Q&A: When online threats turn real: How security teams can protect executives

An online threat against a senior executive can travel across platforms before a security team has established who created it, why it is spreading or whether the person behind it poses a credible danger.

For corporate security teams, simply knowing that hostile content exists is no longer enough. They need to distinguish viral outrage from potentially dangerous behaviour, assess the individual behind the activity, understand whether a campaign is organic or coordinated, and put reliable intelligence in front of decision-makers quickly.

To learn more, Digital Journal caught up Matt Hogan, Chief Technology Officer at Liferaft to understand what security teams should look for when an executive is targeted online, why specificity can matter more than audience size, how intent, access and capability shape threat assessment, and what organisations should be doing before an incident occurs.

Digital Journal: A sizable number of security chiefs report a significant rise in threats against executives. What’s missing from that stat when it comes to the actual job of protecting them?

Matt Hogan: Knowing threats are online doesn’t help when a post naming your CEO has thousands of views by morning. At that point, the team needs to quickly understand what they’re looking at, who’s behind it, whether the threat is gaining traction and who needs to know first. The real job is getting those answers before a situation escalates. Security teams must be proactive at identifying concerning activity early, connecting signals across channels, and giving decision-makers enough context to decide when something requires action.

DJ: When a post naming an executive starts circulating, what should a security team look at first?

Hogan: Look at two things in parallel, because they tell you different things. First, the content: Does it include anything specific, like a location, a date, a method, or a reference to the executive’s routine? A detailed threat from a small account with a handful of followers can be the most serious signal you’re looking at, because it isn’t performing for an audience. That deserves attention regardless of reach. Second, the spread: How many platforms is it on, how fast is it growing, and does that growth look organic or coordinated?

Identical text appearing across half a dozen platforms in an hour points to a deliberate effort to shape public perception. That’s a different kind of risk. It affects reputation, and it can create the kind of sustained hostile attention that inspires someone else to act. Reach tells you how many people are seeing something. Specificity tells you how close someone may be to acting. Teams need both.

DJ: Once a team understands what a post says and how it’s spreading, what’s the next step?

Hogan: After mapping the spread, pivot from the post itself to whoever is behind it. Determine if the account is new or well-established, if their posting history shows a pattern of grievance, obsession, or escalating hostility, and if they’ve targeted the company before. One more critical question — where are they physically located? Geographic proximity to the executive can dramatically reshape the urgency of the situation.

DJ: Not every viral mention of an executive is actually a threat against that person. How should teams sort out what they’re looking at?

Hogan: Teams should focus less on how much attention a post is getting and more on what the behavior behind it suggests. The key questions are intent, access and capability: Is the person becoming more specific about the executive’s location, routine, timing, or a potential method of harm?

Those details are what help determine whether something needs to be monitored, managed, or escalated. Leadership needs intelligence that explains how credible the threat is, why it matters, and what action is needed.

DJ: Who needs to be looped in once a threat is assessed as credible, and in what order?

Hogan: Speed matters, but so does sequence. Internally, information typically flows upward first: The analyst who spots it alerts the GSOC manager, who briefs the CSO, who decides what gets communicated and when. For a threat that looks imminent, though, analysts should have a pre-agreed fast path to alert the protective detail or law enforcement directly. From there, information moves outward.

The chief of staff should hear about it before the executive does, so the executive gets context rather than a raw screenshot. Communications needs early awareness, since an uninformed response could amplify the post’s reach. Legal should be looped in if law enforcement involvement is possible. And the security detail needs to know right away, so protective plans can adjust before the executive’s next movement.

DJ: What should security teams be doing on a quiet day to prepare for the next incident?

Hogan: Keep ongoing monitoring running on the executive’s name and any known aliases or variants. Maintain an up-to-date picture of what personal information about them is publicly accessible and reduce it where you can.

Establish clear, agreed-upon thresholds for what triggers escalation versus what just gets logged for the record. And make sure the intelligence side and the physical protection side actually know each other and have a working relationship, ideally built through regular tabletop exercises. Most importantly, agree ahead of time on who has the authority to make the call.