For most of the last two decades, executive protection sat quietly under the corporate security function — a line item, a logistics expense, occasionally a perk. Directors heard about it when a CEO traveled overseas or when something went wrong. Otherwise, it lived three or four levels below the boardroom.
That posture is no longer defensible. After a year of widely reported attacks on senior executives, a roughly doubled volume of executive-targeting incidents through 2025, and the September 2025 release of the first ANSI-accredited ASIS Executive Protection Standard, executive protection has crossed a threshold. It is now a governance topic. Directors, audit committees, and CFOs need a clear point of view on it — the same way they have a point of view on cybersecurity, financial controls, and crisis communications.
This article is written for that audience. Not for security professionals. For the people who sit on boards, chair audit and risk committees, sign 10-Ks, and own the fiduciary duty to oversee material risk.
Why the Conversation Has Moved Upstream
Three forces, compounding.
1. The threat curve. Public industry reporting through 2025 documented a sharp rise in executive-targeting incidents — roughly double the prior year — alongside increased use of deepfake-enabled impersonation against finance and HR functions. The targets are no longer just household-name CEOs of the largest companies. Mid-cap, pre-IPO, family-office, and private-company principals are increasingly visible — and increasingly named in credible threats. The Brian Thompson incident in December 2024 made the point that a sitting Fortune 500 executive could be killed on a public sidewalk in midtown Manhattan, in front of a hotel his company had booked, with effectively no protective coverage. Boards have not been able to un-see that fact.
2. Materiality. When a key executive is incapacitated, threatened, or killed, the company experiences a real, measurable event — stock price reaction, operational disruption, succession scramble, regulatory inquiry, customer concern, employee fear. Those are not abstract harms. They are the kind of "material" that boards are obligated to oversee under enterprise risk management frameworks and, in public-company contexts, are increasingly expected to discuss in risk-factor disclosures.
3. Standardization. Until September 2025, there was no ANSI-accredited industry standard for what a competent executive protection program actually looks like. There is now. The ASIS Executive Protection Standard sets out a structured framework — leadership and governance, risk assessment, program design, operations and resources, continuous improvement — that boards can use as a reference point. The existence of a recognized standard changes the legal and governance posture: "we didn't know what good looked like" stops being a defensible answer.
From "Security Expense" to Fiduciary Concern
The reframing matters because it changes who is responsible.
When executive protection is a line item, it gets cut in lean years, scoped down by procurement, and quietly under-resourced — until something happens, at which point the board asks why the program was where it was. That sequence is now well-documented across multiple recent incidents.
When executive protection is a governance concern, it sits inside a different conversation. It belongs to the same family of topics as:
- Cybersecurity oversight — where the SEC's 2023 rules put board-level accountability on the map.
- Crisis preparedness and business continuity — where directors are expected to ensure plans exist, are tested, and are funded.
- Key-person risk and succession — already a standard board topic, now with a physical-security dimension that cannot be separated.
- Disclosure obligations — where material risks to the enterprise must be discussed in public filings.
The question for directors is no longer "Do we pay for the CEO's car service?" The question is "Have we satisfied our oversight duty regarding a known, escalating category of enterprise risk?"
What the ASIS Standard Actually Asks Of Organizations
Boards do not need to read the full ASIS document to govern around it. The five program areas it codifies map cleanly to questions a director can ask in a single meeting.
1. Leadership and Governance. Who owns the executive protection program? To whom does that person report? Does the board (or its risk/audit committee) receive a regular briefing? Is there a written charter that defines scope, decision rights, and escalation thresholds?
2. Risk Assessment. Is there a documented, current threat and vulnerability assessment for each covered principal — not just the CEO, but other named executives, the CFO, the General Counsel, and where relevant their immediate families? When was it last updated? What methodology was used? Who reviewed it?
3. Program Design. Is coverage scoped to the actual risk picture, or is it improvised? Is there a written program document covering routine operations, travel, events, residence, and crisis response? Are the inputs — protective intelligence, advance work, transportation, residential security, training — all addressed, or are there obvious gaps?
4. Operations and Resources. Are the people doing this work appropriately credentialed and trained? Are vendors vetted? Are insurance, legal, and HR aligned with the program?
5. Continuous Improvement. Are incidents (including near-misses and online threats) captured, reviewed, and used to update the program? Is there an annual or biennial third-party review? Is the program tested through tabletop exercises?
A board does not need to manage the program. It needs to assure itself that the program exists, is current, is competent, and is funded — and to record that assurance. That is the same standard the board applies to financial controls, cybersecurity, and crisis communications. There is no longer a defensible reason to apply a lower standard here.
The CFO and Audit Committee Lens
Two specific roles deserve attention.
The CFO is now central to this topic because the financial exposure of an unaddressed executive-security incident is unambiguously material for most companies in the AMERINE client profile. The CFO should be able to answer, on the record:
- What is our current annual spend on executive protection, broken out by principal and by category (routine, travel, events, residence, intelligence)?
- How does that spend compare to the assessed risk and to peer benchmarks?
