Aegean Intelligence Group
Research · PMR-2026-0619-USA-002
Publishable Market Research · 2026

The Protection Premium

Executive and Principal Security Became a Priced, Disclosed Function. The Threat Moved to the Data Layer. The Ownership Did Not Follow.

The Protection Premium — Aegean Intelligence Group Publishable Market Research
PMR-2026-0619-USA-002 · Defense & Security Intelligence

Executive and principal protection has crossed from a discretionary perk into a priced, disclosed, board-level function. But the threat it manages has migrated to the data layer, where a person's location and wealth are assembled from breaches, people-search brokers, and social media, and almost no organization or family office owns the seam between digital exposure and physical harm. This brief maps where the protection money is going, where the threat is actually coming from, and the gap between the two.

Author
Zacharias · Principal
Pages
15
Timeliness
Durable (6 to 18 months)
Issue date
2026-06-19
Classification
Public
Sources
35 (T1 20% · T2 31% · T3 35% · T4 14%)
Read the full PMR (PDF)
Durable read · Update on a material change in proxy-season disclosure, attack-frequency data, or the data-broker regulatory regime

Key Judgments

Six judgments anchor this assessment. Each is tied to cited evidence in the body of the brief and carries an explicit confidence level. The four below are the load-bearing four.

  • High confidence. Executive protection has crossed from perk to disclosed corporate function. The share of S&P 500 companies disclosing a security perquisite rose from 23.6 percent in 2021 to 37.8 percent in 2025, and the median disclosed value more than doubled. This is a durable governance shift, not a post-incident spike.
  • Moderate confidence. The threat has migrated to the data layer. The dominant enabling vector for physical attacks on the wealthy is now their digital exposure, data from corporate breaches, people-search brokers, and social media, rather than opportunistic proximity. The end-to-end causal chain is rarely proven in a single case, but the direction is unambiguous.
  • Moderate confidence. Violent attacks on holders of liquid wealth reached a record in 2025, with independent trackers logging between roughly 55 and 72, and the method is professionalizing, with planning, disguises, and remote coordination evident in 2025 to 2026 cases.
  • High confidence. No single function owns the combined exposure. Only about a quarter of organizations have converged physical and cyber security, and most family offices lack basic protective controls. This ownership gap, not the level of spending, is the binding weakness.
Related coverage