The Protection Premium

By Zacharias · Principal

Executive and Principal Security Became a Priced, Disclosed Function. The Threat Moved to the Data Layer. The Ownership Did Not Follow.

ISSUED 19 JUNE 2026 · DEFENSE DESK · ZACHARIAS, PRINCIPAL · AUDITED AGAINST AEGEAN-OS

THE DOCUMENT

NumberAIG-DEF-26-002

FormerlyPMR-2026-0619-USA-002

ProductAssessment

Issued2026-06-19

Pages16

DistributionPublic release

TimelinessDURABLE (6 TO 18 MONTHS)

DOWNLOAD

FULL REPORT (PDF)

16 PAGES · 429 KB · FREE

HOW TO CITE

Aegean Intelligence Group, “The Protection Premium,” AIG-DEF-26-002, The Aegean Register, 19 June 2026.

Abstract

Executive and principal protection has crossed from a discretionary perk into a priced, disclosed, board-level function. But the threat it manages has migrated to the data layer, where a person's location and wealth are assembled from breaches, people-search brokers, and social media, and almost no organization or family office owns the seam between digital exposure and physical harm. This brief maps where the protection money is going, where the threat is actually coming from, and the gap between the two.

Key judgments

KJ-1HIGH

Executive protection has crossed from perk to disclosed corporate function: the share of S&P 500 firms disclosing a security perquisite rose from 23.6 percent in 2021 to 37.8 percent in 2025, and the median value more than doubled.

KJ-2HIGH

The December 2024 killing of the UnitedHealthcare chief executive was the catalyst, not the cause: it accelerated an existing rise in executive targeting rather than creating it.

KJ-3MODERATE

The threat is migrating to the data layer: the dominant enabling vector for physical attacks on wealthy individuals is now digital exposure from breaches, brokers, and social media rather than opportunistic proximity.

KJ-4HIGH

No single function owns the combined exposure: physical security, cyber, and privacy remain siloed in most organizations and almost all family offices, and this ownership gap, not the level of spending, is the binding weakness.

Key stats

Source registry35 entries

Judgments4

Confidence3 HIGH / 1 MOD

Pages16

Issued 2026-06-19Public releaseDURABLE (6 TO 18 MONTHS)AIG-DEF-26-002

Cover

FORWARD CLAIMS · DATED TO PUBLICATION · SCORED ON THE SCORECARD →

ID	Statement	p	Made on	Resolves by	Status	Outcome
CLM-2026-187	broker compliance becomes mandatory on a 45-day cycle from August 1, 2026.	0.65	2026-06-19	2026-08-01	Resolved	TRUE A 20 August 2026 practitioner note records that data brokers' obligations to process deletion requests through the platform at least once every 45 days took effect on 1 August 2026, with the agency ramping up oversight.2026-08-20
CLM-2026-191	The most probable twelve-month path is Baseline, in which spending and disclosure keep rising while integration lags, leaving the seam open.	0.65	2026-06-19	2027-06-19	Locked

A claim is entered in the brief's own words and carries its publication date and the day it entered the ledger: the register's briefs on 8 September 2026, when the standard was first applied; the forward benchmark on the day it was locked. It resolves only against a dated public source. The scoring rule is on the Methodology page.

SOURCES & METHOD

Corporate spending figures derive from SEC proxy filings and the compensation-data firms that aggregate them, such as Equilar and The Conference Board, alongside DOJ indictments, insurer and blockchain-intelligence trackers, regulatory sources, and tiered press. Claims are structured as six key judgments with explicit confidence levels, with per-section assessments carrying confidence grades and stated rationale, keyed by numbered citations to a source registry.

Limitations: Attack-frequency counts differ across independent trackers and are presented as a range rather than a census, and market-size estimates for executive protection and kidnap-and-ransom insurance diverge widely across vendors and are flagged where used.

SOURCE REGISTRY: 35 ENTRIES16 PAGESTIMELINESS: DURABLE (6 TO 18 MONTHS)

Estimative language in this report follows the firm’s published standard: judgments carry HIGH, MODERATE, or LOW confidence, and each carries its rationale in the full report. The framework, source tiers, and anti-fabrication perimeter are public on the methodology page. Corrections issue as numbered addenda.