Torchstone’s The Watch in Review: 2025
Each year, we take stock of what security topics resonated with The Watch readers with a review of the most-read pieces over the last year. As always, readers continued to reference our foundational security pieces on the attack cycle, situational awareness, and countering stalkers. These pieces (some of which turned five years old in 2025) are as relevant as ever and will continue to be a valuable resource to our readers.
Good security requires good situational awareness—as well as good situational understanding—which is why we also publish guidance in the lead-up to and following major events to guide our readers on potential shifts in the global security environment. In 2025, our readers expressed interest in our guidance on threats to the presidential inauguration in January and risks associated with social unrest leading up to Al-Quds Day in March. Our analysis of the July 28 Manhattan attack also received significant attention.
Notably absent from the list are our monthly Executive Protection reports. While none of the reports individually cracked the top-ten list, they altogether represented our most popular Watch product and were consistently among the most-read articles each month. We look forward to continuing to provide valuable data and analytics for Executive Protection teams and security professionals through our monthly EP reports.
Looking ahead to 2026, our annual Executive Protection report is in the works and will be available by the end of January. Additional reports throughout the year will look at threats associated with the World Cup (hosted in North America this year), as well as the 250th anniversary of the United States Declaration of Independence.
We’re proud of our work in 2025 and honored that so many readers have relied on our guidance to keep themselves, their families, and employees safe. We look forward to continuing to share our expertise with our readers through The Watch and to being a trusted partner.
Please find a list of the ten most-read articles on The Watch from 2025 below:
- 2025 Presidential Inauguration Threats (January 2025)
Overall, the protest threat to the inauguration appears to be moderate. There have been no signs of a significant protest movement against President Trump manifesting over the past two months since the election. While there is certain to be turnout at the planned protest events, there is no indication that they will be significantly more disruptive than the baseline level of protest activity already present in major U.S. cities. It appears likely that continuing protest campaigns (such as the pro-Palestine protest movement) will incorporate grievances against President Trump and use the inauguration to highlight their existing grievances.
- Annual 2024 Executive Protection Report (February 2025)
The December 4, 2024, murder of United HealthCare CEO Brian Thompson was a seminal moment for the Executive Protection industry, and concerns over executive safety remain high going into 2025. In addition to the murder of Brian Thompson and associated threats against his family, there were seven other incidents of threats against business executives in December 2024—by far the highest number of monthly incidents targeting business executives since we began tracking in May 2023. Preliminary figures for our January 2024 report suggest that the threat against business executives remains high, as social media threat influencers call for more attacks like the one that killed the United HealthCare CEO.
The concept of the “Pathway to Violence” was developed by Frederick Calhoun and Steve Weston in 2003. As I wrote in the piece on the attack cycle, people “don’t just snap” and conduct a terrorist attack or other acts of targeted violence. Attacks are the result of a discernible process—a process Calhoun and Weston’s model divides into six steps.
Situational awareness is more a mindset than a highly refined skill, and anyone can practice it if they have the will and discipline to do so. Discipline and will are critical because complacency, denial, boredom, and distraction often prevent people from practicing the appropriate level of situational awareness for the environment they find themselves in.
Use the acronym TEDD when teaching people to recognize… surveillance conducted by stalkers. TEDD stands for Time, Environment, Distance, and Demeanor. So… if a target sees the same person at different times, in different environments, and over distance, it is likely that they are surveilling (or stalking) the target. It may be difficult for security team members to correlate observing the same people over time, environment, and distance, so databasing observations is critical. Other technological tools, such as automated license plate reader systems (where legal), may also help identify this behavior.
- TorchStone Executive Protection (EP) Training Program (August 2025)
Adequate training from seasoned practitioners is a key distinction between bodyguards and a professional EP team. Whether it’s getting new hires up to speed or sharpening the skills of veterans, a good EP team is a trained EP team. While physical training is a critical component of the job, mental training is what prevents attacks and disruptions from happening in the first place.
The bottom line is that Wint did not just accidentally show up at the residence of the CEO of his former company and kidnap, extort, and murder the CEO and his family. This home invasion was the result of a decade-long process in which Wint harbored and nurtured a grievance, thought about conducting an act of violence, and then planned and prepared for the attack. The process by which an aggrieved individual passes from holding a grievance to conducting an attack is known as the pathway to violence.
- Preparing for Global Protests to Mark Al-Quds Day (March 2025)
Al-Quds Day is observed every year on the last Friday of Ramadan—which this year falls on March 28. The annual tradition began in Iran as a day intended to support Palestine through demonstrations and appeals to political leaders. While the vast majority of Al-Quds Day protests are peaceful and orderly, there is a precedent for anti-Israel and antisemitic sentiment and, occasionally, violence. Iranian leaders frequently use the day to espouse antisemitic ideology and threaten Israel. Organizations and individuals (especially those affiliated with Israel or Judaism) should be aware of Al-Quds Day–related actions and take precautionary measures where necessary.
- Saints, Copycats, and the Continuing Threat to CEOs (February 2025)
The continuing celebration of the murder of United HealthCare CEO Brian Thompson and the veneration of Luigi Mangione raise the very real possibility of copycat attacks. It is also possible that these attacks may involve targets other than CEOs. On January 27, a Massachusetts resident was arrested at the U.S. Capitol after being found in possession of a folding knife and two Molotov cocktails. The individual told arresting Capitol Police officers that they had traveled to Washington to kill then–Treasury Secretary nominee Scott Bessent, other Trump administration officials, and to burn down the Heritage Foundation office. They also claimed that they were inspired to take action by Luigi Mangione’s murder of Brian Thompson.
- Manhattan Attack: July 28, 2025 — Lessons Learned (August 2025)
Like the attacks that came before it, the July 28 shooting in Manhattan should serve as a learning opportunity for companies and individuals. The biggest lesson is the importance of using existing security measures effectively. In this case, that meant using designated safe havens and creating safe havens with the materials available. It is also critical to shelter in place in those safe havens until it is clear that it is safe to come out. Do not send a potential victim to “check if the coast is clear.” Hunker down as long as it takes until police or responding authorities confirm that it is safe to leave, either directly through responding law enforcement officers, via a building’s public address system, or by cell phone or another communication system.