- What insurance coverages — kidnap-and-ransom, business travel accident, key-person, directors and officers — are tied to this program, and are the policy conditions actually being met by current practice?
- What is the financial exposure to the company in a worst-case scenario, and how is it being mitigated?
If the CFO cannot answer those questions, the program is being managed by hope rather than by governance.
The audit committee — or the risk committee where one exists — should be receiving a written executive protection briefing at least annually, ideally semi-annually, with the same rigor as a cybersecurity briefing. The briefing should cover the current threat picture, program changes year-over-year, incidents and near-misses, the results of any third-party review, and any material gaps. The committee should record the discussion in its minutes. That record matters in a downside scenario.
What Good Looks Like, Practically
A board-grade executive protection program does not mean a permanent armored motorcade for every senior executive. It means a program scoped to the actual, assessed risk — with the ability to scale up quickly when the risk picture changes.
In practice, the AMERINE programs that satisfy this standard typically include:
- A current, written protective intelligence baseline for each covered principal — what is publicly exposed, what is being said online, what the realistic threat vectors are. Refreshed at least annually and after any material change (new role, public announcement, litigation, layoff cycle).
- A standing relationship with a vetted executive protection provider — not a vendor list, an actual operational relationship — so that coverage can be stood up inside hours, not days, when the picture changes.
- Documented protocols for high-risk moments: earnings calls, layoffs, contentious public statements, M&A announcements, regulatory actions, international travel, public appearances. These are predictable triggers and they should not be improvised each time.
- Residential and travel security postures appropriate to the principal — which may be minimal in steady state and substantial during a flagged window.
- Family and household coverage where the threat picture includes them, with clear protocols for assistants, drivers, and household staff who handle sensitive logistics.
- Crisis playbooks that integrate physical security with legal, communications, HR, and the family — so that the first hour of an incident is not spent figuring out who to call.
The board's job is not to design any of that. The board's job is to confirm it exists, is competent, and is funded against the assessed risk — and to record that confirmation.
What Directors Should Ask in the Next Meeting
Five questions for the next board, audit committee, or risk committee meeting. They take less than thirty minutes to walk through and they produce a defensible record.
- Who owns our executive protection program, and when did the board last receive a substantive briefing on it?
- Do we have a current, documented threat and vulnerability assessment for each named executive officer? When was it last updated?
- Have we benchmarked our program against the ASIS Executive Protection Standard released in September 2025, or had a third party do so?
- What is our coverage and response posture for predictable high-risk moments — earnings calls, layoffs, M&A, regulatory actions, international travel?
- What is our financial exposure to a worst-case incident, and how is it being mitigated through program design and insurance?
If the answers are not crisp, the board now has the information it needs to act.
The Bottom Line
The combination of a doubled threat curve, several high-profile incidents fresh in public memory, and a brand-new ANSI-accredited industry standard has moved executive protection from the security function's office into the boardroom. Directors who treat it as a personal-security matter for the CEO are working from a model that the rest of the world has already moved past. Directors who treat it as a governance and fiduciary topic — and document their oversight accordingly — are operating to the standard that will be expected of them.
If your board has not had a substantive executive protection discussion in the last twelve months, that is the place to start. AMERINE works with boards, general counsel, and CFOs to baseline programs against the ASIS standard and to scope coverage to the actual risk picture. Contact AMERINE for a confidential conversation about your program.
Sources & Further Reading
- ASIS International — Executive Protection Standard (ANSI/ASIS EP-2025). Released 23 September 2025; first ANSI-accredited standard defining best-practice EP program design. asisonline.org — Executive Protection Standard
- ASIS International — Introducing the ASIS Executive Protection Standard: 10 Things to Know. Plain-language summary of the standard's structure and intent. asisonline.org PDF
- Ontic — 2025 State of Protective Intelligence Report. Annual benchmark on executive-targeting incidents, threat volume, and corporate-security program maturity. ontic.co/resources
- Allied Universal — World Security Report. Surveys CSOs at large enterprises on threat trends year over year. aus.com/world-security-report
- National Association of Corporate Directors (NACD) — Director's Handbook on Cyber-Risk Oversight (related framework). Useful analog for how boards now oversee adjacent enterprise risk categories. nacdonline.org
- SEC — Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure Rules (2023). Reference for the disclosure and oversight posture being extended into adjacent risk categories. sec.gov
Threat figures cited as "roughly doubled" reflect directional trends across the reports above as of the most recent reporting cycle; exact percentages vary by methodology and survey population.
---
A note on terminology: ANSI accreditation applies to the ASIS Executive Protection Standard itself, which was developed through the ANSI consensus process. It is not a credential issued to security firms. AMERINE is not an "ANSI-accredited" or "ANSI-certified" provider — no such designation exists for EP firms — and benchmarks its program against the ASIS standard as a reference framework.
General governance and security-planning commentary for directors and senior corporate officers. Not legal, accounting, or fiduciary advice; readers should consult counsel and qualified advisors regarding the specific application of these topics to their organization.
