A physical security incident can start with a conference keynote photo, a charity-gala caption, or a school-fundraiser post that tags a neighborhood. 360 Privacy’s survey of security and wealth professionals found more than eight in ten now treat cybersecurity and physical safety as one problem, while high-profile executives still act as if the street can’t find them. Digital exposure is already converting into physical risk. A search bar and an afternoon of patience are enough to assemble the packet.

Your threat-protection stack at the office edge won’t see that. It’s watching packets. The targeting starts in search indexes, people-finder sites, and the executive’s own press page.

Cybersecurity that stops at the firewall leaves the house on the map

The survey’s most useful finding is also the most embarrassing. More than eight in ten of the people paid to worry about this already agree the split is dead. The people with the public calendars haven’t caught up.

More than 8 in 10 security and wealth professionals say cybersecurity and physical security can no longer be separated.

Write that on the whiteboard. Then look at what your CEO posted last week. Feelings of being untouchable show up as open school names, license-plate vanity, home-office Zoom backgrounds, and live travel posts. Each item is a courtesy to a stranger building a movement plan. You already know how this works for principals in higher-risk countries. Plenty of US and European programs still file it under celebrity problems and move on.

Family accounts are the softest layer. A spouse’s running club. A kid’s tournament schedule. A nanny’s tagged story. None of that hits your SIEM. All of it tells someone when the house is empty and which gate the driver uses.

People-search brokers industrially convert that residue into paid dossiers. If you’ve never ordered your own, do it once. Then look at it the way a hostile would: home, prior addresses, relatives, court records, property maps. That dossier is cheaper than a decent phishing kit, and it’s reusable across every future campaign against the same human.

Corporate comms will call this a privacy preference. Treat it as an unmonitored control gap. The same leader who will fund badge readers and a SOC will still post a groundbreaking photo from the driveway.

AI planning turns a public bio into a movement order

Office cyber security still gets the budget because it produces tickets. Personal OSINT produces a knock, a tail, or a tailored pretext call to the executive assistant. Unit 42’s write-up of a threat actor who used AI to plan real crime is the acceleration layer you should assume is already in play.

The operator bypassed AI safety controls and used the model to coordinate credential theft, VoIP fraud planning, and database exfiltration. That mix is a planner sitting on top of public data. Give it a bio, a company org chart, and a few leaked mail formats, and it will help sequence the human parts of the job: who to call, what to steal, which story will clear the front desk.

Recovery questions sitting in a 2019 interview beat a brute-force run against the mailbox. An EA out-of-office that names the hotel beats guessing VoIP forwarding rules. Defense in depth that only hardens the corporate firewall is theater once the identity is preassembled off-network.

Threat detection still keys on malware, impossible travel, and known-bad IPs. Physical targeting keys on patterns: gym hours, school pickup, the restaurant the board uses after earnings. Your incident response runbook should name both. If the first time physical security and the SOC share a channel is after a stalker report, you’re late.

Researchers have already shown that AI attackers can be sent into dead ends. So-called context bombs, deceptive prompts and fake targets, cut agent attack success by up to 91 percent in tests and raised the cost of a successful run 23-fold. That result is about misleading machines. Steal the idea for humans and scrapers: seed decoy addresses, canary personal emails, and fake calendar artifacts, then watch who bites.

Delay the takedown and physical security inherits the incident

Do the ugly inventory this week. Do it before the next board offsite, and before a journalist does it for you.

Today. Pull a self-dossier on every in-scope executive, spouse, and high-visibility staffer. Use the same people-search tools an amateur uses. Screenshot what is live. Assign owners by name. Executives don’t get to mark this optional.

This week. Kill geotags on work-adjacent posts. Pull home, school, and plate details out of bios, podcasts, and old keynotes that still rank. File data-broker opt-outs and track them like patch tickets. Rotate personal mail and phone numbers that appear in those dossiers, especially any address that recovers a corporate SSO account.

This month. Stand up a joint intake between the SOC and physical security so a doxx, a stalker, or a pretext call lands as a single incident with both teams on the channel. Add executive OSINT to tabletop exercises. Put security hardening of personal identities, unique credentials, phishing-resistant MFA, and no password reuse into the tenant, on the same scoring as laptop encryption.

Ongoing work is dull, and that’s the point. Recheck the dossiers quarterly. Watch for new photos from the driveway and new relatives appearing in broker dumps. Keep a canary: a unique decoy address or phone that exists only as bait, then alert on first use. Tie that into the same threat detection you already trust for credential stuffing.

Stop asking the firewall to cover a press page. Defense in depth for this problem is data minimization, broker suppression, travel discipline, and a physical team that gets the same pager as the SOC. If your program can’t say who owns executive OSINT by name, the street already has a better map than you do.

Sources

• Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk
• “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities
• ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets