Nisos assessed 72 corporate executives during 2025 and the first quarter of 2026 and found home addresses publicly accessible for 94% of them, breach data tied to at least one current email for 100%, and Social Security numbers exposed for 64%. None of that sits inside a corporate network. All of it is usable against the company, and none of it is a cyber problem your existing stack was scoped to solve.
That is the gap this article is about. Personal exposure lives entirely outside the corporate security perimeter, which means endpoint agents, email gateways, and SIEM rules never fire on these digital threats, and the security program you already fund cannot see it. This piece covers what a modern executive protection program actually monitors, and what follows from it, how personal exposure converts into corporate loss, where the two disciplines connect, and how a general counsel or CISO should scope the work. Written for the corporate layer: boards, GCs, and security leaders.
What does executive protection mean when the threat is digital?
Executive protection refers traditionally to physical security measures: close protection details, secure transportation, venue advance work, and travel security for senior leaders. Traditional executive protection is mature, well-understood, and entirely about the physical world. It is not going away. What changed is that the intelligence driving it now comes almost entirely from open sources, and the exposure that makes someone a target is assembled in the digital world long before anything physical occurs.
Digital executive protection is the newer half, and going beyond physical protection is why executive protection is important to a CISO rather than only to a facilities lead. It means continuously reducing the personal information attackers use to profile, impersonate, or reach a leader outside company infrastructure. It covers broker listings, breach data, social media, property records, and the account exposure that turns a personal login into a route into the business.
The two halves answer different questions. Physical executive protection asks how to keep someone safe in a place. The digital side asks what an attacker can learn before choosing the place. Treating them as separate programs, run by separate teams with separate budgets, is the single most common structural defect in corporate executive protection.
How does personal exposure become a corporate problem?
Through the accounts and devices that sit between the two. An executive's personal email, home network, and mobile device hold calendar data, travel plans, board material forwarded for convenience, and correspondence that never touched a managed system. Compromise any of those and you have access to sensitive information without breaching a single corporate control. That is the attack surface nobody has inventoried.
Business email compromise is the clearest conversion path. The FBI's 2025 Internet Crime Report recorded roughly $3 billion in reported BEC losses inside nearly $20.9 billion of total reported losses. Phishing at this level works because it is specific, and specificity comes from reconnaissance: an attacker who knows an executive's travel dates, assistant's name, and current deal can write a request that reads as routine. Financial loss follows a convincing message, not a technical exploit.
The second path is password reuse and account recovery. Personal data such as birthdates, family names, and property history feeds security questions and password patterns, and it is exactly what those sites publish. An attacker does not need to defeat multi-factor authentication if the personal account behind the recovery flow is easier. Cybersecurity controls at work do not extend to a personal inbox.
What is actually exposed, and where does it come from?
Four sources, layered, and together they form an executive's digital footprint. What the executive published deliberately, including conference bios and an executive on social media posting more than they realize. What was published about them: property records, litigation filings, and corporate registrations. What data broker sites aggregate and sell. And what leaked in breaches and now circulates on the deep and dark web.
Nisos's 2026 research puts numbers on the last two. Alongside the home address and breach findings, 54% of the executives assessed had a Social Security number listed for sale on dark web marketplaces. That is not a theoretical vulnerability; it is an identity available for purchase. High-profile individuals fare no better than anyone else here.
The finding that most surprises boards concerns family. Immediate family members maintained an average of eight public social media accounts, and 97% of family members revealed personal details about the executive through them, frequently at a higher rate than the executive's own accounts. Executives and their families form one information surface whether or not the company treats them that way, which is a corporate exposure question rather than a personal one.
How is AI changing the executive threat landscape?
By collapsing the cost of reconnaissance, and by widening what counts as a threat to executive safety. Building a profile on a leader used to take an analyst days of manual searching. Automated tooling now aggregates public records, breach data, and social activity in minutes, and Nisos found that certain AI models returned executives' residential addresses.
