Counter-surveillance in executive protection is the practice of detecting and disrupting the people who are watching a principal in the days, weeks, or months before they act. It rests on a simple truth that drives modern protective work: most targeted attacks are not spontaneous. They are planned, and planning requires the attacker to observe the target's habits, routes, and routines first. The protective team that spots that observation gains the single most valuable thing in security, which is time.

Behavioral research from the U.S. Secret Service National Threat Assessment Center has consistently found that attackers who target public figures and public spaces tend to plan their actions and display observable warning behaviors beforehand, rather than striking without any prior indication (USSS NTAC). Surveillance is where much of that planning happens in the physical world. If a protective detail can identify a person conducting hostile surveillance, it can change the principal's pattern, alert law enforcement, or simply deny the attacker the predictability they depend on.

What is the attack cycle, and where does surveillance fit?

Security professionals describe targeted violence as a sequence often called the attack cycle: target selection, surveillance and planning, rehearsal, approach, and the attack itself. The surveillance phase is the longest and the most observable. An attacker has to learn when the principal leaves home, which vehicle they use, where they park, and where they are most exposed.

That phase is also the attacker's greatest vulnerability. While conducting surveillance, a hostile observer has to be present, has to linger, and has to pay attention to the principal in ways that ordinary people do not. Those behaviors leave a signature. Counter-surveillance exists to read that signature and act on it before the cycle reaches the approach phase. At MPS Security, we treat the surveillance phase as the window where an attack is most preventable, because it is where the threat is still forming rather than unfolding.

How do executive protection teams detect hostile surveillance?

Surveillance detection blends disciplined observation with knowledge of how attackers behave. A trained team looks for a combination of factors rather than any single tell. Common indicators include:

1.         Correlation: the same person, vehicle, or face appearing across different times and locations tied to the principal's routine.

2.         Poor demeanor: someone who is watching the principal but trying to look as if they are not, often reacting awkwardly when noticed.

3.         Fixed observation posts: a person or vehicle positioned with a clear line of sight to an entrance, garage, or chokepoint the principal must use.

4.         Note-taking, filming, or photographing access points, security measures, or arrival and departure patterns.

5.         Probing: testing the response of security staff, lobby personnel, or access controls.

No one of these proves hostile intent. Taken together, and especially when they repeat, they justify a closer look. Detecting them reliably depends on operators who can observe without being obvious, which is why surveillance detection is closely tied to a deliberately low-profile protective posture.

Why counter-surveillance matters more than ever

The threat environment for senior executives and other prominent individuals has intensified. Open-source reporting and industry threat compilations have documented a sharp rise in incidents targeting corporate leaders over the past several years, a trend that accelerated after several high-profile attacks drew public attention to executive exposure. While those industry figures come from private threat-tracking sources rather than government data, the direction is consistent with what protective teams see in the field: more research, more online targeting, and more physical surveillance of principals and their families.

Counter-surveillance is the discipline that turns that reality into action. It is not about paranoia or about following the principal with an obvious entourage. It is about understanding the risk-mitigation thinking behind protective planning and applying it to the one phase of an attack where the threat is still observable and still preventable. A program that watches for watchers gives the principal the option to never become a target at all.

How counter-surveillance integrates with the rest of a protective program

Surveillance detection does not operate in isolation. It feeds the advance work that surveys venues before the principal arrives, it informs route selection and timing, and it shapes how a detail manages arrivals and departures, which are the moments of greatest exposure. When a counter-surveillance element flags a pattern, the protective team can adjust in ways an attacker cannot anticipate: changing departure times, varying routes, adding a second vehicle, or moving a public appearance to a more controlled setting.

The most effective programs also document and share what they observe. A logged, photographed pattern of suspicious activity becomes actionable intelligence for law enforcement and, if needed, evidence for a protective order. In our experience, the firms that prevent attacks are the ones that treat every anomaly as information rather than coincidence.

Frequently asked questions

What is the difference between surveillance and counter-surveillance?

Surveillance is observing a target to gather information. Counter-surveillance is detecting and disrupting that observation. In executive protection, counter-surveillance is defensive: its purpose is to identify anyone studying the principal so the team can respond before an attack.

Can counter-surveillance actually prevent an attack?

It can. Because most targeted attacks require a planning and surveillance phase, detecting that activity early gives the protective team time to alert authorities, change patterns, or harden a location. Removing the attacker's predictability often removes the opportunity to attack.

Does counter-surveillance require a large, visible security team?

No. Effective surveillance detection usually depends on a small number of discreet operators who can observe without drawing attention. A large, obvious presence can actually push hostile surveillance to a distance where it is harder to detect.

Who needs counter-surveillance services?

Corporate executives, public figures, high-net-worth families, and anyone facing a credible, persistent threat can benefit. It is especially valuable for principals with predictable routines, public visibility, or a known dispute that raises their risk profile.

How is counter-surveillance different from advance work?

Advance work secures a specific location or event before the principal arrives. Counter-surveillance focuses on detecting people who are watching the principal over time, across locations. The two functions complement each other within a complete protective program.

Talk to a protective team that watches for the watchers

The earliest sign of a targeted attack is often someone paying attention to a principal who should not be. Detecting that attention is a discipline, not a guess, and it is one of the highest-value capabilities a protective program can offer. To discuss counter-surveillance and a protective plan tailored to your risk profile, contact MPS Security & Protection.

About the author

Michael D. Julian brings more than 30 years of experience in security, investigations, and executive protection. He served as President of the California Association of Licensed Investigators (CALI) from 2005 to 2015 and leads the executive protection practice at MPS Security & Protection, where he advises corporate and high-net-worth clients on threat mitigation and protective operations. Connect with Michael on LinkedIn.