Protective Intelligence: Understanding Threat

Protective Intelligence: Understanding Threat.

Protective Intelligence identifies, assesses and develops an understanding of threats to people, families, organisations, locations, events, assets and operations. It supports timely, proportionate and defensible decisions through the integration of intelligence, evidence and continual risk assessment.

Understanding the threat before it becomes an incident

An incident may be the first visible indication that an organisation, its personnel, assets or operations are being targeted.

It does not necessarily represent the beginning of the threat.

Preparatory activity, hostile intent, surveillance, information gathering, behavioural changes or attempts to gain access may precede an incident by days, weeks or considerably longer.

Understanding what is happening, why it happened, who or what may be responsible, and what may happen next is fundamental to Protective Intelligence.

Specialist Investigative Support (SIS) provides operational Protective Intelligence where organisations, private individuals, families, executives, locations, events or operations face actual or potential adverse targeting, and where the nature, origin, intent, capability or development of a threat is not sufficiently understood.

The objective is to reduce uncertainty, identify opportunities for proportionate early intervention and support decisions before circumstances dictate reactive responses.

From incident response to understanding threat

Organisations may respond to an incident by increasing security, restricting access, reviewing procedures, commissioning an investigation or engaging law enforcement.

Those measures may be wholly necessary and appropriate.

An effective response to an incident does not necessarily establish whether the underlying threat has been identified, understood or resolved.

A threat actor(s) responsible for hostile activity may retain both intent and capability after an immediate incident has concluded.

SIS examines the wider threat environment rather than treating the incident as an isolated event.

We establish what is known, what remains uncertain, what information is required and what developments may indicate escalation or a change in behaviour.

Our Protective Intelligence investigations provide the basis for protective strategies directed by intelligence and evidence, rather than by the availability of security resources alone.

Identifying and assessing threat

A threat assessment requires more than identifying a person, group or circumstance of concern.

We consider the relationship between intent, capability, opportunity, access, targeting behaviour and the vulnerabilities of those potentially exposed.

Intent concerns the apparent objectives, motivations or desired outcomes of a potential threat actor.

Capability considers the means, knowledge, resources and practical ability to act.

Opportunity and access concern the circumstances through which a threat might be realised, including physical, organisational, technical or personal vulnerabilities.

Behaviours may provide indicators of preparation, persistence, fixation, escalation, adaptation or disengagement.

SIS assesses these factors in context, alongside the reliability of available information, alternative explanations and the potential consequences of error.

Not every concerning behaviour establishes hostile intent. 

Equally, the absence of an overt incident does not necessarily establish the absence of threat.

We distinguish between suspicion, credible indicators, assessed intelligence and demonstrable fact, recognising the different levels of confidence and evidential significance associated with each. 

The resulting threat based assessment is not static. Threat, vulnerability and exposure can change as circumstances develop.

Protective Intelligence for individuals and families

Protective Intelligence is equally relevant to private individuals, families and those whose personal circumstances expose them to adverse or hostile targeting.

Threats may arise through obsessive / fixated behaviours, intimidation, blackmail, hostile surveillance, coercive behaviour, stalking or attempts to gain access to an individual through family members, associates, work or routine activities.

These circumstances can involve complex behavioural, personal and environmental considerations. 

An individual may face a credible threat without a clear understanding of its origin, motivation or potential development.

SIS seeks to establish the nature and credibility of the threat, assess intent and capability, identify vulnerabilities and support proportionate protective and intervention options.

Where appropriate, this may involve discreet intelligence collection, specialist behavioural assessment, protective surveillance, investigation or coordination with existing security arrangements, legal advisers and relevant authorities.

Our objective is to understand the threat sufficiently to identify effective, proportionate measures that protect personal safety while preserving privacy, independence and quality of life wherever practicable.

Protective strategies must also account for the lifestyle, preferences and circumstances of the individual being protected. Measures that are excessively restrictive, impractical or incompatible with normal activities may be disregarded or circumvented, creating vulnerabilities that the protective arrangements were intended to reduce.

Information is not intelligence

Organisations increasingly possess substantial volumes of information.

Incident reports, security records, communications, digital material, open-source reporting, witness accounts and operational observations may all contribute to understanding a developing threat.

Their availability of information does not automatically make it intelligence.

Information must be evaluated for relevance, reliability, credibility and context. Sources may be incomplete, mistaken, misleading, compromised or deliberately deceptive.

SIS develops intelligence through structured collection, evaluation, corroboration and analysis against defined requirements.

The purpose is to resolve uncertainty sufficiently to support informed decisions.

An effective intelligence requirement identifies what the organisation needs to understand, why that understanding matters and which decisions it is intended to inform.

Collection can then be directed towards identified gaps and exploitation of assessed intelligence opportunities rather than continuing without a defined operational purpose.

Artificial intelligence and analytical limitations

Artificial intelligence and automated analytical systems can significantly increase the speed and volume of information collection, processing and analysis.

However, the ability to identify patterns, associations or anomalies does not, in itself, establish their significance, intent, reliability or evidential value.