That speed changes the economics of targeting. Attacks that were previously reserved for high-value targets become viable against a much wider set of corporate leaders, because the reconnaissance no longer requires a skilled operator. Impersonation gets cheaper too: voice and video cloning of a senior figure is now routine tradecraft rather than a demonstration, and detecting it belongs alongside brand security rather than in a separate workstream. A threat actor working at this speed does not need advanced skills.
For a security function the practical implication is that periodic audits no longer suffice. If an attacker can rebuild a profile in an afternoon, an annual review is a snapshot of a surface that regenerates continuously. Real-time monitoring is the only cadence that matches the threat, which is what digital risk protection means in practice.
What should a corporate executive protection plan actually cover?
Six components of executive protection on the digital side, and none of them are exotic. This is how you build a corporate executive protection capability that a security team can actually run. Continuous discovery of what is publicly available about each protected person. Removal of personal information from data aggregators, repeated because listings regenerate. Monitoring of breach and credential exposure. Impersonation detection across social platforms and domains. Executive security hardening on personal accounts and the home network. And a defined escalation path into whoever makes physical decisions, including travel protection when someone is moving.
Scope the population deliberately. Most programs quietly protect whoever complains loudest. A defensible approach ranks executives by exposure using public visibility, decision authority, litigation history, and the controversy attached to their business unit, then tiers coverage accordingly. That ranking is the document a board committee will ask for.
Write the escalation path down and rehearse it. Executive protection may begin as a monitoring service, but its value is realized at the moment a validated finding needs to change somebody's schedule. If that handoff has never been tested, you will discover its gaps during an actual event. Our executive protection practice is built around that validated-alert-to-decision path rather than around a dashboard.
How do you conduct a useful threat assessment?
Start with discovery rather than with controls. A proper risk assessment establishes what exists about each person across all four exposure sources, then scores it by exploitability rather than volume. A decade-old forum post is noise. A current home address paired with a published routine is a physical risk. The goal is to identify risks that are live, not to catalog history.
Then map the conversion paths explicitly. For each finding, ask what an attacker could do with it: impersonate, authenticate, locate, or pressure. That framing turns a list of findings into prioritized security risks that a GC and a CISO can both act on, and it is what distinguishes a threat assessment from a data dump.
Repeat it on a schedule and after triggers. Role changes, contentious announcements, litigation, and layoffs all move someone up the exposure ranking. Ongoing threat intelligence covering criminal forums and the channels where targeting gets coordinated is what turns this from a report into proactive security. The mechanics of that collection sit in our dark web monitoring work and in our piece on why corporate reputation is an asset worth protecting.
Where do the two sides connect?
At the escalation point, and it needs a named owner. When monitoring surfaces something that could affect an executive, somebody has to decide whether to change a travel plan, add security personnel, or notify law enforcement. That decision is a protective judgment informed by digital intelligence, and it fails when the two functions report separately and meet quarterly.
Doxxing is the clearest example of why timing matters. Targeting information typically circulates in closed channels before it reaches public platforms, which creates a short window where intervention is still possible. Our complete monitoring guide covers what those channels look like. Monitoring that only watches public sources learns about it at the same time as everyone else, which is too late for comprehensive protection to mean anything.
The reverse flow matters too. Physical events generate digital attention: a protest, a contentious earnings call, or a restructuring announcement produces a surge in online activity that a monitoring program should anticipate rather than discover. Protecting leaders from digital and physical threats means treating them as one problem with two response paths.
What does this cost, and how do you fund it?
Less than most boards expect, and there is now a disclosure argument alongside the safety one. Equilar analysis published through the Harvard Law School Forum on Corporate Governance found more than a third of S&P 500 companies providing security perquisites in 2025, with the median value reaching $130,468, up roughly 20% year over year.
