By The Falcon Consulting Group
Falcon’s protective operations associates are former federal, state, and local law enforcement officers with protective-intelligence and high-threat-environment experience, and the firm conducts principal threat assessments for boards making this decision.
Executive protection is often treated as a discretionary perk, something a CEO requests rather than something a board evaluates. That framing is outdated, and the paper trail now shows it.
Protecting key personnel is a duty-of-care, business-continuity, and enterprise-risk issue. For public companies it is also a disclosure issue, which means the decision is visible to proxy advisors, institutional shareholders, insurers, and eventually to plaintiffs’ counsel. Boards that treat it as optional are increasingly exposed themselves.
This post is about the board’s side of the question: what the duty actually is, what the disclosure environment now looks like, and what a defensible decision record contains. Whether a specific executive warrants a program, what the risk indicators are, and what a real program includes are covered separately in our risk-based guide to whether your CEO needs executive protection.
Why Is Executive Protection a Board Issue Rather Than a Personal One?
Because the exposure is the company’s, not the executive’s alone. An attack, a credible threat, or even a serious security scare involving a chief executive does not stay contained to the individual. It moves through the organization immediately: a leadership vacuum at a critical moment, a share-price reaction, a wave of employee anxiety, and a scramble to explain to the board and to regulators why no protective measures were in place.
Litigation frequently follows, often framed around whether the company knew about foreseeable risk and failed to act on it. None of this requires a worst-case outcome to be costly. A single credible threat that surfaces publicly, without a program in place to have anticipated or managed it, can still produce reputational damage, insurance friction, and a response that looks, to a plaintiff’s attorney or a regulator, like negligence rather than misfortune.
The Oversight Duty and What It Asks of Directors
Boards owe key personnel a duty of care, and that duty does not evaporate because the risk feels abstract until it isn’t. Shareholder derivative suits following an incident examine what the board knew, what it was told, and what it chose not to fund.
Delaware evaluates director oversight claims under the Caremark line of cases, and the Delaware Supreme Court’s 2019 decision in Marchand v. Barnhill sharpened the expectation that boards make a good faith effort to put a monitoring system in place for risks central to the enterprise. Whether a court would treat executive physical security as central is fact specific and unsettled. What is not unsettled is the evidentiary pattern: a board that commissioned an assessment and made a documented, risk-based decision sits in a materially stronger position than one that never asked the question, even where both boards ultimately spent nothing.
This is the same structure that governs employer liability for workplace violence generally, where recognition of the hazard plus a feasible response is what establishes the obligation. We cover that framework in detail in our post on workplace violence prevention and what OSHA can cite an employer for.
The Absence of a Program Is Itself a Decision
This is the point most boards miss. Not funding executive protection is not a neutral default. It is a choice that will be characterized after the fact by someone with the benefit of hindsight and an incident report.
A board that assessed the risk and concluded a program was not warranted has a defensible answer. A board that never put the question on an agenda has nothing to point to except the absence of a discussion. The difference between those two positions costs almost nothing to create in advance and is very expensive to manufacture afterward.
What the Proxy Data Now Shows
Executive security has become a mainstream disclosed expense rather than an outlier one. An Equilar review of S&P 500 proxy filings through April 2026, summarized on the Harvard Law School Forum on Corporate Governance, found that more than a third of S&P 500 companies provided security perquisites to at least some executives for 2025, an increase of 12.8% over the prior year. Among companies reporting them, the median value reached $130,468, up 20% year over year.
A separate review of large-cap proxy statements, also published through the Forum, found that the upward trend in CEO personal security perquisites was already underway before December 2024 and has continued at a similar pace since. These programs frequently intersect with policies on personal use of corporate aircraft, where companies require or encourage executives to fly privately specifically to reduce exposure in public travel environments.
For a board, the practical significance of those numbers is comparative. A committee asked why it did or did not fund a program is now answering against a visible market benchmark rather than in a vacuum.
The Disclosure Catch-22
Public companies must disclose perquisites and personal benefits exceeding $10,000 in the compensation tables, and the SEC’s 2006 executive compensation release remains the governing guidance for whether a security arrangement counts as a perquisite at all.
