The most visible part of executive protection is the least important part of it. The agent walking a step behind the principal, scanning a lobby, opening a vehicle door: that is the last four percent of the job. The other ninety-six percent happened days earlier, in an empty parking garage with a tape measure, on a phone call with a hotel director of security, and in a document nobody outside the detail will ever read.
Advance work is the discipline of removing decisions from the moment they would otherwise have to be made under pressure. A detail that has done its advance is not improvising when the freight elevator is out of service or when a crowd forms at the main entrance. It already knows the alternative.
This post walks through what a competent advance actually involves, in the order it gets done.
Why Advance Work Is the Whole Program
Protective work fails in predictable ways, and almost none of them look like a movie. They look like a principal stuck in a stairwell because nobody confirmed which doors lock from the inside. A motorcade routed onto a street closed for construction. A venue that turned out to have a single point of egress. An agent who does not know which hospital is closest or whether it has a trauma designation.
Every one of those is an advance failure, not a reaction failure. The reason experienced protection professionals talk about advance work constantly, and about physical technique rarely, is that the advance is where risk is actually reduced. Everything after it is contingency management.
There is a second reason, less often stated. Good advance work makes protection nearly invisible, which is what most principals actually want. A detail that has pre-arranged a discreet arrival, cleared a route with building management, and coordinated with venue staff does not need to create a visible security footprint. Executives who resist protection are usually resisting disruption, not safety, and the advance is what removes the disruption.
Phase One: Intelligence and Threat Assessment
Advance work begins before any location is visited, with an honest assessment of what the principal is actually exposed to. That assessment drives everything downstream, including how much protection is warranted at all.
The inputs worth gathering:
Principal profile. Public visibility, industry, recent news coverage, litigation, layoffs or labor disputes, controversial business decisions, and political or public positions taken. A CEO who just announced a plant closure carries a different risk profile than one who did not.
Direct threat history. Prior threatening communications, unwanted contact, persons of concern with a documented fixation, and any restraining or protective orders. Patterns matter more than single incidents. Escalation in frequency or specificity is the signal that changes posture.
Digital exposure. Home address availability on data broker sites, family member social media, real-time location disclosure through posted photos, and property records. Digital exposure is frequently the largest and cheapest-to-fix vulnerability in the entire picture, and it sits outside the reach of any physical detail. Reducing it is often the first recommendation a security consulting engagement produces.
Destination conditions. Crime patterns near the venue and lodging, planned demonstrations, labor actions, major events competing for the same infrastructure, weather, and for international travel, political stability and local emergency service capability.
Protective intelligence is ongoing rather than a one-time report. The value comes from monitoring change: a person of concern who resurfaces, a scheduled protest that materializes near a venue, a news cycle that raises the principal’s visibility in an unwelcome direction.
Phase Two: The Site Advance
This is the part that requires physically being there. Reviewing a venue on a floor plan or in satellite imagery produces a plan that fails on contact with the building, because floor plans do not show that the loading dock is chained shut on weekends.
A site advance covers:
Arrival and departure points. Primary and at least one alternate for each. The alternate is not theoretical. The agent walks it, confirms it is unlocked or that someone with a key will be present, and times it.
Interior routing. The path from vehicle to destination room, including which elevators serve which floors, where stairwells discharge, which doors are one-way, and where the principal will be briefly exposed in an open or public space. Those exposure points get specific attention.
Holding areas. A secure room where the principal can wait, take a call, or shelter if something develops. It needs a door that locks, a second way out, and cellular signal.
The venue’s own security. Who they are, how many, armed or unarmed, what their response time and procedure look like, and whether they can be reached directly by radio or phone rather than through a main desk. Building security and event staff are force multipliers when coordinated in advance and obstacles when surprised.
Medical. Nearest emergency department, driving time under realistic traffic, whether it is a designated trauma center, and the location of on-site AEDs and first aid. For international work this expands to include hospital quality assessment and evacuation arrangements.
Photographs and measurements. The advance produces a record other agents can use. An advance that exists only in one person’s head is not an advance.
Where the itinerary includes a public-facing function, the advance also has to account for crowd behavior, credentialing, and controlled access, which overlaps substantially with event security planning and often calls for additional personnel beyond the protective detail itself.
Phase Three: Route Planning
Vehicle movement is where principals are most exposed, and route work deserves proportionate attention.
Primary and alternate routes get driven, not mapped. They get driven at the actual time of day the movement will occur, because a route that is clear at 10 a.m. may be gridlocked at 5 p.m. The advance notes construction, choke points, areas where the vehicle would be forced to stop in an unfavorable position, and the safe havens along the way: police stations, fire stations, hospitals, and occupied commercial buildings where a vehicle can pull in.
Departure timing is planned to avoid predictability. Consistent routes and consistent times are the single most exploitable pattern in a principal’s life, and daily commutes are almost always the least protected and most predictable movement they make.
Drivers matter more than most clients expect. A protective driver is a specific skill set, distinct from both chauffeur work and general security work, and the vehicle is itself a protective asset. For movements involving valuables or cash alongside the principal, the requirements overlap with armed transport operations.
Phase Four: Coordination and Liaison
Advance work is largely relationship work. The agent spends more time on the phone than on foot.