Digital work sits at the cheaper end of that range, which is why corporate security teams increasingly start there. Removal work, monitoring, and account hardening for a small protected population cost a fraction of physical coverage, and they reduce the probability that physical measures are ever needed. That is the risk management argument: the digital layer is the cheapest intervention in the sequence.
Frame it as enterprise risk rather than as an executive benefit. Wire fraud exposure, reputational damage, and continuity risk are corporate outcomes, and presenting the program that way is what gets it funded. Presenting it as a perk for senior leaders invites exactly the scrutiny you do not want.
What should executives themselves do?
Treat personal accounts as corporate infrastructure. Security professionals often assume executives already do this; the assessment data says otherwise. Phishing-resistant authentication on personal email and financial accounts, a password manager, and no reuse between personal and work systems. CISA's guidance for highly targeted individuals assumes communications are subject to interception and is a reasonable baseline for anyone at this level.
Reduce what is publishable. Safeguard what is already public: lock down social privacy settings, disable geolocation on fitness and photo apps, and avoid posting travel in real time. Pattern-of-life information is the input to physical targeting, and most of it is volunteered rather than stolen. Executive protection services cannot remove what someone keeps republishing.
Then involve the household in the conversation, carefully and at the corporate layer. The Nisos family finding means an executive can do everything right and still be exposed through someone else's account. Framing that as a security briefing rather than a restriction is what makes it land, and it belongs in the program rather than in an awkward one-off conversation.
How do you know the program is working?
Measure exposure reduction, not activity. Number of broker records removed and the re-listing rate. Percentage of protected executives with no current home address publicly available. Time from a validated finding to remediation. Those numbers move, and they are defensible to a board committee.
Watch the leading indicators too. Impersonation attempts detected and taken down, credential exposures found and reset, and the proportion of findings that were current rather than historical. A program generating mostly stale findings is measuring the archive rather than the threat. Online threats that are two years closed are not a result.
And review the protected population quarterly. Exposure regenerates, people change roles, and last year's ranking is wrong by now. Building an executive protection capability is a continuing control, not a project, and the organizations that treat it as the latter end up repeating the discovery phase every few years. The board-level framing sits in our guide to closing the executive digital footprint gap.
Find out what is exposed before someone else does
Our Exposure Report runs your executive leadership teams against current collection and returns the executive risk that is publicly discoverable, what is circulating in breach and credential markets, and where the escalation path breaks. It is written for a risk committee and specific enough for practitioners to act on.
We work at the corporate layer with GCs, CISOs, and global security leads, and our executive protection strategies are built for that audience rather than for private clients. If you want a straight read on where your exposure sits before it becomes an incident, that is the conversation to have now.
Key things to remember
- Personal exposure sits outside the corporate perimeter. Endpoint agents, email gateways, and SIEM rules never fire on a data broker listing, which is why existing tooling cannot see this category at all.
- The baseline is worse than assumed. Across 72 assessments, 94% of executives had a publicly accessible home address, 100% had breach data on a current email, and 54% had an SSN listed for sale.
- Family accounts are the blind spot. Immediate family averaged eight public social accounts, and 97% of family members revealed details about the executive, often more than the executive's own posts.
- Reconnaissance is now cheap. AI tooling collapses profile-building from days to minutes, which widens the set of leaders who are economically worth targeting.
- Periodic audits no longer match the threat. If a profile can be rebuilt in an afternoon, annual reviews measure a surface that has already changed.
- The conversion path runs through personal accounts and account recovery, not through your firewall.
- The two halves must share an escalation path with a named owner. The handoff is where the value is realized and where untested programs fail.
- Fund it as enterprise risk, not as a benefit from executive protection spending. Security perquisites are disclosed, and a perk framing invites scrutiny a risk framing avoids.
- Measure exposure reduction and re-listing rates, not alert volume. Stale findings mean you are measuring the archive.
- Review the protected population quarterly. Exposure regenerates and rankings go out of date faster than budget cycles.
