Protective intelligence · OSINT · Event risk
From public signals to proportionate protective decisions.
I use public-source information, behavioural indicators and business context to understand how emerging issues can affect people, events and organisations. The aim is not simply to identify activity, but to explain what it means, what remains uncertain and what decision should follow.
356
public-source items
0
credible direct threats
Synthetic case study: snapshot
356
Public-source items
104
Accounts in the synthetic dataset
11
Calls to interrupt presentations
0
Credible direct threats
The case examines how broad public criticism can develop into event-specific mobilisation without assuming that activism itself represents a physical threat.
Cause does not equal threat.
Behaviour changes the risk picture.
Escalation flow: behaviour changes the risk
- 1. Broad criticism: Companies and relationships criticised
- 2. Event targeting: Speakers, sessions and venue named
- 3. Calls to interrupt: Explicit disruption intent (MLCOA)
- 4. Harm indicators: Weapons, injury intent, access to restricted areas (MDCOA)
Case Study 02
From activism to event disruption
From online mobilisation to live-event interruption, business impact and protective decision-making.
The fictional Meridian Leadership Forum is a two-day UK industry event with 2,400 attendees, livestreamed keynotes and 18 senior corporate speakers.
Two unrelated activist networks begin focusing on the event.
One campaign criticises a cloud-services sponsor over alleged links connected to the Gaza-Israel conflict. A separate animal-rights campaign focuses on another company over an alleged supplier relationship with a regulated research-animal business.
There is no evidence that the two networks are coordinating.
The intelligence problem is not whether people are allowed to criticise the companies. The question is whether public activity is changing in ways that could affect event continuity, executive exposure, business reputation or physical safety.
Real-world context
Why this matters now
Corporate presentations, shareholder meetings and high-profile events can become stages for issue-motivated activism. A disruption that lasts only minutes inside the room may reach a much larger audience through livestreams, social media and news coverage.
Reuters · 2025
Microsoft event presentations interrupted by protesters over the company's ties to Israel
Reporting describes protesters interrupting company presentations while raising concerns about Microsoft's relationship with Israel and the use of its technology. Microsoft has disputed aspects of the activists' characterisation.
Source (opens in a new tab)Associated Press · 2025
Protests and disruption at corporate events and shareholder meetings
Coverage of activists interrupting corporate presentations and annual meetings, including Palestine-related campaigns directed at banks such as Barclays. The allegations described are those made by campaigners.
Source (opens in a new tab)UK Parliament / Hansard · 2022–2024
Parliamentary debate and written answers on MBR Acres and animal-rights protest activity
Parliamentary material describes MBR Acres as a regulated breeding and supply facility that does not conduct animal testing on site, and discusses sustained protest activity directed at the site and companies identified by activists as connected to it.
Source (opens in a new tab)The Independent / PA · 2026
Protest at a COS show during New York Fashion Week and the CFDA chief's intervention
Reporting on a runway protest that became a wider corporate story after a senior industry figure physically intervened, illustrating how response behaviour can outweigh the original disruption.
Source (opens in a new tab)The protective-intelligence lesson is not that activism equals violence. It does not. The task is to understand behaviour, intent, access, target exposure and likely consequences, then recommend a proportionate response.
Intelligence products
Same intelligence. Different decision context.
Flash Alert
For immediate operational awareness.
Answers three questions:
What happened? Why does it matter now? What should happen in the next two hours?
Protective Intelligence Brief
For operational and protective decision-makers.
A structured assessment covering:
BLUF, additional relevant detail, assessment, most likely course of action, most dangerous course of action and advisory.
Executive Brief
For senior leadership.
Condenses the same intelligence into:
Bottom line, business implications and decision points.
The value is not producing three versions of the same document. It is understanding what different decision-makers need from the same intelligence.
How I approach analysis
From signal to decision
- 01
Define
What does the organisation actually need to know?
- 02
Collect
Gather relevant public-source, event and business information.
- 03
Connect
Identify changes, relationships, patterns and gaps.
- 04
Test
Consider alternative explanations rather than immediately accepting the most alarming one.
- 05
Assess
Separate likelihood, consequence, uncertainty and escalation indicators.
- 06
Brief
Explain what happened, why it matters and what should happen next.
Focus
What this portfolio demonstrates
- Protective intelligence and event risk analysis
- OSINT collection framing and source validation
- Behavioural assessment separating criticism from risk-changing behaviour
- Structured analysis, confidence statements, MLCOA and MDCOA
- Business impact analysis across security, communications, HR and legal
- Operational and executive intelligence writing