2024 Review: The Watch
As we welcome 2025, we take the opportunity to also reflect on 2024 and highlight the most-read articles on TorchStone’s, The Watch. As readership for The Watch grows, our foundational pieces from years past remain as relevant today as they were when we published them. The top five most-read articles from 2024 are classic, foundational introductions to basic personal security principles that define TorchStone’s dedication to protective intelligence.
Those foundational articles include guides to situational awareness, understanding how attacks develop, and recognizing an attack before it happens. Recognizing and preventing an attack is always preferable to responding to an attack already underway, a principle that highlights our corporate identity, which is that we are in “The Business of Before.”
To supplement these foundational pieces on personal security, several of our analyses of current events captured our readers’ attention. The December 4 murder of UnitedHealthcare CEO, Brian Thompson, in New York, highlighted a worst-case scenario of what can happen when individuals or companies become complacent regarding the basics of protective intelligence and security.
Fortunately, this year’s presidential election cycle has been much more peaceful than 2020/2021, but we cannot dismiss the threat of future violence—particularly on Inauguration Day when multiple groups are planning to protest across the country. Stay tuned for our forthcoming assessment of threats surrounding the Presidential Inauguration.
Finally, our update on trends we identified during the first six months of publishing our executive protection monthly report rounded off the most-read list. We will continue to publish our monthly Executive Protection report and share insights on trends and statistics based on our data collection. We look forward to publishing our first annual executive protection report, which will be for the year 2024, by the end of January 2025.
We’re proud of our work from 2024 and honored that so many readers have looked to us for guidance on keeping themselves, their families, and their employees safe. We will continue to share our expertise with our readers through The Watch and look forward to hearing your thoughts.
Please find a list of the ten most-read articles on The Watch from 2024 below:
Situational awareness is more a mindset than a highly refined skill, and anyone can practice it if they have the will and discipline to do so. Discipline and will are critical because complacency, denial, boredom, and distraction often prevent people from practicing the appropriate level of situational awareness for the environment they find themselves in.
The concept of the “Pathway to Violence” was developed by Frederick Calhoun and Steve Weston in 2003. As I wrote in the piece on the attack cycle, people “don‘t just snap” and conduct a terrorist attack or other acts of targeted violence. Attacks are the result of a discernable process, a process Calhoun and Weston’s model divides into six steps.
Use the acronym TEDD when teaching people to recognize… surveillance conducted by stalkers. TEDD stands for Time, Environment, Distance, and Demeanor. So… if a target sees the same person at different times, in different environments, and over distance, it is likely that they are surveilling (or stalking) the target. It may be difficult for security team members to corollate observing the same people over time, environment, and distance, so databasing of observations is critical. Other technological tools such as automated license plate reader systems (where legal) may also help identify this behavior.
The bottom line is that Wint did not just accidentally show up at the residence of the CEO of his former company and kidnap, extort, and murder the CEO and his family. This home invasion was the result of a decade-long process in which Wint had harbored and nurtured a grievance, thought about conducting an act of violence, and then planned and prepared for the attack. The process by which an aggrieved individual passes from holding a grievance to conducting an attack is known as the pathway to violence.
Most criminals have poor surveillance tradecraft. Yet, the reason they are able to succeed in their crimes despite their ineptitude at this critical skill is that the majority of people simply aren’t looking for surveillance and therefore miss even awkward surveillance efforts.
While this attack is cause for concern, it is not cause for panic. Attacks like the one that took Mr. Thompson’s life are preventable. It appears that Mr. Thompson did not have security. While many CEOs forgo a protection detail as part of their day-to-day routine, Dec. 4 was no ordinary day for Mr. Thompson. The shooter attacked Mr. Thompson as he was on his way to the UnitedHealthcare Investor Conference at the Hilton Midtown. It was a major event that had been public for at least the past week. Such high-profile events that require travel (UnitedHealthcare is based in Minnesota) typically justify elevated security support for an executive. While today’s attack was a worst-case scenario, even mundane issues like transportation logistics and muggings can derail an executive’s day. Especially when an investor conference is on the line, what happens to a CEO can and does impact the entire company.
The process of consciously observing, orienting, deciding, and acting—the OODA Loop—creates links between an awareness of one’s surroundings in a dangerous situation and the actions necessary to escape it by staying one step ahead of an adversary. Because of this, I consider OODA to be the bridge that connects situational awareness with action.
While a repeat of January 6 is unlikely, disruptive protests and general social unrest surrounding the 2024 election process remain likely. Companies with personnel and/or assets near the locations outlined in the report should start planning and communicating contingency plans now in the case of social unrest. Security professionals should also use the election process calendar to anticipate when unrest is most likely and to help assess how local dynamics may contribute to unrest.
The COVID-19 pandemic only exacerbated the rate of attacks and financial losses as employees worked on more vulnerable home networks. Criminals exploited the confusion of the pandemic to take advantage of more victims. Even as the pandemic recedes and employees return to offices, there are no indications that the rate of cyber-attacks will decrease anytime soon. Fortunately, major losses associated with cyber-attacks are preventable, and understanding how these attacks work is a major component of prevention.
As shown in the graph below, the home has the most diverse set of threats, reinforcing the importance of prioritizing home security. Public areas are similarly more likely venues for aggressive tactics such as harassment and attacks. Basic security measures at offices and restricted events appear to reduce the number of violent incidents, but harassment is a concern. Protesters often target private events and closed meetings to voice their disapproval of political or business decisions. Digital/online incidents mostly consist of verbal or written threats, typically posted on social media, but cyberstalking is a concern to watch online.
