Case Study 02 · Synthetic protective intelligence exercise

From activism to event disruption

From online mobilisation to live-event interruption, business impact and protective decision-making.

Illustrative image. Not the fictional Meridian Leadership Forum.

Scenario: 8–17 September 2026
Environment: Fictional UK industry conference
Focus: Protective intelligence / event risk
Case status: Synthetic portfolio exercise

✦ Synthetic case studyThis is a synthetic exercise. The event, companies, accounts, incidents and analytical data are fictional. Real-world incidents are referenced only to provide professional context.

Jump to section

Overview

My role in the exercise

This is a portfolio exercise rather than employment or a client engagement. Working through the scenario, the analytical tasks were to:

Frame the intelligence requirement before the event
Assess public mobilisation without treating political or ethical disagreement as a threat
Identify which speakers, sessions and locations were becoming focal points
Distinguish disruption indicators from indicators of physical harm
Test alternative explanations
Assess likely business consequences
Produce different intelligence products for security teams and senior leadership
Recommend proportionate action

Priority intelligence requirement

Assess the likelihood, form and business impact of activist disruption at the Meridian Leadership Forum, identify any credible escalation toward executive targeting or physical harm, and recommend proportionate measures that protect people and event continuity without treating lawful protest as a security threat.

The problem

The challenge

Two unrelated activist campaigns began paying increasing attention to speakers appearing at the same corporate event.

Early discussion consisted largely of criticism of companies and their commercial relationships. As the event approached, some public activity became more specific:

speakers were named
session times were shared
venue details appeared
some posts encouraged people to attend
11 items explicitly called for presentations to be interrupted

The key question became: would this remain ordinary protest, develop into deliberate event disruption, or indicate a more serious threat to executives?

The important change was not more criticism. It was the move from broad criticism to specific event-focused behaviour.

Cause does not equal threat.

Behaviour changes the risk picture.

Assessment summary

BLUF: Bottom Line Up Front

Selected sessions at the Meridian Leadership Forum are highly likely to face planned, non-violent activist disruption.
Two unrelated issue-motivated networks are separately focusing on named speakers and sponsors.
Current reporting supports visibility and reputational pressure as the main intent, not physical harm.
Risk is highest around livestreamed keynotes, named speakers and access points.
Enhanced but proportionate controls are advised, and executives should not personally intervene in physical incidents.

Event disruption

High likelihood · High confidence

Physical harm

Lower concern on current evidence

Likelihood and confidence are different ideas. Likelihood is how probable the outcome is. Confidence is how much the available evidence supports that judgement. A judgement can be highly likely with high confidence, or unlikely but held with low confidence because the evidence is thin.

Evidence

Evidence snapshot

Evidence profile: synthetic dataset

29 · Items naming a company or a commercial relationship.
18 · Items identifying a speaker, a session time or the venue.
11 · Items explicitly encouraging interruption of a presentation.
3 · Accounts linked in the synthetic dataset to earlier non-violent disruption.
0 · No credible direct threat was identified in the dataset.

These categories overlap and should not be added together. Base dataset: 356 total public-source items across 104 accounts.

Event disruption risk

Deliberate, non-violent interruption of selected sessions is assessed as highly likely, with high confidence.

Synthetic physical-safety risk score

38/100

A synthetic analyst risk score for this exercise only. Physical harm is a lower concern on current evidence, which does not remove the need to protect stages, movements and access points.

Additional relevant detail

Activity increased as the event approached.
Eleven public items explicitly encouraged interruption of presentations.
Eighteen items identified a speaker, session time or location.
Three accounts were linked in the synthetic dataset to previous non-violent disruption.
No credible direct threat was identified.
No weapon reference was identified.
No stalking pattern was identified.
No specific plan to injure a speaker was identified.
No evidence showed coordination between the two activist networks.
Livestreamed sessions increased the potential reach of even a short interruption.

Sequence

How the picture changed

8 Sep
Speaker list published
General criticism begins.
10 Sep
Campaign accounts share event details
Attendance and protest discussion becomes more specific.
12 Sep
First calls to interrupt a keynote
Event-continuity risk becomes more likely.
14 Sep
Named speakers and session times circulate
Executive and session exposure increases.
15 Sep
Accounts linked to previous non-violent disruptions engage with event posts
Confidence in attempted disruption increases.
16 Sep
Multiple posts encourage visible action inside or immediately around the event
Security and communications planning is increased around selected sessions.
17 Sep 09:40 · event day
First verbal interruption
17 Sep 11:15 · event day
Banner and chant interrupt keynote
Session pauses for eight minutes.
17 Sep 13:05 · event day
Small foyer sit-in
One breakout session is moved.
17 Sep 16:30 · event day
Event closes
No injury. No forced access to private executive areas. No evidence of violent escalation.

