Insights / Executive Protection

Baseline, Anomaly, and the Cluster: How Protectors Read Pre-Attack Behavior

By Warren Pulley · November 8, 2026

One of the most useful ideas in The Protective Detail is one I carried from patrol in Los Angeles into protective work: the baseline. Every environment has a normal rhythm. A threat usually shows itself first as a break in that rhythm.

How do you establish a baseline?

On a detail, you set the baseline during advance work and in the first minutes at any location. The book gives agents a short set of questions:

• What is everyone here doing, and why are they here?
• How are people dressed for this weather, this venue, and this time of day?
• Where are people looking: at their phones, the stage, the door?
• How fast do people move through this space?
• Who works here, and how can I tell?

Then you watch for the person who does not fit. Not the person who looks different, which is a trap that leads to bias and missed threats, but the person who acts different: moving against the flow, watching the principal instead of the event, standing where nobody has a reason to stand.

What are pre-attack indicators?

The book lists indicators protectors watch for in the last minutes and seconds before an attack, including:

• Target focus: sustained attention on the principal or the protective team when everyone else is focused elsewhere.
• Hand behavior: hands hidden, or repeated touching of the waistband or a pocket.
• Clothing that doesn't fit the conditions: a heavy coat in the heat.
• Blading: turning one side of the body away.
• Approach behavior: closing distance against the social flow or moving to intercept a predicted path.
• Scanning for authority: checking where police, security, and the detail are standing.
• Sudden stillness or sudden purpose.

Why does no single sign mean anything?

A cold person wears a coat. A nervous fan touches her face. What you look for is a cluster: several indicators together, focused on your principal, in a place and at a time where they do not fit. That discipline keeps agents from overreacting to innocent behavior and from underreacting to a real pattern.

Police instincts, protector reflexes

The book is honest about what policing gives a protector and what it does not. Police are trained to move toward a problem. Protectors are trained to move the principal away from it. A confrontation keeps the principal in the danger area, so a good agent keeps the instincts and questions the reflexes. As the book puts it, the first tool a new agent uses is not their hands and not their weapon. It is their feet.

What else does the book cover?

It is a plain-spoken field guide to how executive protection works, from advance work and choke points to motorcades, arrivals, protective intelligence grounded in published Secret Service research, insider threats from staff, drivers, and vendors, and hiring protection well. Its appendices include an advance survey, movement plan, threat intake form, emergency action plan, hotel security checklist, and vendor vetting checklist. For the threat assessment side, read Targeted.

Working on a threat concern now? Get the free Threat Assessment First-Response Checklist.