AI-generated assessments may contain inaccuracies, unsupported inferences or misleading associations. Automated outputs may also lack sufficient transparency concerning the underlying sources, analytical process, contextual understanding or limitations.

A system detecting potentially concerning behaviours does not necessarily establish hostile intent. 

Where intelligence or evidence may inform consequential decisions, the reliability, provenance and limitations of the material must be understood, with appropriate human oversight, assessment and verification.

Technology can support intelligence development. It does not remove the requirement for professional judgement, accountability or defensible decision-making.

Where appropriate, SIS can employ specialist investigative and covert operational capabilities to develop the intelligence picture beyond information already available to the client.

These capabilities are selected according to the requirement, operational necessity, legitimate purpose, legality and associated risk.

Intelligence informs decisions. Evidence defends them.

Intelligence and evidence perform different but connected functions.

Intelligence supports an assessment of what may be happening, what it may mean and what could happen next.

Evidence establishes what can be demonstrated.

An intelligence assessment may be sufficient to justify immediate protective action, particularly where delay could expose people to significant harm.

That assessment does not automatically establish the factual basis required for subsequent legal, regulatory, disciplinary or other consequential decisions.

Consider an organisation receiving credible intelligence suggesting that an employee is facilitating hostile access to sensitive information.

The intelligence may justify immediate protective measures, restrictions, monitoring or further investigation.

If the organisation subsequently intends to pursue dismissal, litigation, criminal referral or regulatory action, the evidential requirements may be substantially different.

The provenance, integrity, reliability, preservation and disclosure implications of material may become critical.

SIS considers potential evidential requirements from the earliest appropriate stage, ensuring intelligence collection and protective decisions do not unnecessarily compromise subsequent investigative, legal or regulatory options. 

This does not mean every threat assessment must become a formal investigation.

It means that decisions about collection, handling and intervention should preserve legitimate future options wherever practicable.

Without intelligence, an organisation may fail to understand a developing threat in time to act.

Without sufficient evidence, it may struggle to demonstrate the factual basis for consequential decisions made in response.

Risk is not static

Risks can change as information becomes intelligence, intelligence is developed, evidence is established and decisions are made.

Importantly, the activities undertaken to understand or mitigate a threat can themselves create additional risk.

Intelligence collection may influence behaviour, expose operational interest or compromise sensitive sources.

An investigation may create legal, evidential, reputational or organisational consequences.

Intervention may reduce immediate vulnerability while causing a threat actor to change methodology, identify alternative targets or escalate.

Delay may preserve an intelligence opportunity while allowing exposure to continue.

A decision not to intervene may be proportionate and justified, but it is not necessarily without consequence.

SIS does not consider risk as the final stage of an intelligence or investigative process. It is present and must be considered throughout.

We continually assess both the threat being examined and the consequences of the methods and decisions employed in response.

The intelligence requirement, collection strategy, evidential requirement and risk assessment must remain connected.

When circumstances change, those requirements may need to change with them.

Protective measures are not necessarily threat mitigation

Physical protection can be essential.

Close protection, residential security, access controls, protective surveillance, counter surveillance, TSCM and other security measures may significantly reduce vulnerability.

However, reducing vulnerability is not necessarily the same as reducing hostile intent or capability.

A determined threat actor may adapt to protective measures by changing behaviour, location, timing, methodology or target.

A successful security intervention can create a misleading impression that the threat itself has been resolved.

Protective Intelligence seeks to establish whether an intervention has reduced the underlying threat, altered its manifestation or merely displaced the opportunity for harm.

This distinction is particularly important where organisations rely heavily on overt security arrangements. The objective is not to replace physical protection.

It is to ensure protective resources are informed by intelligence, directed towards assessed risks and reassessed as the threat environment develops.

Where immediate physical protection is necessary, it may operate alongside continued intelligence development and investigation.

Specialist operational capability

Protective Intelligence may require capabilities extending beyond open-source research, routine security assessment or conventional fact-finding.

Depending on the circumstances, SIS can draw upon specialist government-trained personnel and operational experience across intelligence, investigative and protective environments.

Capabilities may include covert and protective surveillance, specialist behavioural detection, counter-surveillance, counterintelligence, technical surveillance, technical surveillance countermeasures and specialist covert human intelligence activity.

These capabilities support defined intelligence, evidential and protective requirements.

Their availability does not, in itself, justify deployment.

Our operational activities must have a legitimate purpose and are assessed for necessity, proportionality, legal considerations, collateral consequences and the availability or adequacy of less intrusive alternatives.

SIS coordinates these capabilities through its Intelligence, Evidence and Risk framework, maintaining operational accountability, continuity and integration with the wider client requirement.

Further detail is provided in our Specialist Covert Operational Support (SCOS) Knowledge Centre article.

Mitigation, intervention and defensible decisions

Identifying a threat is not the same as mitigating it.

SIS assists organisations determine what action is necessary, when intervention is appropriate and what consequences may follow.

Options may include enhanced protective measures, further intelligence collection, investigation, safeguarding, changes to operational arrangements, legal remedies, regulatory engagement or referral to law enforcement.

