Protective intelligence is the work of finding threats against a company's people, offices and events, such as its senior executives or its annual meeting, before anyone is harmed. Protective intelligence software gathers these threats from public and internal sources into one case, so that the corporate security team can judge each threat and act on it.
A corporate security team protects a company's people and sites, not its computers. Its information arrives from many places. Public sources include social media posts, news reports and local protest calls. This kind of information is called open-source intelligence (OSINT). Internal sources include reports from guards, emails from employees, the list of former employees who left on bad terms, and alerts from the cameras. Before such software existed, this information sat in many inboxes and spreadsheets. Nobody could see that three small signals were about the same person.
Imagine a listed company in Mumbai that holds its annual general meeting for shareholders in a hotel ballroom. Two weeks before the meeting, the software finds a social media post by an account that names the company's chairman and the date of the meeting in an angry message. The same week, a guard at the head office reports a man who argued at the reception and asked when the chairman arrives. The software links the two reports, because both name the chairman and the photo on the account matches the guard's description. It puts both into one case and gives the case a higher risk score. An analyst in the security team reads the case, finds that the man is a former contractor with a dispute about unpaid bills, and recommends two extra guards and a checked guest list at the meeting. The meeting passes without trouble.
Most cases end like this one. The software helps the team decide which of many signals need action, and record why. Camera alerts from video analytics can be added to a case. If a threat becomes an emergency, such as a protest blocking an office, the team uses critical event management to warn the employees in that building.
How is protective intelligence different from a threat intelligence platform? Both collect warnings from outside the company. A threat intelligence platform collects warnings about attacks on computers, such as the internet addresses that attackers use. Protective intelligence collects warnings about harm to people and buildings. Many companies now use both, and the two teams share what they find, because an attacker who targets an executive may try both ways. The same idea of sorting many signals into the few that matter is described in alert triage.