Analysis

What raised and reduced concern

What raised concern

repeated naming of individual speakers
session times circulating
calls to interrupt presentations
previous non-violent disruption associated with several accounts
interest in being inside the venue during targeted sessions

What reduced concern

no direct or implied threat of violence
no weapon references
no evidence of preparation for physical harm
no stalking or home targeting
no repeated monitoring of private locations
public messaging focused mainly on visibility, criticism, boycott pressure and disruption

Assessment

High confidence
Selected sessions are likely to face deliberate disruption.
Moderate confidence
The disruption will remain non-violent.
Moderate confidence
The main objective is reputational pressure and online amplification.
Low confidence
Any claim that the campaigns intend physical harm to a speaker.

What would change the assessment

The assessment should materially change if credible evidence appears of:

a direct threat to a named person
repeated unwanted approaches to a speaker
stalking
surveillance of private movements
forced access to restricted areas
weapons
sabotage
explicit intent to injure someone
attempts to follow an executive outside the public-event context
previously separate actors coordinating a more serious plan

These are escalation indicators, not claims about the activists in the synthetic case.

Planning

Most likely and most dangerous courses of action

Escalation flow: behaviour changes the risk

1. Broad criticism: Companies and relationships criticised
2. Event targeting: Speakers, sessions and venue named
3. Calls to interrupt: Explicit disruption intent (MLCOA)
4. Harm indicators: Weapons, injury intent, access to restricted areas (MDCOA)

MLCOA

Most Likely Course of Action

The scenario the available evidence currently supports as most likely.

A small number of activists use normal attendee or public access to interrupt one or more named sessions with verbal protest, banners or a short sit-in.

The activity is filmed and amplified online.

Likely effect

short programme delay
strong social-media visibility
staff distraction
reputational pressure
limited direct safety impact

Watch for

increasingly session-specific calls to attend
discussion about tickets or access
coordinated media preparation
live-location posting

MDCOA

Most Dangerous Course of Action

A lower-likelihood but plausible scenario with significantly greater consequences that security planning should be able to manage.

A participant crosses a restricted boundary or makes a direct approach to a speaker and the intervention develops into a physical confrontation near the stage or an executive movement route.

A second disruption could divide security attention.

Potential effect

injury
emergency event pause
evacuation
substantial reputational amplification
longer-term executive-security review

Current judgement · Low likelihood

No weapon or injury intent is indicated by the scenario evidence.

MLCOA and MDCOA are planning tools, not predictions. The MDCOA allows protective measures to be tested against a plausible high-impact scenario without implying that activists generally intend violence.

Business

So what for the business?

A live disruption can matter to the organisation even when nobody is injured and the event continues.

Leadership time

Executives, event leads and security managers may be pulled away from planned work.

Reputation

A short video clip can travel much further than the original event and remove important context.

Event delivery

Sessions may be paused, relocated or delayed.

Employee relations

Where employees participate in activism, HR, management, communications and security may all become involved. Disagreement itself should not be treated as a security problem.

Partner and supplier exposure

A company can become a secondary target because of a customer, supplier, investment or sponsorship relationship.

Cost

Additional security, event changes, legal review and communications work create costs even when the physical incident is minor.

Executive confidence

Repeated disruption may change how leaders approach travel, public events or engagement with staff and external audiences.

The security incident may last minutes. The business consequences can last much longer.

Without a fused assessment

Security sees an access issue.
Communications sees a reputation issue.
HR sees an employee-relations issue.
Event operations sees a schedule problem.
Executives see a difficult audience.

With a fused assessment

Leadership sees one event-risk picture.

The organisation can coordinate:

security
communications
HR
legal
event operations
executive support

around the same evidence and escalation thresholds.

Good intelligence does not simply describe the problem. It helps different parts of the business make the same decision from the same picture.

Wider implications

What this means beyond one event

Corporate events are media stages.

An interruption in a room can reach a much larger audience online.

Secondary targets matter.

Suppliers, banks, technology providers, venues and sponsors can attract pressure because of their commercial relationships.

Public schedules create exposure.

Speaker names, event times and venue details make high-visibility moments easier to identify.

