In this monthly series, Mike Evans, Chief Intelligence Officer at Securitas, explores the key developments influencing the security landscape and their implications for organizational resilience.
As November begins, my top five priorities for security and resilience leaders are:
- European unrest and the potential for disruption to extend across borders and different groups
- The US midterms and the period of heightened risk that may continue beyond election day
- Anti-AI activism and the variety of tactics organizations could encounter
- National preparedness and the role businesses can play in strengthening broader resilience
- Holiday-season security as established threats continue to change and evolve
The key message:
Security leaders don’t need to predict every incident. They need to understand what is changing, how that affects their organization, which warning signs matter, and how to turn assessment into action.
European unrest: understanding contagion risk
November offers a useful example of contagion risk, demonstrating how unrest can extend across borders, grievances, and communities.
Potential flashpoints include French union strikes on 5 November, environmental activism surrounding COP31 from 9 to 20 November, as well as anti-war demonstrations and the proposed Gen Z “Revolution Europe Tour” on 20 November.
While these campaigns involve distinct groups, motivations, and objectives and should not be viewed as one movement, unrest does not always stay within defined geographic or ideological boundaries. Social networks can amplify narratives and tactics, allowing them to be observed, adapted, and replicated elsewhere, even without direct coordination.
This can create three forms of potential contagion:
- Geographic spread: Events in one country inspire similar activity in other locations.
- Grievance crossover: Separate causes begin to adopt common narratives, targets, or demands.
- Tactical imitation: Groups replicate approaches that appear to have been successful elsewhere.
Most demonstrations are expected to remain lawful and peaceful. However, periods of increased mobilization may provide opportunities for criminals, extremists, and other actors to take advantage of disorder, deepen divisions, or associate themselves with legitimate causes.
What to watch
Look for coordinated dates of action across multiple countries, shared narratives emerging between previously separate campaigns, specific organizations or sectors being identified as targets, calls for escalation or direct action, and indications that criminals or extremists may be attempting to take advantage of protest activity.
What does this mean for security?
- Track related activity across borders instead of evaluating each event independently.
- Assess whether your locations, industry, or supply chains are becoming common targets.
- Differentiate lawful protest activity from indicators of disruptive or criminal intent.
- Prepare higher-risk locations for potential demonstrations, blockades, or direct action.
- Watch for other threat actors seeking to exploit unrest or periods of reduced security.
- Evaluate the cumulative impact of disruptions occurring simultaneously or in close succession.
A single event shows you what is happening now. Understanding the connections between events can help indicate what may happen next.
US midterms: election day is not the end of the risk period.
The US midterms show why heightened security doesn’t necessarily indicate an imminent or severe threat. Elections involve critical people, processes, systems, and locations. Even limited disruption can have wider consequences for public confidence, political legitimacy, or continuity.
Risk is driven by the interaction between the threat, the importance of what could be affected, and an organization’s vulnerability. Additional controls can therefore be proportionate even when the threat itself is considered manageable. Their purpose is often to reduce vulnerability and keep the consequences of disruption within acceptable limits.
Election day should therefore be viewed as one stage in the broader risk period, rather than its conclusion. Risks may continue as ballots are counted, results become known, and political narratives evolve. Delayed or contested outcomes, misinformation, hostile rhetoric, and calls for mobilization could extend the threat environment beyond 3 November. Planned demonstrations in Washington, D.C., from 10 to 12 November also illustrate how other political causes may overlap with the post-election landscape.
Organizations should avoid automatically scaling back enhanced security measures once polling stations close. Instead, security controls should continue to reflect the evolving risk environment and established decision points.
What to watch
Disputed or delayed results; escalating political rhetoric; narratives alleging fraud or illegitimacy; threats against officials or institutions; calls for post-election mobilization; manipulated or synthetic content; and other campaigns seeking to use the political environment for their own aims.
What does this mean for security?
- Approach the election as an extended cycle that includes the campaign, voting period, immediate aftermath, and subsequent political milestones.
- Strengthen security at locations where even limited disruption could result in significant consequences.
- Establish clear thresholds for when security measures should be increased, maintained, or scaled back.
- Track online narratives for indicators of potential real-world mobilization.
- Enhance protection for higher-exposure offices, facilities, events, and executives.
Good security is not about predicting that disruption will occur. It’s about keeping the consequences manageable if it does.
Anti-AI activism: understand the possible range of tactics
The security considerations surrounding AI are increasingly moving beyond cyber risks, information integrity, and digital systems. The physical infrastructure that supports AI is also becoming more prominent. Data centers rely on land, construction, power, water, connectivity, and extensive supply chains. As investment increases, these developments are drawing opposition related to environmental concerns, housing pressures, energy costs, surveillance, militarization, and supply-chain practices.
Across Europe, a coalition of local activist and civil-society groups has identified 6–7 November as days of action as part of the Stop Dirty Data Centers campaign. The campaign is calling for large-scale data center developments to be paused until associated social and environmental concerns are addressed.
Separate action is also planned against a specific data center in the Netherlands by a group previously linked to disruptive activity. This highlights the importance of recognizing that groups participating in a broader campaign may differ significantly in their objectives, capabilities, and approaches.
Tactics could range from public advocacy and lawful demonstrations to blockades, occupations, trespassing, vandalism, property damage and, in the most serious cases, extremist activity.
