Closing the Gap Between Threat Detection and Response
Key Highlights
- Detection alone isn't enough: Advances in threat intelligence and security technology are outpacing some organizations' ability to respond effectively.
- Executive protection demands are evolving: Rising threats are prompting companies to reassess executive risks, protection strategies and staffing needs.
- Response readiness requires preparation: Clear decision-making authority, coordinated crisis plans and regular exercises help organizations respond when threats emerge.
Security organizations have more tools than ever to identify potential threats. Threat intelligence platforms, AI video analytics, access control and automation promise earlier warnings and fewer blind spots. But the ability to detect a threat does not necessarily mean an organization is prepared to respond effectively.
That distinction surfaced in conversations among security leaders at GSX 2026, where questions extended beyond technology to whether crisis plans would hold up under pressure and who would make the call when an incident crossed departmental lines. Many security leaders had also recently taken on executive protection responsibilities and were asking where to start and how to find agents they could trust.
The concern was not simply identifying risks. It was determining whether organizations had the people, processes and authority to act on that intelligence.
That distance is the response gap.
What response capability means
Consider a fictional scenario: A monitoring service flags a credible threat against the CEO at 9 p.m. on a Sunday. Before morning, someone must assess the threat and determine who needs to be notified. Monday's travel plans may need to change, and protection agents may need to be called in. Employees and the board will expect updates.
If those roles and thresholds aren’t defined in advance, the organization spends its first hours working out who’s in charge and how to proceed.
Some incidents never pass through the security department. At the engineering firm Arup, an employee wired about $25 million after a video call in which every other participant was a deepfake. That loss turned on whether a finance employee had a verification protocol to follow and knew when to escalate an unusual request.
Readiness must extend to finance, IT, executive support and communications teams, since any of them can be the first to receive an attacker’s request.
Response capability is the operating model that prepares an organization for both physical and digital situations. It includes governance, decision-making authority, escalation protocols, crisis management, business continuity, communications, trained professionals and trusted outside partners.
In this environment, technology tells an organization what’s happening, and people with clear authority and practiced judgment decide what to do about it.
Where the gap shows up
Requests for security services can reveal where organizations lack the preparation or in-house resources needed to respond effectively. Three trends illustrate how companies are addressing those gaps:
- Requests for next-day protection have risen sharply. So have requests for crisis management plans, often from companies replacing an outdated plan or writing their first. In a Q4 2025 survey, 31% of mid-cap companies and 13% of large-caps had no formal crisis management plan. Among mid-caps that did have one, only a quarter reviewed and tested it at least every two years.
- Hybrid models are taking hold. The most mature programs keep ownership and decision-making inside the company and bring in trusted partners for specialized expertise or geographic reach. Partners also supply surge capacity when an incident outgrows the internal team. They’re most effective when they know the program before a crisis starts.
- Companies are hiring for demonstrated competency. For everyday coverage at corporate facilities, more organizations want protection agents who have shown sound judgment, clear communication, situational awareness and the ability to de-escalate tense moments. Leaders increasingly evaluate agents on how they’ve handled real situations.
Executive risk exposes the readiness gap
The December 2024 assassination of UnitedHealthcare CEO Brian Thompson in Manhattan heightened attention to executive protection. According to Equilar, more than a third of S&P 500 companies assigned security to executives in 2025, up from 24% four years earlier.
AI companies now face some of the sharpest exposure. In April, a man allegedly threw an incendiary device at OpenAI CEO Sam Altman's San Francisco home. Two days later, gunfire was reported at the residence, although authorities had not established whether Altman was deliberately targeted. Separately, data from security intelligence company Liferaft, cited by the Wall Street Journal, showed that online threats against AI executives and data centers increased sevenfold between late February and May.
Many security leaders have relatively little experience developing executive protection programs. Professionals with extensive experience protecting dignitaries and high-net-worth families often work outside traditional corporate security environments. At GSX 2026, security leaders expressed interest in advisers who could assess executive risks, develop appropriate protection programs and identify vetted agents through established professional networks rather than personal referrals alone.
Executives don’t always see their own exposure. Some assume a low profile keeps them safe and overlook the visibility that comes with their board seats or their family’s social presence. At many companies, legal counsel or the board initiates protection as a part of its duty of care.
Executive risk also shifts quickly. An IPO or an unpopular product launch can raise an executive’s threat level within a week, and it may fall again just as fast. A program built around a set level of protection for events and travel, with continuous monitoring and preapproved criteria for scaling up, can absorb those swings without starting from scratch each time.
3 ways to close the response gap
Closing the response gap requires more than additional technology. Security leaders can strengthen organizational readiness by focusing on three practical priorities.
Keep the risk picture current
Risk changes with the business. New facilities, leadership changes, public controversies and shifts in the threat environment can all alter an organization's exposure between formal assessments. Continuous monitoring keeps leadership aware of those changes as they happen, and a regular reassessment cycle confirms the program still fits the risk. Independent reviewers can add an outside perspective at key moments, such as after a major incident or a change in security leadership.
Build one plan for prevention and response
Security technology projects can take years to win approval, which is long enough for the risks behind them to change. Budgets hold up better when a current assessment shapes them and when crisis management, business continuity, communications and legal teams help set priorities alongside security. The aim is a single plan that funds detection and response in proportion to the risk, with a named owner for each.
Rehearse the decisions
The Sunday-night threat and the deepfake call offer useful scenarios for tabletop exercises. Exercises built around plausible events can reveal whether decisions reach the appropriate people quickly enough and whether outside partners can mobilize when needed. Senior leadership should participate in these exercises.
From intelligence to action
Detection and prevention remain fundamental to an effective security program. But its success also depends on an organization's ability to make decisions, mobilize resources, protect people and maintain or restore operations when an incident occurs.
When an incident occurs, security teams will be judged by how quickly operations resume and the extent of the resulting financial and reputational damage. Organizations that develop response capabilities alongside their threat intelligence capabilities are better positioned to minimize those consequences.
About the Author
Melissa MackMelissa Mack
Managing Director
Melissa Mack, CPP, is a Managing Director at Pinkerton with more than 20 years of experience in security. A member of the ASIS Professional Certification Board, Mack is passionate about mentoring the next generation of security professionals.