Some circumstances demand immediate action based upon the best intelligence available at that time.

Others permit further evidential development before consequential decisions are made.

There is an important distinction between an informed decision and a defensible decision.

An informed decision responds to what is known at the time.

A defensible decision must also be capable of subsequent explanation and justification: what was known, what remained uncertain, what alternatives were considered, why the action was necessary and proportionate, and what risks and consequences were anticipated.

This is particularly important where decisions may later be examined through litigation, regulatory proceedings, employment processes, independent investigation or public scrutiny.

Time may change the intelligence picture, but it does not remove the need to account for decisions taken on the information available at the time.

Intervention changes the environment

Intervention is not necessarily the conclusion of Protective Intelligence activity.

A legal intervention may secure compliance or provoke escalation.

A change in organisational procedures may close one vulnerability while creating another.

A threat actor may disengage, adapt, relocate, become more covert or redirect attention towards another target.

Consequently, mitigation requires continued assessment.

Following intervention, SIS supports organisations establish whether the intended objective was achieved, whether the threat has been reduced or displaced, what vulnerabilities remain and whether further action is justified.

The measure of effectiveness is whether the activity has materially improved the organisation’s understanding, reduced exposure, mitigated risk or supported the next necessary and defensible decision.

Protective Intelligence for locations and events

SIS also supports the assessment and management of threats affecting premises, venues, public events, private functions, critical operations and other locations where people, assets or activities may be exposed to adverse targeting.

These environments present particular challenges.

The threat may not be directed towards an identified individual. It may concern a location, event, organisation, activity or symbolic target.

Exposure may be temporary, as with a public event, or continuous, as with a corporate headquarters, sensitive facility or operational site.

We can support the identification of potential hostile interest, assessment of intent and capability, examination of vulnerabilities and development of intelligence-led protective strategies.

Specialist behavioural detection, protective surveillance, counter-surveillance and other operational capabilities may support these requirements where justified and appropriate.

The intelligence requirement should reflect the particular location, event, operating environment and consequences of a potential incident.

When protective measures change risk

Access controls may reduce vulnerability at a particular entrance while displacing exposure to queues, public approaches, adjacent locations or other less protected areas.

An overt security presence may deter hostile activity, but may also influence behaviour or cause a potential threat actor to adapt.

Changes to an event’s operating arrangements may reduce one vulnerability while introducing another.

We provide assessment of these consequences and the continual reassessment of protective arrangements.

The relevant question is not simply whether additional security has been introduced.

It is whether the measures have materially reduced the assessed risk, whether vulnerabilities have been displaced and whether the response remains appropriate to the developing threat environment.

Martyn’s Law and protective security responsibilities

The Terrorism (Protection of Premises) Act 2025, commonly known as Martyn’s Law, establishes a statutory framework for protective security at qualifying premises and events.

Its requirements depend on the relevant statutory provisions, qualifying criteria and commencement arrangements.

Protective Intelligence is not itself a statutory requirement under the Act, nor does commissioning a Protective Intelligence assessment automatically demonstrate compliance.

However, the principles of threat awareness, vulnerability assessment, proportionate protective measures and continual review are relevant to organisations responsible for the safety and security of premises and events.

Protective Intelligence can complement established protective security arrangements by developing a better understanding of potential threats, identifying changes in the threat environment and informing decisions about protective resources.

The objective is to identify vulnerabilities, mitigate potential harm and support effective protection rather than simply the introduction of additional controls.

SIS: Intelligence, Evidence, Risk

SIS applies an integrated Intelligence, Evidence and Risk (IER) framework derived from specialist government intelligence, investigative and protective practice and adapted to UK commercial, legal and organisational environments.

The framework connects intelligence requirements, specialist collection, evidential development, operational decision-making and continual risk assessment.

Intelligence develops understanding of the threat, its potential development and the options available.

Evidence establishes what can be demonstrated and supports consequential decisions and intervention.

Risk informs strategy, operational methods, proportionality, resource allocation and the consequences of action or inaction.

These are connected functions, not isolated stages.

Engagement may be appropriate where adverse targeting is suspected but not understood, where existing protective measures have not resolved concerns, where an emerging threat requires specialist intelligence collection, or where protective decisions may lead to significant legal, operational or personal consequences.

An instruction begins by establishing the client’s concern, the decisions requiring support and the intelligence or evidential gaps that need to be addressed.

Depending on the requirement, SIS may provide an initial threat assessment, targeted intelligence development, specialist operational support, evidential reporting supporting formal processes or continuing assessment as circumstances evolve.

Findings and recommendations are communicated in a form appropriate to the client’s operational, legal or protective requirements, enabling informed decisions and proportionate action.

Our objective is to provide the intelligence, evidence and continuing assessment necessary for clients to make timely, proportionate and defensible decisions.

Intelligence informs. Evidence defends. Risk determines strategy.

Back to Protective Intelligence

Intelligence. Evidence. Risk.

Specialist Investigative Support. 

August 2026.

NPSA – Protecting Your Assets