Escalation is not inevitable, and peaceful activism should not be treated as criminality. Assessments should be based on objectives, intent, capability, and observable warning signs, not on labels.
What to watch
Specific organizations or facilities being named; changes in rhetoric; publication of site details; signs of reconnaissance; instructions for disruptive action; movement from awareness-raising to operational interference; and property damage or suspected sabotage.
What does this mean for security?
- Assess exposure across locations, projects, suppliers, and business partnerships.
- Strengthen protection for vulnerable construction sites, infrastructure, and critical equipment.
- Develop scenarios and response plans for blockades, occupations, and other forms of non-violent disruption.
- Establish clear escalation procedures that differentiate lawful protest from criminal activity.
- Evaluate the potential operational and financial consequences of low-likelihood but high-impact incidents.
National preparedness: what is the role of business?
More governments, particularly in Europe, are encouraging citizens to prepare for potential crises. The scenarios differ, from severe weather and prolonged infrastructure disruption to cyberattacks, terrorism, and geopolitical conflict. The common message is that societies must be able to absorb disruption instead of relying only on emergency services or government intervention.
That raises a related question for the private sector: what role should organizations play in national preparedness and resilience?
Businesses employ people, operate facilities, manage supply chains, and deliver services on which communities and economies depend. Some own or support critical infrastructure. Others provide security, technology, logistics, communications, or other capabilities that keep essential activity moving. Organizational resilience and national resilience are therefore closely connected.
Security and business leaders should be able to answer two questions. First, what is the organization doing to support preparedness? The answer should go beyond having a crisis-management or business-continuity plan. It should explain how the organization protects its people, operations, assets, supply chains, customers, and reputation, and how it contributes to the wider system around it.
Second, what would cause the organization to act? A single cyber incident, suspicious drone flight, infrastructure failure, or suspected act of sabotage may be difficult to interpret. Several related indicators could point to a meaningful pattern. Leaders need agreed thresholds for deciding when a pattern justifies a change in posture.
What to watch
Monitor changes to government preparedness guidance, new resilience initiatives, revisions to official threat assessments, unusual disruptions affecting critical infrastructure, indicators of possible sabotage or reconnaissance, and patterns of incidents involving similar targets, timing, or methods.
What does this mean for security?
- Clarify the organization’s role in supporting national and societal resilience.
- Determine which people, assets, operations, and services are truly critical to the organization.
- Identify dependencies on infrastructure and essential services operated by third parties.
- Test organizational resilience against prolonged, simultaneous, or overlapping disruptions.
- Establish clear thresholds for adjusting the security posture or activating response plans.
- Assign specific decision-makers, responsibilities, and actions to each defined threshold.
Holiday-season security: reassess familiar threats
Thanksgiving, Black Friday, Christmas, and New Year’s celebrations create a recurring period of increased travel, shopping, gatherings, and online activity. The main security concerns are well known, including theft and organized crime, fraud, cyber threats, risks associated with crowded spaces, pressure on transportation networks, and the ongoing threat of extremism.
However, familiar threats do not mean the risk landscape remains unchanged. Threat actors continue to adapt and evolve. Emerging technologies provide new capabilities, while established tactics can become faster, more affordable, and increasingly convincing. Generative AI, for instance, can increase both the sophistication and scale of phishing, impersonation, and social-engineering activity.
Threat-actor intentions and target selection can also shift over time. Events and developments throughout the year may change the risk exposure of aviation, transportation, retail locations, seasonal gatherings, or individual organizations. Previous-year reporting can provide a valuable baseline, but it should not be relied upon as a current assessment.
The key question is not simply whether familiar threats will return, but how threat actors, their capabilities, tactics, and preferred targets have evolved since last year.
What to watch
AI-enhanced phishing and impersonation; changes in social-engineering methods; criminal targeting of retail, logistics, and payment systems; hostile reconnaissance around crowded places; threats to aviation and transport; extremist narratives focused on seasonal gatherings; and adaptations of previously successful attack methods.
So what for security?
- Build the seasonal assessment from current intelligence, not last year’s conclusions
- Reassess threat-actor intent, capabilities, tactics, technologies, and preferred targets
- Test whether existing controls address current rather than historic threats
- Reinforce employee awareness of increasingly credible impersonation attempts
- Review travel security during peak movement periods
- Maintain clear escalation and decision-making arrangements during reduced-staff periods
The threat category may be familiar. The actor, capability, and method may not be.
Final thoughts
November’s five developments illustrate how quickly familiar issues can acquire new significance. Protest narratives and tactics can travel more quickly. Election-related risk can continue beyond the vote itself. AI infrastructure is creating new targets and grievances. Governments are placing greater emphasis on shared resilience. Seasonal threat actors are gaining new tools and adapting established methods.
The role of security and intelligence is to identify these changes early enough for organizations to act. That means separating threat from risk, likelihood from impact, and isolated reporting from meaningful patterns. It also means understanding where the organization is vulnerable and which people, assets, and operations are critical enough to require action.
Most importantly, warning must be connected to decisions. The organizations best placed to navigate November will not be those trying to identify every incident before it occurs. They will be those that recognize when risk has changed, understand why it matters, and already know what they will do next.