From boardrooms to backyards.
A located home is attacked, entered or surveilled, using exposed property, vendor or routine information.
More on physical and continuity →Executive Threats · Research Hub 06
All ten executive threats in one table: the risk and severity scores, the digital triggers behind each, and how much exposure reduction changes the picture for each one.
How it happensAddress resolution
Executive Threats · Research Hub 06
The trigger chain from online hostility to targeted violence, four recent cases, why the threat is accelerating, and the counter-moves that remove the most common targeting vectors.
How it happensPathway to targeted violence
Executive Threats · Research Hub 06
The adversary profile, eight case patterns, a typical attack timeline and a thirty-day checklist, for residences and secondary homes that are softer targets than any office.
How it happensResidence targeting
Executive Threats · Research Hub 06
The access loop, six kinds of harasser, five scenario patterns, and the six moves that break the continuity a harasser depends on.
How it happensAddress resolution
Well Regarded, Easy to Reach
A single name search can surface a flattering biography, an old dispute and a current home address, and the 2025 Minnesota shootings showed what an address can enable. This brief separates perception risk, what people believe, from targeting risk, what someone can find and use, and asks why fixing one does not fix the other. Built from court records, a hypothetical filing and ObscureIQ removal work. For principals, family offices and communications leads.
How it happensAddress resolution
A Gaming PC Found Your Front Door
In October 2026 Cisco Talos analyzed VOLTA, Windows malware that steals credentials and sessions, confirms a home address from the victim's own email receipts and has an AI model rank what the person is worth. This brief asks how automated triage changes infostealer risk, why a child's gaming PC or an assistant's laptop can expose a principal, and what an incident response must cover. Built from Talos analysis and related research. For principals, family offices and security teams.
How it happensAutomated target triage
The Attack Starts With a Lookup.
In July 2026 executive protection reporting recorded bombings, arson, burglaries and a swatting aimed at prominent people's homes, and the home was the most frequent physical venue that month. This brief asks how a stranger now finds where a principal lives, why that step escapes physical security, and how to measure and shrink it. Built from a monthly incident catalog, public reporting and a federal affidavit. For principals, family offices and security directors.
How it happensAddress resolution
CB-130 argued that every domain record tied to a principal will eventually be read, and that its contents decide the damage. This annex asks how a family office keeps those records clean over time: how to find every domain, what to look at beyond the public lookup, how to rank what turns up, and how to prove a fix held. Built from registry and ICANN policy and standard lookup tools. For family offices and staff who manage a principal's domains.
How it happensPublic and government records release
Someone Already Knew
Research reported in Harvard Business Review on 26 October 2026 linked stronger working relationships between security and business teams with fewer and cheaper cyber incidents. This brief asks what that finding means for a principal whose earliest warnings may reach a child, an assistant, a driver or an advisor, and how the same trust can be turned against the household. Built from the study, documented impersonation fraud and FBI sextortion guidance. For principals, family offices and their security teams.
How it happensApproach through the circle
CB-293 argued that protection fails when the first person who sees a threat is not connected to the person who can stop it. This annex asks how a household closes that gap: who notices what, who hears it and how fast, which instructions always get checked, and how the path is rehearsed. Built from the brief's five questions and ObscureIQ casework practice. For family offices, security leads and principals.
How it happensApproach through the circle
An annex to CB-288 on AI models with refusal safeguards removed: wrapped jailbreaks, criminal fine-tunes, abliterated open models, hosted unrestricted services and poisoned models. It explains why refusal is cheap to strip, what unrestricted models change for pretexting, research and tooling aimed at a principal, and what they do not change. It closes with questions for households, family offices and vendors, and the controls that hold regardless of model behavior. For security leads and family offices.
How it happensAI-composed claims
CB-292 argued that a principal's information will keep escaping through institutions the principal does not control. This annex asks how a principal's team keeps control when that happens: who decides, what must be verified, and how each protection is proven rather than promised. Built from federal incident response and authentication guidance and joint Five Eyes guidance on AI agents. For family offices, security leads and the principals who authorize them.
How it happensAccount takeover
CB-292-A made a dedicated money-movement device one of its baseline controls for principals with real financial authority. This annex asks what such a device protects, what it leaves open, and what the bank itself must enforce alongside it. Built from long-standing federal fraud guidance, published platform update policy and federal authentication standards. For principals, family offices and the staff who initiate or approve significant payments.
How it happensPayment diversion
Encrypted, and Still Readable
In August 2026 Apple confirmed it is challenging a second secret UK order for access to encrypted iCloud data. This brief asks who can read an end-to-end encrypted conversation once its copies reach cloud backups, on a principal's phone and on the phones of everyone in the thread. Built from provider security documentation, the reported record of the UK orders and documented cases of backup-derived evidence. For principals, family offices and the counsel and staff who hold their threads.
How it happensProvider-held copies
Spyware Can Arrive Through an Ad
On 15 October 2026 researchers published the first public technical confirmation of mercenary spyware delivered through targeted advertising, with no click or other action by the person targeted. This brief asks how the machinery that decides which device sees which ad was turned into a delivery system, and where a principal's devices can be protected before an ad ever loads. Built from two primary research reports and contemporaneous reporting. For security leads and family office technologists.
How it happensExploit delivery
A device protocol behind CB-276 for closing the advertising channel on a principal's phones, computers and networks: four layers of settings and filtering, a verification test recorded for each device and channel, a look back through retained logs, and a thirty-day rollout. Each layer's known gap is stated. For the security lead or family office technologist who has to make the controls hold on real devices.
How it happensExploit delivery