Protective Intelligence for Teams Without an Analyst

Protective intelligence is the discipline of identifying, assessing, and monitoring concerns that could become threats to a principal before they arrive at the rope line. Most of what is written about it assumes an analyst desk; most working details don't have one.

The literature describes intake procedures, case management systems, and watch floors. That material is written for enterprise programs with a protective intelligence unit down the hall. If your whole detail fits in one Suburban, none of it maps to your day. But the underlying work still has to happen, because the concerns don't care about your org chart.

A function, not a position

The mistake is treating protective intelligence as a hire you can't afford, and therefore a thing you don't do. It isn't a position. It's a function: a set of jobs that have to get done for the detail to see problems early. An enterprise program concentrates those jobs in a person or a unit. A three-person detail can't, so it distributes them.

Distribution means every job has an owner, a cadence, and a place where its output lives. That's the whole model. What follows is one way to distribute it. Adapt the ownership and the cadence to your detail, because every team runs this differently.

The four jobs, at small-team scale

1. Baseline awareness. You cannot recognize abnormal until you know what normal looks like around the principal's residences, workplaces, and recurring travel destinations. On a small detail this belongs to whoever runs advances, because they're already building the picture — the baseline is the accumulated residue of every advance. The cost is a standing sweep, twenty minutes a week: local news for each fixed location, anything new around upcoming travel, changes to the pattern. We've written about the mechanics in monitoring a region before you travel. A calendar block covers it. You don't need a watch floor.

2. Concern tracking. Every detail accumulates people and situations that have touched it: the letter-writer whose tone shifted, the terminated employee who mentioned the principal on the way out, the stranger who has now appeared at two events. Each one gets a case file. Simple and factual. What happened, when it happened, exact words where you have them, and the source of every fact. No diagnoses, no speculation about intent; the file records behavior, not your theory of the person.

The file's job is pattern visibility over months. A single odd interaction means little. The same individual surfacing across three entries in ninety days means something, and only a written record makes that visible. The file may also end up in front of lawyers or police someday.

Write every entry as if it will be read aloud in a hearing. It might be.

One note worth stating plainly: collecting information about individuals is regulated differently depending on where you operate. Keep files factual, keep them need-to-know, and know the local law before you build a practice around them.

3. Pre-travel collection. Movement is where exposure concentrates, and the brief before movement is where baseline awareness and concern tracking pay off. This job usually falls to the agent running the advance for that trip. We've covered the structure separately in the pre-travel intel brief, so we won't repeat it here. The point is that it's one of the four jobs, and it needs an owner like the others.

4. Source discipline. Before any piece of reporting drives a decision (a route change, a posture change, a conversation with the principal), someone rates it. How reliable has this source been before, and how likely is this specific claim to be true? This is the working core of what an analyst actually does, and anyone on the team can learn it. The method is in how to rate an intelligence source, and our rated list of open sources for protective work is here. A detail that rates its sources makes better calls than a larger one that forwards headlines.

Where behavioral threat assessment fits

Behavioral threat assessment is a real professional field with real depth. Its practitioners evaluate whether a person of concern is moving toward violence, and what intervention changes that trajectory. A small detail's job is not to become assessors. Doing that work badly is worse than not doing it at all.

The small-team job is narrower and achievable: recognize the general categories of concerning behavior (fixation on the principal, escalation in the frequency or intensity of contact, approach behavior that closes distance over time), document them in the concern file, and know the escalation point. That means knowing, before you need them, who you'd call: a threat assessment consultant, a local threat assessment unit where one exists, your law enforcement liaison.

The skill isn't assessing the threat. The skill is recognizing the pattern early and handing it to someone qualified while there's still time to act on the answer.

Details get this backwards in both directions — either dismissing a pattern because nobody feels qualified to judge it, or sitting on it because calling for help feels like admitting the team can't handle its own problems. The concern file solves both. It gives you something concrete to hand over, and the handoff itself is the competent move.

What breaks without the discipline

The failure modes on small details are consistent, and none of them are about talent.

• Concerns live in one person's memory. The agent who dealt with the letter-writer rotates off, and the history leaves with them. The next agent meets the same individual as a stranger.
• Sources go unrated. A forwarded post changes a route because nobody asked where it came from, or a credible warning gets ignored because it arrived looking mundane.
• Observations never connect. The same stranger gets noticed three times by three different agents who each log it nowhere and never compare notes. Together, the three sightings would alarm anyone. Apart, they produce three shrugs.

Every one of these is a process failure, not a headcount failure. Adding an analyst without the process just gives you a fourth person whose observations also live in one head.

Start smaller than you think

The distributed version of this function costs a detail minutes per week — a recurring sweep, a file updated when something touches the detail, a rating habit applied before reporting drives a decision, a brief before movement. If your team runs none of it today, start with concern tracking, because that's where lost information does real damage and where a written record compounds in value. Then add the weekly sweep.

This is one way to run it. Your detail's version will look different, and it should. What shouldn't vary is that each of the four jobs has an owner. Without owners the function still gets done — by accident, in fragments, in people's heads, right up until the day the fragments mattered.