decisions were made. 

After a significant incident, for example, organizations may face some very basic but important questions:

  • What did you know?
  • When did you know it?
  • How was the risk assessed?
  • What actions were recommended?
  • Who made the decision?
  • Were those actions completed?
  • What changed afterward?

Answering those questions requires more than good intentions or institutional memory. It requires documentation, accountability and a defensible record of decision-making. 

Technology Must Support the EP Tradecraft, Not Replace It 

There is understandable energy today around artificial intelligence and other emerging technologies within corporate security. But technology should enable, and never replace, the protective methodology itself. 

A sophisticated intelligence platform cannot compensate for a poorly conducted advance. Artificial intelligence cannot replace the judgment of an experienced protective intelligence professional. A dashboard cannot substitute for clearly defined responsibilities or a properly developed contingency plan. 

What technology can do, however, is connect those activities so that information discovered in one part of the protective organization becomes actionable in another. That is ultimately what our three-pillar model is intended to accomplish. 

Protective Intelligence & Continuous Monitoring: Helps organizations understand historical and evolving risk. 

Protective Operations Planning & Logistics: Turns that understanding into preparation. 

Real-Time Protection & Situational Awareness: Carries that preparation into the operational environment. 

The information generated during the operation feeds back into intelligence and future planning. And while the technology supports the cycle, the protection professional remains at its center. 

Our Profession Evolves 

ANSI/BEPP EPS 2026 is, in many respects, another important step in the evolution of a profession influenced by organizations such as the U.S. Secret Service and Diplomatic Security Service, and by generations of experienced professionals from civilian, law enforcement and military backgrounds who, over decades, have brought that experience into the private sector. 

For much of its history, executive protection relied heavily on individual experience, organizational tradition and knowledge passed from one practitioner to another. Those things remain enormously valuable. But a mature profession also requires common standards, repeatable processes, accountability and the ability to learn institutionally rather than individually. 

ANSI/BEPP EPS 2026 provides an important piece of that foundation. The opportunity now is to operationalize it. 

During my Secret Service career, I learned that successful protection was rarely the result of a single action. More often, it was the product of hundreds of disciplined actions taken before, during and after an operation: intelligence and information evaluated, advances completed, vulnerabilities identified, contingencies considered, responsibilities assigned, and risks continually reassessed. 

The publication of the first American National Standard for executive protection provides the private sector with an opportunity to institutionalize many of those same principles within a modern professional framework. 

This is also the philosophy behind the Executive Protection capability we are introducing at Kaseware and OSINT Combine: technology intended to support, not replace, protective expertise, within an operating environment designed to help experienced professionals apply that expertise consistently, collaboratively and at scale. 

Our profession now has a standard — the next challenge is turning that standard into daily practice. 

More Resources on Protective Intelligence:

Schedule a demo to learn how Kaseware can support connected investigative information and workflows across your organization.