Why One Cycle, Not One Per Event
There is a temptation, every time a new mega-event hits the calendar, to build a bespoke intelligence plan for it. World Cup 2026 gets its own playbook. LA28 Olympics gets another. Davos 2027 gets a third. The Super Bowl, the Ryder Cup, the inauguration each get their own.
After enough cycles, the pattern is clear: the events differ, but the intelligence cycle does not. The trigger dates change. The output formats stay the same. The decision points stay the same. The 30/14/7/72 framework we run for World Cup principals is the same one we run for Davos delegations, Ryder Cup family trips, and presidential-cycle corporate travel.
This article lays out that framework. It is the operational backbone behind our mega-event protective doctrine and the intelligence layer that sits behind every program described in our Family Office Security Strategy pillar.
The Cycle in One Diagram
Four trigger windows, four written outputs, four decision gates.
T-30 days — Baseline. Initial assessment, named-operator confirmations, alternate-venue and alternate-route research.
T-14 days — Pressure-Test. Threat-environment update, hotel and route walk plans, principal and family briefing, EA digital hygiene briefing.
T-7 days — Lock. Final movement schedule, named-driver and named-protector confirmations, medical and legal references confirmed, daily intel rhythm begins.
T-72 hours through T+24 — Daily. Daily written read on the threat environment, real-time movement adjustments, post-event debrief in the first 24 hours after departure.
Each window has a written output that the principal and the principal's designate (chief of staff, family-office security director, corporate security lead) actually read. If a window has no written output, it did not happen.
T-30 Days: Baseline
This is the only window with meaningful per-event research. Everything later builds on it.
Outputs:
- Event-specific threat baseline. What is the federal coordination posture (NSSE, SEAR-1, etc.)? Who is the lead federal agency? What public protest, demonstration, or counter-protest activity is announced? What is the historical adversary attention profile for this event class (state-actor cyber, opportunistic crime, targeted attacks)?
- Named-operator file. Lead protector, alternate protector, lead driver, alternate driver, medical reference, legal reference, on-property security director per hotel. Names and résumés, not "we will assign." This is the single highest-leverage step in the entire cycle.
- Movement skeleton. Primary and alternate routes between every fixed point. Walk-and-drive of each, where feasible. Identified chokepoints, identified hospitals, identified safe-stop locations.
At T-30, the supply of competent local capacity is still available. At T-14, it is half-booked. At T-7, it is gone. The teams that win the operator-supply problem do it at T-30.
For World Cup-specific examples of this work, see our 14-day pre-departure countdown and the host-city pressure analysis. The structure is identical for an Olympics, a Davos week, or a Super Bowl trip.
T-14 Days: Pressure-Test
Two weeks out, the baseline is tested against current conditions. New information always exists.
Outputs:
- Threat-environment update. What has changed in the public reporting, the federal posture, the local-jurisdiction announcements? What new protests are scheduled? Has any credible adversary signaling appeared (state-actor cyber advisory, lone-actor threat in open source, infrastructure incident)?
- Hotel walk plan. Lobby bypass confirmed. Elevator-bank discipline confirmed. Floor and suite confirmed. Egress route through back-of-house walked and timed. Named on-property security director introduced.
- Principal and family briefing. Written, one-page. What to wear, what not to post, what app to use, what number to call, what to do if separated, what to do if extracted. Read aloud, not emailed.
- EA / chief-of-staff digital briefing. OSINT footprint scrub. Social engineering vectors specific to this event (ticket-app phishing, "lost credential" outreach, deepfake travel confirmations). What to verify before forwarding, what to never forward.
If the principal travels with family, the family briefing is its own document. Spouses, adult children, and minors each carry distinct exposure profiles — this is the same point we make in the family office security strategy framework, applied to a single trip.
T-7 Days: Lock
One week out, the movement plan is locked. Changes after this point degrade execution.
Outputs:
- Final movement schedule. Every minute from wheels-down through wheels-up, with named protector, named driver, primary and alternate route, and explicit handoffs.
- Named-operator confirmations. Re-confirmed in writing. Substitutions documented. No floating slots.
- Medical and legal references. Closest Level-1 trauma center per fixed point. Local counsel contact for any incident requiring representation. Insurance carrier numbers (K&R, evacuation, cyber) on the protective team's go-bag card.
- Daily intel rhythm started. Push begins three days early so the principal is reading the format already by T-72.
The single most common protective failure we see is a late change inside this window. A new dinner added at T-3 to an unvetted restaurant in an unfamiliar neighborhood, with a hotel-arranged driver the team has never met. The protective doctrine for handling that, at every event: the team gets a vote. Late additions that violate doctrine get pushed back or rerouted, in writing, before they happen.
T-72 Hours Through T+24: Daily
The cycle becomes a rhythm. One written read each morning, one rapid update each evening, real-time push of anything material.
Each daily read covers:
- What changed in the last 24 hours in the federal, local, and event-specific environment.
- What we are watching in the next 24 hours.
- Any triggers for a movement change (route, time, mode, principal-only versus family).
- Status of named operators and any substitutions.
This is the layer most protective programs underinvest in. A T-30 baseline without a T-72 daily read is a beautiful document that becomes stale on contact. A T-72 daily read without a T-30 baseline is reactive and lacks context. The two are a system.
Post-event debrief at T+24 closes the loop. What worked, what nearly failed, what is going into the doctrine. This is how the cycle compounds across events. The World Cup debrief feeds the Ryder Cup plan. The Davos debrief feeds the Super Bowl plan. The Olympics 2028 plan is being written, right now, from 2024 and 2026 debriefs.
Where Family Offices and Corporate Programs Underbuild
Three under-builds we see consistently.
Under-build one: no T-30 named-operator file. The team has a vendor; the vendor will "send someone." Names get assigned 48 hours out. Quality is whatever happens to be available. The fix is to require named operators in writing at T-30, and to push the procurement timeline up by a full quarter ahead of the next event.
Under-build two: no daily intel product during the event. Briefings happen pre-trip. Once the principal is on the ground, intelligence becomes "if something happens, the protector will call." Mega-event soft-target environments change every twelve hours. The discipline of a written daily read is what catches the change before it catches the principal.
Under-build three: no T+24 debrief. The trip ends, the team rotates off, the lessons evaporate. The doctrine never compounds. Programs that institutionalize a written debrief — three pages, ten minutes to read — get measurably better with each mega-event. Programs that do not, re-learn the same lessons every cycle.
These are the same three under-builds at the World Cup, the Olympics, Davos, the Super Bowl, and every other mega-event we have covered. They are not event-specific. They are program-design failures, fixable by adopting the cycle.
Running the Cycle Without Doing It Yourself
For most family offices and corporate security functions, the cycle is too operationally intensive to run in-house for every mega-event on the principal's calendar. That is the work we do for retained clients through our memberships and on a per-engagement basis through our protective intelligence and event security services. The cycle runs the same way for a single World Cup match, a full Davos week, a Ryder Cup VIP weekend, or a Super Bowl trip.
The doctrine behind it — and the broader program-design point that mega-events are one recurring class, not eleven separate problems — is laid out in our mega-event protective doctrine and in the Family Office Security Strategy pillar.
If you would like AMERINE to run this cycle against your principal's upcoming mega-event calendar — the rest of the 2026 World Cup, the Ryder Cup, Davos 2027, LA28 planning, or the next inauguration cycle — contact us. Scott takes every first call personally.
---
General security-planning commentary based on AMERINE protective experience across federal-led, NSSE, and major private-event programs. Not legal, law-enforcement, or operational advice for any specific event. Coordinate sensitive movement decisions with corporate security, counsel, and local authorities.
