Inside the Rise in Executive Targeting—A Conversation With Bob Hayes

For years, security leaders have warned that the risk environment is changing. Civility is eroding, rules are being ignored more often, and behaviors that used to feel rare have moved from the exception to the pattern.

Now, the data is catching up. The Security Executive Council’s latest research on executive targeting shows incidents have climbed 313% over two years, with individual categories rising between 150% and 450%. The motive profile has shifted, too, with activism overtaking criminal intent as the leading driver. And the target set has broadened well beyond the C‑suite.

In this episode of The Employee Safety Podcast, Bob Hayes, Managing Director and founder of the Security Executive Council (SEC), joins Peter Steinfeld to share what the SEC’s research reveals about executive exposure today—from the “broken windows” progression that led them here, to the practical steps security teams can take now.

You can listen to the full interview below, or follow The Employee Safety Podcast on Spotify or Apple Podcasts.

Q&A With Bob Hayes, Managing Director and Founder, Security Executive Council

Over the past couple of years, what changes in the risk environment have stood out most to you?

There’s a continual shift in the risk environment, and it varies by industry and sector. But the change that affects everyone is a shift in perceptions of safety. We can’t say it was caused by COVID, but around 2019–2020, that’s when we first noticed that people’s perceptions of and concerns about safety were changing. And the underlying cause was a new risk and threat profile for many organizations.

Your team has connected a line from incivility to social disorder to executive targeting. Walk us through that progression.

It started with incivility—people behaving differently. More rudeness in grocery stores, conflicts in parking lots, road rage, fights at kids’ sporting events. Youth leagues couldn’t find umpires and coaches because of parental abuse. Eventually, the Society for Human Resource Management (SHRM) published a civility score showing that millions of acts of incivility happen in the American workplace every day, costing businesses more than $2 billion a day.

My undergraduate degree was in criminal justice, and there was a figure named O.W. Wilson who wrote about what he called the broken windows theory—that if you deal with the small things, you impact the larger, more significant crimes. What we were seeing looked like another example of that theory: bad personal behavior leading to worse things.

From incivility, we moved to what we call social disorder—passenger misconduct on flights, OSHA-reportable intentional injuries, hit-and-run accidents, people running from police—and every longitudinal study we found showed those numbers rising. From social disorder, we moved to threatening behaviors and violence, where we found 12 or 13 studies pointing in the same direction. Then our clients and partners started telling us they were seeing a lot more threats against executives and other key figures. That’s what led to the executive-targeting work.

What were the top takeaways from the new executive-targeting research?

Three things really jumped out.

You use a four-tier “exposure matrix.” How should leaders think about where their executives fall?

After the UnitedHealthcare shooting, we worked with more than 50 companies over the next couple of months, helping shape presentations for CEOs, boards, and executive leadership teams. One of the most popular frameworks we created was the exposure matrix with four tiers.

Tier one is Elon Musk, Mark Zuckerberg, and Bill Gates—people in every newspaper, known everywhere, recognizable on sight. Tier two is where the UnitedHealthcare chairman landed after the shooting: virtually unknown outside the industry, then propelled to a level of public exposure he’d never experienced. The “wanted posters” of executives that went up in New York and the deck of cards circulating online moved a lot of people to tier two almost overnight. Most executives are tier three or four—few people would recognize them, they’re not in the middle of controversy, and their products aren’t flashpoints.

Most executives don’t realize what moves them between tiers. They say, “I’m not Elon Musk, I don’t have any concerns.” But there’s proximity risk—who’s on your board, who’s in your supply chain. There’s product risk. There’s sector risk. The things that feel normal to you can be a red flag for someone else.

For organizations without a mature executive protection program, where should a leaner team focus first?

The left side of the continuum. Every program is a continuum that runs from awareness to emergency response to disaster recovery. I’d spend almost all my time on the left side.

That means awareness, intelligence, role definition, and reporting. Do the risk assessment so you know what the risk levels actually are and who the players are. What’s event security doing? What’s travel doing? What are the executive assistants doing to mitigate problems? What’s communications doing to minimize the publication of where the person will be? Who’s doing sentiment analysis in the company?

You can intervene and mitigate much more easily on the left-hand side than you can once you’re reaching for people with sunglasses and guns.

If security leaders only adjust one thing when assessing executive risk today, what should it be?

Use the research. Don’t just do what you’ve always done, because things are changing too rapidly. Security has become an industry of personal opinion, and that’s a problem. We’ve been working toward an accredited body of knowledge so decisions are made on peer-reviewed research, not on what a bunch of long-tenured security leaders—myself included—have always done.

Focus on the research that’s available, act on it, and then use metrics to see if what you’re doing is working.

The New Shape of Executive Risk

Bob’s message lands on two points every security leader can act on. The first is that the threat environment has genuinely changed—not in tone, but in shape. Motives, locations, and target profiles are all shifting, and the data is moving faster than most programs are built to handle. The second is that the response can’t rely on habit or on gut. It has to be grounded in current research, tuned to the organization’s specific exposure, and verified through metrics.

Whether your program is mature or still taking shape, there’s a clear starting point: treat assessment as the core muscle. Map the risks, identify who’s exposed (not just in the C‑suite), and understand what moves people between exposure tiers. The organizations best positioned for what’s next aren’t necessarily the ones with the most visible security—they’re the ones willing to pressure-test their assumptions against the data.