Before the Boots Hit the Ground

By Dr. Tyler Billings — PAG Protection

A principal we'll call James is driving to a routine meeting at a venue in a major U.S. city. His protective detail has driven the route twice this week. The vehicle is in good order. The advance team has cleared the venue. By every conventional measure, this is a low-risk movement.

What James and his detail don't know yet is that, in the last ninety minutes, a coordinated protest action has been organized over social media targeting the building immediately adjacent to the venue. The first demonstrators are now arriving. Traffic in the surrounding blocks is about to lock down. A counter-demonstration is forming three blocks away.

In a conventional security operation, the detail learns about all of this when they arrive at the choke point, see the crowd, and start improvising.

In ours, the lead operator's phone vibrates eighteen minutes before they're due at the venue. The message is from our intelligence team: Protest activity developing within two blocks of your destination. Estimated 400 participants by your ETA. Counter-protest forming on 5th. Recommend re-route via alternate two, push arrival by twenty-five minutes, brief principal on possible schedule adjustment.

The detail re-routes. The principal is briefed. The meeting starts ten minutes late and the security team never appears on a news feed.

That difference — between learning about a situation when you walk into it and knowing about it before you arrive — is the entire value proposition of intelligence-led protection.

What we mean by an intelligence function

Most private security firms do not have an intelligence function. They have dispatchers, and they have officers. When something happens at a site, the officer reports it; the dispatcher logs it; the client is informed if it crosses a certain threshold. This is reactive by design. It works for facilities that need a watchful presence on the property. It does not work for the kind of protective work that requires staying ahead of a threat picture rather than reacting to it.

At PAG, our intelligence team is a standing capability — not a service we bolt onto specific engagements. The team operates continuously, builds and maintains the situational picture across every active operation, and pushes information directly to field teams the moment it becomes relevant. They are not a research function. They are not a marketing line item. They are operators in their own right, working a different terrain.

What the team does before an operation begins

The work of an intelligence team starts well before the first boot hits the ground. For any meaningful engagement — a principal moving through a high-exposure environment, a residential security detail standing up at a new property, an event protection assignment with public attendance — there is a body of preparatory work that determines how well the field operation runs.

Threat assessment specific to the principal. What is the principal's profile? What public exposure do they have? What recent statements, business decisions, or industry positioning could attract attention? What grievances, real or perceived, exist around them? This is not generic profiling. It is the work of understanding why a specific person might attract a specific threat, from whom, and through what vector.

Open-source intelligence on environment and adversaries. Social media activity, dark web chatter, recent local incidents, protest organizing, fixation indicators around the principal or the organization. Done well, OSINT collection produces a continuously updated picture of what is moving in the threat environment around an engagement.

Route and venue analysis. Not generic route planning — specific analysis of the actual routes the principal will travel and the venues they will occupy. Choke points. Surveillance vantages an adversary would use. Egress options. Access control posture at each destination. Recent incidents in adjacent areas. Local conditions specific to the day.

Coordination with external sources. Local law enforcement. Regional intelligence fusion centers. Industry peers. Trusted vendors operating in the same space. The intel team builds and maintains relationships that allow information to flow when it needs to — not after a request goes through three layers of bureaucracy.

Operator briefings. Everything the team has gathered gets distilled into actionable briefings for the field teams before they deploy. Operators arrive informed. They know what the picture looks like, what's been flagged, what the contingencies are, and what to watch for. They are not walking in blind.

What the team does during an operation

The preparatory work is the foundation. The real value of an intelligence function shows up in real time.

Continuous monitoring. While the detail is moving, the intel team is watching. Social media activity in and around the operation. Traffic and transportation disruptions. Criminal incidents within proximity. Weather events that could affect the route. Anything in the operating environment that could change the threat picture in the next thirty minutes.

Direct, prioritized communication with the field team. The intel team does not produce reports. They produce decisions. When information surfaces that the field team needs to act on, it goes to the lead operator immediately, prioritized by urgency, in a format the operator can use without translation.

Decision support in motion. Route changes. Schedule adjustments. Posture shifts. The intel team's job is not to tell the field team what to do — it is to make sure the field team has every piece of information they need to make the call themselves, before the moment requires them to make it under pressure.

Post-operation review. After every significant engagement, the intel team debriefs the field team and incorporates what was learned. What did we get right? What surfaced that we should have caught earlier? What patterns are emerging in this principal's exposure, this venue, this corridor? The picture gets sharper with every operation.

What this prevents

The value of intelligence work is mostly invisible by design. When it functions well, the things it prevents never happen — which means the people protected by it rarely see what was avoided on their behalf.

A few categories of incident that intelligence-led protection consistently prevents from reaching the field team:

• Walking into a protest or counter-protest that wasn't on the schedule.

• Arriving at a venue that has just experienced a security incident.

• Using a route that has become a choke point in the last hour.

• Being adjacent to an unrelated law enforcement operation that turns into a media event.

• Missing pre-attack surveillance indicators that the field team alone wouldn't have the context to recognize.

• Being unaware of a credible threat against the principal or the organization that surfaced overnight on a forum the field team doesn't monitor.

In each case, the intervention is small. A re-route. A schedule shift. An additional officer on a particular post. A heads-up to the principal. None of it makes the news. None of it costs much. The cumulative effect, over months and years of operations, is the difference between a protective program that works and one that gets lucky.

The discipline

Building and maintaining an intelligence function is not easy and it is not cheap. It requires people who can do the work — and the people who can do the work are not the people the contract security industry has historically hired. It requires technology. It requires relationships that take years to develop. It requires a willingness to spend on capability that does not appear on a client invoice as a billable hour.

We have made that investment. It is one of the things that makes our operation what it is, and it is one of the harder things for a competitor to replicate.

If you are evaluating security providers, here is a question worth asking: what intelligence work is your team doing on my behalf right now? If the answer is vague, or the question itself seems to surprise them, you have your answer. They are providing presence. Presence has its place. But presence by itself is not protection — not in the threat environment we currently operate in.

The work that matters happens before the first boot hits the ground. And it does not stop until the operation is complete.

PAG Protection provides intelligence-led private security, executive protection, and high-risk operations support across the United States and internationally. For a confidential conversation about your security posture, contact our team.