> ## Content Index > Fetch the complete content index at: https://www.protection-in-shifting-domains.org/llms.txt > Use this file to discover other available public pages before exploring further. # Why I built Hybrid Threat Awareness - URL: https://www.protection-in-shifting-domains.org/why-i-built-hybrid-threat-awareness/ - Published: 2026-10-04T13:39:09.000Z - Updated: 2026-10-04T13:49:51.000Z - Description: Twenty years in close protection taught me that the best day is the one where nothing happens. Hybrid Threat Awareness brings that habit of noticing early to the people who are never trained: the engineer, the assistant, the traveller. Why I built it, and who keeps watch. - Author: B.J.F. Rifesser - Tags: Blog, hybrid threat awareness training, Framework, Hybrid Zone, Four lanes, Corporate Security, Crisis and Incident Response, Awareness The story behind Ombrex Consulting's training on hybrid threats In close protection, we say: "The best day is the one where nothing happens." Not necessarily the easiest one. No incident, no drama, nothing to report. People outside the profession sometimes think that means nothing was done. In reality, most of the work happened long before: in the planning, the questions asked in advance, the route not taken, the meeting moved by half an hour. On 26 January 2020 I added a short item to my daily team briefing. A new virus had broken out in China, and I asked my team to keep it at the back of their minds. We were travelling a lot. It wasn't alarm, just a what-if. A month later we flew out of Milan after fashion week. Codogno was sealed off shortly after, and Linate airport closed behind us. Nobody could have predicted the details. But the habit of noticing early and asking what it would mean for us made the difference. Awareness also works the other way round: noticing what you are giving away yourself. Years ago I arrived for the first time at the estate of a new client who was under an immediate and serious threat. A large house in the middle of nowhere, the kind everyone in the area knows. At the entrance, a sign with the owner's name and his personal mobile number. Nobody had thought about it, because it had always been there. He was away for most of the year, and for anyone looking for him, it was the first thing they would find. Today the sign at the gate is often a phone. Think of a principal's daughter on a night out in Ibiza, tagged in other people's stories, easy to find and easy to profile. A friend of a friend starts a conversation, mirrors her interests and slowly builds trust, grooming her. That is no longer teenage drama; it is a lever. Without a single physical approach, it can isolate her, put pressure on the family and, in the worst cases, open the door to blackmail or worse. Not because she is careless, but because the ecosystem around her is built to profile and exploit. I explored this scenario in more detail in "[Beyond The Firehose](https://www.protection-in-shifting-domains.org/beyond-the-firehose/)". That habit, noticing early and seeing yourself through someone else's eyes, is the core of protective work. For a long time, though, it stayed inside a small professional circle: protection teams, intelligence functions, people trained to look at the world that way. ### The threat moved, the habits did not Over twenty years I have seen the way pressure reaches people change. It used to arrive mainly in physical form: someone at the door, a vehicle following, an approach at an event. It still does. But more and more it starts somewhere else. A public profile that reveals more than intended. A message that looks like it comes from a colleague. A friendly contact at a conference who later asks for something small. A story that starts circulating before anyone has checked whether it is true. My master's research on the weaponisation of social platforms looked at how perception and behaviour can be shaped at scale in an international context, quietly and long before anything becomes visible. What struck me was not only the technology. It was how ordinary the entry points are, and how much they have become part of daily life. Most organisations are well organised within each lane. Physical security has its procedures, IT and cyber have their systems, communications has its policies. The risk tends to sit between them, where one form of exposure enables another and nobody feels it is their responsibility. I call it the gap. Last year a senior security lead at a major European institution described exactly that to me: the space between cyber and physical security, where each side assumes the other is watching, has the expertise and knows who the bad actors are. That is where today's pressure moves: social engineering, manipulation, extortion, espionage and sabotage of things everyone assumed were safe. The answer does not start with technology. It starts with awareness and training: these risks need to be consciously present on everybody's radar, not only on the security team's. ### The people who are never trained Executives get protection. Security teams get training. But the engineer who travels to a trade fair, the assistant who manages a director's calendar, the marketing colleague who posts content, the HR officer who interviews candidates, and the project lead with a detailed LinkedIn profile usually get nothing beyond an e-learning module on phishing. Yet they are often the easiest way in. In September the NOS reported that many Dutch companies, particularly in and around the defence sector, are not prepared for the sabotage and espionage now reaching Europe. That matches what I see. Not because people are careless, but because nobody has translated what protection professionals know into something an ordinary employee can use on a Tuesday morning. ### What HTA is, and what it is not [Hybrid Threat Awareness](https://www.ombrex.org/hta-training/?ref=protection-in-shifting-domains.org) is my attempt to make that translation. It takes the tradecraft I have used for two decades, in close protection, protective intelligence and operational planning, and turns it into six principles: Aware, Avoid, Assess, Communicate, Escape, Stabilise. These aren't theory, but routines people can apply at the office, at home and on the road. It is not about making people suspicious of their colleagues or turning staff into security officers. It is about noticing earlier, knowing what matters, and knowing who to tell. **Calm, not alarm.** The first sessions were delivered in Vienna to managers and assistants of a European company preparing for international travel. What stayed with me was not a dramatic moment. It was the quiet recognition in the room when people realised how much they were already giving away without noticing. ### Who keeps watch? The Netherlands knows better than most countries that safety depends on what you build before the water rises. But Dutch water management also knows that a dike rarely fails because the water simply flows over it. More often it fails from below. In a process called piping, water finds a path underneath the dike and slowly carries sand away with it. From the outside the dike looks intact. The only early sign is on the land side: a small spring, a boil of water bringing up sand, sometimes metres away from the dike itself. That is why the water boards still organise the *dijkwacht*, the dike watch. When the water is high, trained people walk the dikes and look for exactly those small signals. Not engineers with instruments, but people who know what a sand boil looks like, and who to call when they see one. Spotted early, a boil can be contained quickly with sandbags. Spotted late, it can bring down the dike. Hybrid threats behave the same way. They rarely break through the front wall. They work underneath, through the gaps, carrying small things away one at a time, and the first signs appear somewhere nobody is looking. Every organisation has its flood defences. The question is who keeps watch, and whether the people standing closest to the water know what to look for. Hot zones are easy to recognise. Being a hot target in a cold zone is not. That is where HTA starts. ### Why this, why now I can look back on twenty years of international protection work, across five continents and in some complex environments. But what I have always enjoyed most is teaching. At my dojo in South Tyrol, in the self-defence courses I ran for women, and in the workshops with Bodyguard Academy, the reward was the same: passing on what I had learned, so that others could carry it further. The world has changed, and the way we prepare people has to change with it. I don't believe in a society that is anxious. I believe in one that sees clearly. Awareness, spread widely and taught calmly, is one of the quiet things that makes organisations, and the communities around them, more resilient. Seeing the world as it is, and working towards a better one: that is why I built this training. *Björn Rifesser is the founder of Ombrex Consulting, which offers Hybrid Threat Awareness to organisations in English, German, Dutch and Italian. More information:* [*ombrex.org/hta-training*](https://www.ombrex.org/hta-training/?ref=protection-in-shifting-domains.org) --- **Sources** NOS, *Aanslagen op Europese defensiesector zetten ook bedrijven in Nederland op scherp*, 20 September 2026\. [nos.nl/artikel/2631723](https://nos.nl/artikel/2631723-aanslagen-op-europese-defensiesector-zetten-ook-bedrijven-in-nederland-op-scherp?ref=protection-in-shifting-domains.org)