Contacts worth establishing before arrival include venue and building management, the venue’s security director, hotel security and the front desk manager, local law enforcement for the jurisdiction, the principal’s executive assistant, and event organizers where applicable. Each conversation is establishing two things: what that party will do, and how to reach them immediately.
Law enforcement liaison deserves particular care. Private protective details have no special authority, and the working relationship with local police is built on advance notification and professional courtesy rather than expectation of support. A department that knows a detail will be operating in their jurisdiction, and knows who to call, responds very differently than one that receives a report of armed individuals at a hotel. Notification requirements for armed protective personnel vary significantly by state and by municipality, and confirming them is part of the advance rather than an afterthought. Firms working across multiple states, as with protective operations spanning several markets, carry the burden of tracking those differences.
Phase Five: The Written Plan
The advance produces a document. Verbal advances do not survive personnel changes, shift handoffs, or the moment when the agent who did the advance is dealing with something else.
A working advance package contains the itinerary with times and locations, site diagrams with marked routes and exits, the emergency action plan, contact lists with direct numbers, vehicle and personnel assignments, radio protocol and call signs, medical information including the principal’s relevant conditions and allergies, and the alternate plan for each significant movement.
The emergency action plan is the section that matters most and gets the least attention. It should answer, in advance and specifically: what happens on a medical emergency, on a fire alarm, on an aggressive approach, on a vehicle breakdown, on a credible threat during the event, and on separation from the principal. Each answer names who does what. A plan that says “evacuate to a safe location” without naming the location and the route is not a plan.
The package gets distributed to everyone on the detail before the movement, not on arrival.
Where Advance Work Gets Cut, and What Happens
Advance work is the first thing sacrificed under time and budget pressure, and the sacrifice is invisible until it is not. Common compressions and their consequences:
No site visit, floor plans only. Produces plans that assume doors are usable, elevators are available, and spaces are configured as drawn. Frequently none of those hold.
Advance done by someone not working the detail. Loses the tacit knowledge that does not make it into the document. Where possible, at least one agent on the detail should have walked the site.
Route mapped, not driven. Misses construction, closures, and the timing reality of the actual departure window.
No law enforcement notification. Creates the possibility of an armed private detail being mistaken for a threat, which is a genuinely dangerous outcome.
Skipping the medical component. The most likely emergency on any detail is medical rather than criminal. Cardiac events, falls, and allergic reactions occur far more often than attacks.
Short-notice movements do happen, and a compressed advance is better than none. The triage order when time is genuinely short: medical, then arrival and departure points, then a driven primary route, then venue security contact. Everything else can be abbreviated.
Working With a Protection Provider
When evaluating providers, the advance process is the most useful thing to ask about, because it separates firms that plan from firms that supply bodies. Ask how many advance hours are budgeted, who performs the advance, whether the site will be physically visited, what the written package contains, and how emergency action plans are developed and distributed. Vague answers to those questions are informative.
ALK Global Security provides executive protection services with agents drawn from military and law enforcement backgrounds, operating across Washington, Oregon, Arizona, Texas, and Florida, and coordinating international travel security for movements abroad. Request a quote today.
Frequently Asked Questions
How far in advance should executive protection planning begin?
For routine domestic movements, several days is workable. For a public event, high-profile appearance, or international travel, two to four weeks allows for proper intelligence gathering, site visits, and coordination. Short-notice work is common in this field and manageable, but the tradeoff should be explicit rather than hidden: the client should know which elements were abbreviated.
What is the difference between advance work and a threat assessment?
A threat assessment evaluates who or what poses a risk to the principal and how serious it is. Advance work applies that assessment to a specific place and movement. The assessment tells you the risk level; the advance determines where the exits are. Both are needed, and the assessment should drive the depth of the advance.
Does every executive need a full protective detail?
No, and recommending one where it is not warranted is a common industry failure. Many executives are well served by digital exposure reduction, residential security assessment, driver training, travel risk protocols, and protection deployed selectively for elevated-risk events and travel rather than continuously. Assessment should determine posture, not the reverse.
Who performs the advance, the detail leader or a separate agent?
Both models are used. A dedicated advance agent scales better across multiple simultaneous movements and allows deeper preparation. Having a detail member perform the advance preserves knowledge that does not transfer well onto paper. Larger operations often combine the two, with a dedicated advance agent producing the package and a detail member walking the site before arrival.
How much does executive protection cost?
Cost is driven by the number of agents, hours of coverage, armed versus unarmed posture, vehicle and driver requirements, and travel. Advance work is a real line item and should appear in the proposal rather than being absorbed invisibly. A quote that includes no advance hours is either omitting the work or hiding its cost.
Should executive protection agents be armed?
It depends on the threat assessment, the venues involved, and applicable law. Many corporate environments and venues prohibit weapons, and some jurisdictions impose licensing and notification requirements that make armed coverage impractical for a given movement. The decision should follow the assessment, and the licensing status of every agent should be confirmed for every jurisdiction on the itinerary.
What should a client provide to support advance planning?
The itinerary as early as possible, including changes; the principal’s relevant medical information; any history of threats, unwanted contact, or concerning communications; family travel plans that overlap; and a single point of contact authorized to make decisions. Late itinerary changes are the most common source of advance failure, and clients who understand that tend to get better protection.