Pattern over
incident.

December 2026

Express, Settled Instantly

Instant payment rails compress the express kidnapping timeline from hours to minutes. ERS Briefing 032 on the modernized typology and pre-travel controls.

• —Express kidnapping, now settled at the speed of instant payments
• —The friction that used to bound the crime is gone
• —Controls for traveling executives on instant-rail economies

November 2026

Reading the Cascade

Eleven embassies, near-identical alerts, 24 hours. ERS Briefing 031 on alert interpretation, signal classification, and pre-committed trigger discipline.

• —Synchronized advisories are the signal, not any single alert
• —Classifying cascade signals against ordinary update noise
• —Pre-committed triggers beat judgment calls made mid-event

November 2026

From Perk to Program

Executive security spend tripled at the median for non-CEO executives. ERS Briefing 030 on protection becoming a governed program anchored to independent assessment.

• —Median non-CEO security spend tripled year over year
• —Over a third of the S&P 500 now provides security benefits
• —The assessment, not the spend, is the governance story

November 2026

When Kidnap Becomes an Industry

Nigeria's kidnap economy in twelve months of data: 1,713 incidents, 7,825 abducted. ERS Briefing 029 on industrialized kidnap markets as a duty-of-care problem.

• —1,713 incidents and 7,825 people abducted in twelve months
• —Ransom as revenue: a market that reinvests in itself
• —Where duty-of-care programs actually leak

November 2026

A Growth Industry

Recorded kidnappings rose roughly 60 percent from 2020 to 2025, in every region except Asia-Pacific. ERS Briefing 028 on the drivers and program implications.

• —Recorded kidnappings up 60% from 2020 to 2025
• —Mass incidents up 154%; only Asia-Pacific bucks the trend
• —Economic and diversification drivers, and what they mean for programs

November 2026

Quietly Wealthy Is Not Invisible

Targeted residential robbery has moved down-profile. ERS Briefing 027 on why quiet wealth is findable wealth and what friction redirects selection.

• —Down-profile targeting: findable is the new famous
• —Residential caseloads reach households that never sought attention
• —Pricing discretion into how a family lives, not just spends

November 2026

The Spotter Outside

London's luxury watch theft economy runs on spotter networks and victim silence. ERS Briefing 026 on the selection pattern and the habits that defeat it.

• —A £1.9B trade whose first employee just watches doorways
• —Enforcement works, and displaces: offenses moved, not ended
• —Habits that defeat selection before the follow begins

October 2026

The Away Game

Transnational crews select residential targets online and strike during published absences. ERS Briefing 025 on criminal tourism and the executive calendar.

• —A business model built on one input: predictable absence
• —Why the athlete burglary networks are an executive story
• —Defeating the model: occupancy signals and schedule discipline

October 2026

The Case File You Published

Burglary crews select targets from public schedules, listings, and posts. ERS Briefing 024 on the pre-attack surveillance that already happened online.

• —Burglary crews select from public information, not surveillance
• —The case file assembles itself; absence is the trigger
• —Thinning the file: what to withhold and what to delay

October 2026

Deletion With Teeth

California's DROP enforcement is live and New Jersey has a new broker law. ERS Briefing 023 on what enforceable deletion changes for protective programs.

• —One request now reaches 545 registered data brokers
• —45-day processing, $200-per-day penalties for failures
• —Honest limits: what deletion can and cannot remove

October 2026

Cold Storage Is a Supply Chain

The $116 million Coldcard exploit: a five-year-old firmware flaw weaponized in 41-minute sweeps. ERS Briefing 022 on verifying the cold storage supply chain.

• —$116M drained without touching a single device
• —A five-year-old build decision became the exploit
• —Cold storage is a supply chain: discipline for every link

October 2026

Anonymous by Default

After the August leak, Trezor made Anonymous Delivery its top priority. ERS Briefing 021 on privacy becoming a purchasing criterion for security products.

• —A leaked shipping record turns a wallet order into a home address
• —Why delivery, not firmware, is the hardware wallet's weak link
• —The market signal: anonymity moving from option to default

October 2026

The Vendor Layer

Three crypto breach disclosures in four days, 253,000 exposed, none breached directly. ERS Briefing 020 on why the vendor layer is now the attack surface.

• —Three disclosures in four days, 253K+ people exposed
• —Zero direct intrusions: the vendor layer was the breach
• —Reading your exposure through the vendors that hold your data

October 2026

No Safe Amount

Crypto holders with as little as $6,000 have been abducted. ERS Briefing 019 on the threshold myth and why crews act on perceived wealth, not verified balances.

• —Victims with $6K holdings; deaths over sums as low as $50K
• —Perceived wealth, not actual balance, is the trigger
• —The exposed middle: too small for programs, visible enough to select

September 2026

The Exported Playbook

52 verified coercion attacks on crypto holders in six months, two thirds in France. ERS Briefing 018 on why the playbook travels and readiness should predate precedent.

• —52 verified wrench attacks in H1 2026, up a third year over year
• —Why France went first, and why the playbook is portable
• —The readiness case: prepare before the pattern reaches your geography

September 2026

The Front Door, Not the Firewall

Home invasions are now 37 percent of violent crypto incidents. ERS Briefing 017 on the mid-year Chainalysis data and what it changes for residential security programs.

• —37% of 2026 incidents are home invasions, up from 26% in 2023
• —Why the migration from exchanges to residences was predictable
• —What rising sophistication changes for residential programs

September 2026

The Address Stays Hot

Three home invasions in a month at a house the crypto wealth left years ago. ERS Briefing 016 on data-driven targeting and why leaked files outlive their targets.

