Why are these operations difficult for corporate security teams to detect?

Rinckey: Detection is hard for structural reasons. The activity takes place in the executive’s private life, outside the data loss prevention tools, access logs and badge systems that security teams monitor.

What is collected is usually strategy and impressions, not documents, so nothing leaves a technical trail. Few people inside a company feel empowered to question the CEO’s relationships, and senior leaders often operate outside the controls that apply to everyone else. The executive may never realize anything is happening.

Signs that a relationship is being cultivated rather than developing naturally include rapid intimacy or flattery; persistent interest in strategy, negotiations, regulators or internal disputes; contrived coincidences in travel or social plans; unusually generous hospitality or gifts; pressure to keep the relationship quiet; and requests to move communications to personal devices or encrypted apps.

How can a compromising relationship threaten an organization beyond information theft?

Rinckey: For a sophisticated foreign intelligence agency, influence is often worth more than theft. It helps to distinguish a source, who provides information, from an agent of influence, who shapes decisions, narratives or policy positions.

A cultivated executive can shape decisions about which markets to enter, which partners and customers to prioritize, how to allocate scarce products and what position the company takes on export controls and regulation.

The executive can also broker access to government officials, board members and other executives, help the service identify its next targets, and bring favored vendors, consultants, investors or hires inside.

Leverage can sit dormant for years until the foreign agency needs it, at which point cultivation can turn into coercion. The damage is easy to miss because compromised decisions look like ordinary business judgment.

There is also a cultural cost. When employees see that leadership is exempt from scrutiny, the security program loses credibility across the organization.

Building counterintelligence into executive protection

What counterintelligence measures belong in executive protection programs?

Rinckey: Executive protection traditionally protects the principal’s physical safety, while counterintelligence protects the principal’s judgment, access and relationships. The fix is to build counterintelligence into the executive protection program rather than treat it as a separate discipline, ideally by giving someone with counterintelligence training a defined role in the program and a direct line to the general counsel.

Travel is where much of the risk sits. Executives traveling to high-risk countries should receive destination-specific briefings and use loaner phones and laptops that have no access to sensitive systems and are wiped or retired on return. Those rules should apply to the CEO as well.

Companies can borrow a contact reporting model from the federal SEAD 3 framework. A company version should expressly cover the C-suite and the board, and it should tie gift and hospitality reporting to the company’s existing anti-corruption compliance process.

Training should be built for executives, not generic phishing modules. The program should also reduce the digital footprints of executives and their families and offer briefings to spouses and family members on a voluntary basis, since they share the executive’s travel and social life.

The inner circle (assistants, drivers, household staff, event organizers and close advisors) should be vetted, because they control the executive’s schedule and access and are themselves targeted.

A practical cadence is an annual executive briefing, a destination-specific briefing before high-risk trips, and a debrief within days of return. Protection staff need a written escalation path that protects their jobs when they raise a concern.

How should security teams investigate suspected foreign intelligence targeting?

Rinckey: The first move is to bring in counsel. Running the assessment at an attorney’s direction helps preserve privilege, keeps the company’s options open and reduces the risk of tipping off the operative or alienating the executive.

A practical workflow runs in six steps: (1) intake and immediate escalation to counsel; (2) preservation of relevant records under counsel’s direction; (3) assessment of the counterparty using open and lawful sources; (4) limited, policy-compliant review of company systems if warranted; (5) a decision on whether to engage and report to U.S. government agencies; and (6) a decision on the conversation with the executive and any interim limits on access.

The team should define the concern precisely, writing down what has been observed separately from what is being inferred.

Nationality or ethnicity is never an indicator. Treating it as one invites national origin discrimination claims, and it is poor counterintelligence because it produces false positives while the real threat goes unnoticed.

Speculation is filtered out by testing the facts against benign explanations, having a second reviewer who is not invested in the original theory check the analysis, and agreeing on escalation thresholds in advance.

Every step should be documented, knowledge limited to those who need it, and the response kept proportionate.

Often the most effective step is a respectful, non-accusatory conversation with the executive, framed as protection rather than investigation, because many targeted executives are victims rather than collaborators.

Establishing independent oversight and accountability

What happens when the executive under scrutiny is the CEO?

Rinckey: A security director cannot independently assess the CEO they report to. The conflict is structural, not personal, so the solution must be structural too, and it must be designed before a crisis.

The answer is a written, board-approved procedure that routes concerns about senior leadership from the security director to the general counsel and to an independent director, usually the chair of the audit or risk committee or the lead independent director.

If the general counsel is too close to the executive, the committee should be able to retain outside counsel directly. The policy should protect the person who raises the concern from retaliation, or the concern may never be raised.

Once a concern is escalated, a committee of independent directors should own the inquiry, with outside counsel and independent investigators reporting to it rather than to management.

The executive should not direct the inquiry, control access to the relevant systems or shape internal messaging about it, and information should be tightly compartmented.

Companies should pre-designate outside counsel and investigators and pre-clear their engagement terms so the committee can act within days.

Boards should think through outcomes in advance. The range runs from a defensive briefing for the executive, to limits on access or recusal from certain decisions, to a leadership change.

What are the biggest gaps in corporate counterintelligence preparedness?

Rinckey: The largest gap is the executive exemption. Insider risk programs are built around rank-and-file employees, while senior leaders, the most attractive targets, are excused from the training, device restrictions, travel protocols and reporting requirements everyone else follows.

Several other gaps compound it. Many companies treat counterintelligence as a cybersecurity problem, but human targeting goes around technical controls entirely. Few have pre-agreed governance for a concern about the CEO.

The priorities follow from the gaps: adopt a board-approved policy that expressly brings executives and directors into the insider risk and counterintelligence program, with a clear escalation path for concerns about senior leadership; build counterintelligence into executive protection; provide executive-specific elicitation training at least annually; connect counterparty due diligence across sales, export compliance and security; establish relationships with the FBI and, for cleared companies, DCSA before there is a problem; run a tabletop exercise in which the subject of the concern is the CEO; have counsel set legal guardrails for any assessment; and report metrics to the board at least annually.

None of this means treating executives as suspects. These protections are protections for executives, and a well-run program makes it easier to clear an executive quickly when a concern turns out to be unfounded.