That framework creates a genuine bind, which Cooley described as a catch-22: providing personal security triggers disclosure and invites scrutiny from proxy advisors, while limiting or declining protection to reduce the disclosed figure puts executives at greater risk. Some commentators argue security should be treated as a business expense rather than a discretionary benefit. Until the rules change, companies evaluate it under the existing perquisite framework.
The workable response is not to minimize the number. It is to disclose alongside a rationale. Proxy statements that explain the assessed basis for the program, rather than reporting a figure without context, have generally fared better with advisors and shareholders than those that leave the reader to infer that an executive simply wanted a car and a driver.
What Proxy Advisors and Shareholders Are Asking
Proxy advisory firms and institutional shareholders have begun asking companies to disclose and justify executive security spending. That shifts the absence of a rationale from a security gap into a governance gap.
The questions are consistent: was there an assessment, who conducted it, what did it find, how was the program scaled to those findings, and how often is it revisited. A company that can answer all five is having a different conversation than one whose proxy discloses a number and nothing else.
What Does an Unprotected Incident Actually Cost?
The costs land in four places, and only one of them is the security line item. Set against these exposures, a proportionate program is typically the least expensive option on the table rather than the most expensive one.
Business Continuity
A key-person incident during a merger, a major litigation event, or a leadership transition can stall a deal or trigger a covenant. Continuity of leadership carries real financial value, and a protection program is one of the few controls that directly protects it. The exposure is concentrated at exactly the moments when a company can least absorb disruption, which is also when public visibility and grievance pressure tend to peak.
Litigation and Regulatory Exposure
A documented threat assessment and a proportionate response are the clearest evidence a company can produce that it exercised reasonable care. That is the standard plaintiffs’ counsel and regulators will apply after the fact, regardless of what standard the company applied beforehand.
The asymmetry is worth stating plainly. The assessment is inexpensive. Reconstructing a rationale during discovery is not, and it rarely reads well when the underlying decision was never actually made.
Talent and Retention
Executives, and the people around them, notice whether an organization takes their safety seriously. So do family members, who increasingly factor personal security into whether a leader accepts or stays in a high-visibility role. For companies recruiting into public-facing leadership positions in contested industries, this has moved from a footnote in a negotiation to a term that gets negotiated.
Insurance Posture
Carriers underwriting directors and officers coverage and kidnap and ransom coverage increasingly price in whether a company has a documented protective intelligence and executive protection function, not just whether an incident has occurred. Underwriters ask what the assessment found and what was implemented. An organization that cannot answer is quoted as though the answer were nothing.
Why the Assessment Comes Before the Budget Conversation
The most common sequencing error is moving straight to a hiring decision, bringing on a driver, a guard, or a firm, without first establishing what the actual risk profile is. That produces either an underbuilt program that misses the exposure points where incidents actually happen, or an overbuilt one that spends against the wrong threat. Either way the board is approving a number it cannot defend.
A formal principal threat assessment, conducted by people with genuine protective-intelligence and investigative backgrounds, is what turns executive protection from a gut-feel purchase into a defensible governance decision. It documents the reasoning, scales the response to the actual risk, and gives the board something concrete to point to rather than a shrug.
The methodology is a discipline with its own standards, closely related to the structured process used to evaluate a specific individual’s trajectory toward violence, which we describe in our post on what actually happens in a behavioral threat assessment. The risk indicators that should trigger an assessment, and the program layers an assessment might recommend, are set out in our risk-based executive protection guide.
What a Defensible Decision Record Contains
- A dated assessment from a named, qualified assessor , with the scope stated and the methodology described. Who looked, at what, and when.
- The findings, including the ones that did not warrant action. A record that only documents identified risks looks curated. One that shows what was considered and ruled out looks like a process.
- The response, mapped to the findings. Each measure implemented should trace to something the assessment identified, and each measure declined should have a stated reason.
- The board or committee action. Minutes reflecting that the assessment was presented, discussed, and acted on. This is the element most often missing, and it is the one a derivative complaint will focus on.