• —Targeting files point at addresses, and addresses stay hot
• —Three crews, one house, and owners who moved two years ago
• —What buyers, sellers, and households inherit from a stale file

September 2026

The Lifestyle Was the Map

A London conviction shows how public visibility selects kidnapping targets. ERS Briefing 015 on the selection layer, the franchise model, and what changes outcomes.

• —Selection begins online: the file is built before any surveillance
• —A franchise model: remote orchestrators, interchangeable local crews
• —Four disciplines that shrink discoverability before it selects you

September 2026

When the Public Record Becomes a Targeting Layer

New York's property roll release paired owners' names with high-value addresses. ERS Briefing 014 on public-records aggregation, the wrench attack trend, and the kidnap-prevention response for at-risk principals.

• —A public roll paired owners' names with high-value addresses
• —Aggregation, not novelty: why one dataset changes the exposure
• —52 verified physical attacks in H1 2026 — the trend was already running

August 2026

Safe until January.

Abu Dhabi and Dubai rated among the safest postings in the world. In January 2026 that rating stopped being the relevant question. ERS Briefing 013 on evacuation planning before the crisis.

• —Safe and evacuable on twelve hours' notice are different claims
• —The repeated failure mode: no manifest, no decision rights, no pre-cleared movement
• —Four things that must exist before the crisis, not during it

August 2026

Signal without a phone.

Every protective plan depends on a person under threat getting a signal out, and most plans quietly assume the phone will do it. ERS Briefing 012 on engineering the signaling layer.

• —The phone is four assumptions deep before anyone is alerted
• —The non-negotiable properties of a dedicated signaling layer
• —The receiving end is the majority of the system's value

August 2026

The exit interview you never gave.

Offboarding retires the badge and the credentials. It does not retire what a departing employee knows about the principal. ERS Briefing 011 on the departure as a protective event.

• —What proximity teaches: calendars, routes, wealth events, posture
• —Standard offboarding retires access, never knowledge
• —Four practices that treat proximate departures as protective events

August 2026

The policy is not the plan.

Kidnap and ransom coverage is the control principals most believe they understand and most rarely do. ERS Briefing 010 on what K&R buys, what it cannot, and where crypto bends the model.

• —K&R is two products in one wrapper: reimbursement and retained response expertise
• —A policy prevents nothing, and disclosing it degrades it
• —Why crypto compresses the time the classic playbook depends on

August 2026

The household is the supply chain.

Staff, drivers, contractors, and their subcontractors hold the keys, codes, and rhythms of the residence. ERS Briefing 009 on managing the household like the supply chain it is, without poisoning the home.

• —The invited, not the uninvited: trusted access is the seam
• —Three repeating failures: one-time vetting, unretired access, invisible vendor tiers
• —Running the program as professionalism, not suspicion

August 2026

Duress is a design problem.

Whether compliance ends an incident safely is decided years earlier, in the architecture. ERS Briefing 008 on duress-resistant custody design: truthful disclosure, bounded access, and time by construction.

• —Why compliance is the right instinct and an incomplete plan
• —Truthful disclosure: the test a duress-resistant architecture must pass
• —The design questions to answer in calm conditions, not during an incident

August 2026

The voice is not your CFO.

Voice cloning and deepfake-assisted fraud attack the same terminal control as physical coercion: the human approver. ERS Briefing 007 on verification as architecture, not vigilance.

• —The deepfake call and the wrench attack go at the same terminal control
• —Why a recognized voice is no longer authentication
• —Four properties of verification designed as architecture, not vigilance

July 2026

Your family is the perimeter.

Attackers route around the hardened principal to the household. ERS Briefing 006 on the family's combined public footprint, the exposure math, and extending the perimeter without militarizing the home.

• —Coercion routes to whoever the key-holder cannot accept harm to
• —Aggregation: how a household's combined footprint publishes the routine
• —Three moves that extend the perimeter without militarizing the family

July 2026

The conference is the reconnaissance.

Speaker pages, agendas, and side-event RSVPs assemble a targeting package before the principal lands. ERS Briefing 005 on the event footprint and the audit to run before wheels-up.

• —How a speaker page, an agenda, and a group chat assemble the targeting package
• —Three reasons digital-asset events concentrate the risk
• —The four-question footprint audit to run before wheels-up

July 2026

The questions your custodian has not been asked.

Most custody due diligence questionnaires audit the vendor's paperwork. ERS Briefing 004 on what a serious instrument asks: the human authorizer, the seam between cyber and physical, and eight sample questions.

• —Why the standard DDQ measures paperwork fluency, not operational security
• —The human authorizer: the control the questionnaire never reaches
• —Eight sample questions from the ERS custody due diligence instrument

July 2026

The insider at the signing table.

Every architecture for holding digital assets terminates in a person who can approve. Cryptography relocates that human. It never removes them. ERS Briefing 003 on insider risk to the transaction authorizer.

• —Three custody tiers, one terminal control: the human authorizer
• —Why MPC and qualified custodians relocate insider risk, not remove it
• —Four questions that locate the seam between cyber and physical

July 2026

A stable capital, a targeted threat.

Paris rates as one of the safest major capitals in the world. For crypto and fintech principals, that rating is the problem.

• —The targeting pattern: proximity-based, residential, patient
• —Cyber posture as anti-kidnap posture
• —The controls that must exist before wheels-up

July 2026

The target has moved.

Physical coercion has become a structural feature of digital-asset risk. Why crypto wealth breaks traditional executive protection, how exposure accumulates around a principal, and the architecture that holds under duress.

• —The 2025 inflection in verified physical attacks
• —Custody design as a personal safety control
• —Four questions every board should be able to answer