Security and reputation increasingly overlap.

One incident can involve protective security, communications, HR, legal and senior leadership.

Response behaviour matters.

An unnecessary confrontation can create a larger reputational issue than the original protest.

Proportionality is part of security.

The goal is to protect people and continuity while keeping legitimate expression separate from behaviours that materially change risk.

The analyst's value is not predicting every protest. It is identifying which public signals change the risk, explaining what they mean for the organisation, and helping decision-makers respond without underreacting or overreacting.

Advisory

Proportionate protective actions

Before

Identify the speakers and sessions attracting the most attention.
Review unnecessary publication of executive movement information.
Brief venue security and stage teams.
Agree how disruption will be handled.
Prepare communications lines.
Define escalation thresholds.

During

Use trained security staff for intervention.
Keep executives out of direct physical confrontation.
Maintain event continuity where safe.
Separate lawful protest from behaviour affecting access, safety or continuity.
Avoid unnecessary escalation.

After

Record incident details.
Preserve relevant footage and logs.
Review online amplification.
Reassess whether individual speakers, companies or suppliers remain focal points.
Update protective measures before the next public appearance.

Plan for protest as an event condition.

Escalate security based on behaviour, not ideology.

Outcome

What happened in the simulation?

Live disruptions

19 min

Total programme delay

Session relocated

Injuries

Three actions were short verbal or banner interruptions.
One became a small foyer sit-in.
The targeted keynote paused for eight minutes and resumed.
One breakout session was moved.
Seven senior speakers used adjusted movement arrangements.
No executive personally confronted a protester.
No evidence emerged of an attempt to enter private executive rooms or intentionally injure anyone.

The outcome broadly matched the most likely course of action: visible but non-violent disruption, amplified online, without evidence of deliberate physical harm.

A disruption may last minutes. Video of the response can shape reputation for days.

Method

From signal to decision

01
Define
What does the organisation actually need to know?
02
Collect
Gather relevant public-source, event and business information.
03
Connect
Identify changes, relationships, patterns and gaps.
04
Test
Consider alternative explanations rather than immediately accepting the most alarming one.
05
Assess
Separate likelihood, consequence, uncertainty and escalation indicators.
06
Brief
Explain what happened, why it matters and what should happen next.

Sources

Context sources and synthetic data

Real-world context sources

These references provide professional context only. The organisations listed are not part of the Meridian scenario, and activist allegations are reported as allegations.

Reuters · 2025
Microsoft event presentations interrupted by protesters over the company's ties to Israel
Reporting describes protesters interrupting company presentations while raising concerns about Microsoft's relationship with Israel and the use of its technology. Microsoft has disputed aspects of the activists' characterisation.
Reuters (opens in a new tab)
Associated Press · 2025
Protests and disruption at corporate events and shareholder meetings
Coverage of activists interrupting corporate presentations and annual meetings, including Palestine-related campaigns directed at banks such as Barclays. The allegations described are those made by campaigners.
Associated Press (opens in a new tab)
UK Parliament / Hansard · 2022–2024
Parliamentary debate and written answers on MBR Acres and animal-rights protest activity
Parliamentary material describes MBR Acres as a regulated breeding and supply facility that does not conduct animal testing on site, and discusses sustained protest activity directed at the site and companies identified by activists as connected to it.
UK Parliament / Hansard (opens in a new tab)
The Independent / PA · 2026
Protest at a COS show during New York Fashion Week and the CFDA chief's intervention
Reporting on a runway protest that became a wider corporate story after a senior industry figure physically intervened, illustrating how response behaviour can outweigh the original disruption.
The Independent / PA (opens in a new tab)
NPSA · Current guidance
Protective security guidance for events, people and crowded places
UK national guidance on proportionate protective security planning for people and venues.
NPSA (opens in a new tab)
ProtectUK · Current guidance
Event security planning and public protection guidance
Police-led guidance on event security planning, staff briefing and incident response.
ProtectUK (opens in a new tab)

Synthetic case data

All figures in the Meridian Leadership Forum case are synthetic and were created for this portfolio exercise: 356 public-source items, 104 accounts, 29 company or commercial references, 18 speaker/session/location references, 11 calls to interrupt presentations, 3 links to previous non-violent disruption and 0 credible direct threats.

The event, companies, accounts, incidents, risk score and outcome data are fictional. No real individuals or organisations were monitored, and the real-world reporting listed above is not evidence in the synthetic scenario.