- A review cadence. Annually at minimum, and immediately on a triggering event such as a documented threat, a layoff or plant closing, contested M&A, an activist campaign, or a change in the executive’s public profile.
Frequently Asked Questions
Is executive protection a board responsibility or a management decision?
Both, at different levels. Management operates the program, but the decision to fund one, scale one, or decline one is a governance question that belongs in front of the board or a designated committee, because the exposure created by an incident sits with the company rather than with the individual. For public companies the spending is also disclosable, which makes it a matter of board record either way.
Does the SEC require companies to disclose executive security costs?
Public companies must disclose perquisites and personal benefits exceeding $10,000 for named executive officers, and the SEC’s 2006 executive compensation disclosure release remains the governing guidance for whether a particular security arrangement is treated as a perquisite. Commentators have urged the SEC to revisit that treatment, but under current rules companies evaluate security arrangements within the existing perquisite framework.
How much do companies spend on executive security?
Among S&P 500 companies that reported security perquisites for 2025, the median disclosed value was $130,468, up 20% from the prior year, and more than a third of the index reported some security perquisite. Those figures reflect disclosed perquisite value rather than total program cost, and they skew toward large-cap public companies. Private and mid-market programs are frequently far smaller and still defensible.
What if the board decides not to fund executive protection?
That is a legitimate outcome and often the correct one. The requirement is not a program. It is a documented, risk-based decision. A board that commissioned an assessment, reviewed the findings, and concluded that existing measures were proportionate has an answer. A board that never raised the question has only the absence of a discussion, which is what a plaintiff’s counsel will point to.
Does having an executive protection program affect D&O or kidnap and ransom insurance?
Increasingly, yes. Underwriters ask whether a documented protective intelligence and executive protection function exists, what an assessment found, and what was implemented, and they price accordingly. The relevant factor is often not the size of the program but whether the organization can demonstrate that it evaluated the risk at all.
How often should an executive security assessment be updated?
Annually at a minimum, and immediately following a triggering event: a documented or credible threat, a layoff or plant closing, contested M&A or an activist campaign, major litigation, a significant change in the executive’s public profile, or a relocation. Risk profiles for executives change faster than most governance calendars assume.
The Bottom Line
The organizations that get this right treat executive protection the way they treat any other material risk. They assess it, document the decision, and revisit it as circumstances change.
The ones that get it wrong tend to discover the cost of that gap only after it is too late to close cheaply. The board does not need to buy a detail. It needs to be able to show, on a date certain, that it looked at the question and decided something.
Key Takeaways
- Not funding a program is a decision the board will have to explain. Assessing and declining is defensible; never putting the question on an agenda is not.
- More than a third of S&P 500 companies now disclose security perquisites, at a median above $130,000. Boards answer this question against a visible benchmark.
- Disclose with a rationale rather than disclosing a number. Proxy readers judge the reasoning, not the figure alone.
- Underwriters and proxy advisors ask the same five questions: was there an assessment, by whom, what did it find, how was the response scaled, and how often is it revisited.
- The decision record needs board or committee minutes. That element is the one most often missing and the one a derivative complaint targets first.
- Set a review cadence tied to triggering events, not just to the calendar. Layoffs, contested M&A, activist campaigns, and litigation all move an executive’s risk profile.
Talk to Falcon Consulting Group
Falcon Consulting Group provides principal threat assessments, protective intelligence, executive protection, and residential and travel security programs built around documented, risk-based decision-making.
Our protective operations and advisory services are delivered by former federal, state, and local law enforcement officers with protective-operations and high-threat-environment experience. We produce assessments written to be read by a board and a carrier, not only by a security manager.
If your board has not evaluated this question on the record, contact us to scope a principal threat assessment.
About Falcon Consulting Group
Falcon Consulting Group is a corporate investigations, protective operations, and compliance advisory firm whose associates include former federal and state law enforcement personnel, former Inspector General staff, CPAs, and certified security and financial professionals. Learn more about the Falcon team.