A public-facing person leaves a richer profile than they realise — a schedule, a home area, a set of relationships, the details an approach could exploit. The Shield maps it before someone uses it.
Who the Shield is for
The Shield serves two situations. The first is a documented or suspected active threat — someone monitoring your activity, sending targeted messages, attempting impersonation, or building a profile for harassment or social engineering. The Shield models what an adversary could realistically assemble, assesses the pattern, and reduces what can be reduced.
The second is prevention. High public exposure is a risk factor before any specific threat materialises. Executives and public figures, but also creators, professional gamers, models, streamers, and anyone whose name, face and location are known quantities — the threat does not have to have started for the exposure to be real.
The Shield is a digital investigation. Physical security, active stalking, and criminal matters fall outside it and are referred to law enforcement and specialist partners.
What the Shield addresses
Conference appearances, tagged photographs, location-enabled posts, historical forum activity, publicly connected family members — each is a data point. Assembled, they create a targeting profile: a schedule, a home area, a set of relationships, the details an approach could exploit. For an active threat, that profile is already being used. For a prevention case, it is being built passively and will be available when someone decides to use it. The Shield maps it first.
What digital executive protection means in practice
Digital executive protection sits between physical executive protection and generic enterprise cybersecurity. The discipline behind it is protective intelligence, which maps your own profile the way an adversary would before any threat declares itself. Physical protection models the principal as a body to be moved safely; generic cybersecurity models them as a user with an account. Neither addresses the principal as what an OSINT-driven adversary sees: a public name attached to a home address, a family circle, a routine, an old breach password, and a set of handles that link it all together. The Shield is the digital layer those services do not cover, across four practitioner habits:
- Map the exposure surface — where the home address has propagated, which credential pairs sit in stealer-log corpora, which family members are usable as pretext, what public schedule the filings and appearances draw.
- Close the openings that close cleanly — people-search opt-outs, broker removals, social tightening, registry-data minimisation, password and recovery-channel hardening.
- Watch what reappears — people-search hits regenerate and credentials resurface; ongoing monitoring carries the cycle forward and is discussed as part of post-engagement review.
- Escalate when the threat model changes — a targeted impersonation or a fresh combolist hit is an event, not a finding, and the response routing is different.
A protective-intelligence assessment built on the full Mirror and Lockdown investigation — then three Shield-specific research layers on top.
What the investigation produces
The Shield runs the full Mirror and Lockdown investigation as its foundation — people-search platforms, breach databases, stealer-log corpora, dark-forum archives, social profiles and corporate leak databases — then adds three Shield-specific layers.
Full Mirror + Lockdown scope — public exposure and credential circulation mapped before the Shield-specific work begins.
With consent, your publicly visible activity is monitored for 30 days to map what your routine, locations and relationships disclose.
The profile a social engineer would build before contact — the shared history, affiliations and relationships they would invoke to seem legitimate.
Cross-platform behaviour analysis of found accounts to assess whether coordinated activity is underway. Physical danger is escalated.
What we produce
A full exposure report covering the Mirror and Lockdown foundation plus the three Shield-specific outputs — the 30-day pattern-of-life assessment, the social-engineering vulnerability profile, and the threat or targeting analysis — delivered in a structured report with a 60-minute analyst consultation to walk through it directly. Dedicated analyst support throughout; all collected data deleted within 48 hours of delivery.
Add-on AI & Deepfake Impersonation Assessment · €900
Based on Shield findings, assesses the publicly available material that could enable synthetic impersonation, with mitigation recommendations. Quoted and scoped separately.
The Shield does not stop at mapping. Where the surface can be reduced, we reduce it — and where a threat is active, findings are documented for escalation.
What changes
People-search opt-outs, broker removals, social tightening and registry-data minimisation are executed as part of the engagement. Exposed credentials are flagged for rotation with per-platform instructions; risky recovery routes are closed.
Documented for escalation
For an active threat, findings are documented in a form suitable for law enforcement or legal proceedings. Escalation routing is discussed in the consultation.
After the engagement
A hardened surface is a baseline, not a permanent state. After delivery, your analyst will discuss whether ongoing monitoring is appropriate for your situation — if it is, we will outline the options and scope.
Family exposure
Where family members extend the targeting surface, the Family Member Exposure Check (€750/person) runs a Mirror-level investigation with individual consent.
How the Shield compares
The Lockdown vs The Shield
The Lockdown investigates credential leaks and what is circulating about you. The Shield starts from an active threat: it includes the full Mirror + Lockdown foundation, then adds deep social analysis, harassment pattern assessment, a 30-day pattern-of-life study, social-engineering profiling, and a 60-minute consultation. You do not need to have bought The Lockdown first.
Does the Shield provide physical security?
No. The Shield is a digital investigation service. We assess online harassment patterns and identify what information could enable physical targeting. If you face an active physical threat, that is a matter for law enforcement — we will say so clearly and help you understand which digital evidence is relevant to report.
What 30-day monitoring includes
The pattern-of-life analysis monitors your publicly visible activity — posts, check-ins, tagged photos, replies — to map what your routine, locations and relationships inadvertently reveal. Done with explicit consent and documented in your threat report.
If you think you're being stalked online
Document everything first — dated screenshots of messages, profiles and contact attempts — and report to the relevant platforms. If the pattern suggests a credible physical threat, contact police and victim support. A professional report maps what the individual can actually see and build about you, in a form useful to law enforcement.
Shield FAQs
The Lockdown is an investigation into credential leaks and what's circulating about you. The Shield starts from an active threat — it includes the full Mirror + Lockdown foundation, then layers on deep social analysis, harassment pattern assessment, a 30-day pattern-of-life study, social-engineering profiling, and a 60-minute consultation.
No. The Shield is a digital investigation service. We assess online harassment patterns and identify what could enable physical targeting. An active physical threat is a matter for law enforcement — we will say so clearly and help you understand what digital evidence is relevant to report.
It monitors your publicly visible online activity — posts, check-ins, tagged photos, replies — to map what your routine, habits, locations and relationships reveal to someone watching. Done with explicit consent and documented in your threat report.
Document everything first — dated screenshots of messages, profiles, posts and contact attempts, saved to multiple locations. Report to the relevant platforms. If the pattern suggests a credible physical threat, contact police and victim support. A professional assessment maps what the individual can see and build about you, so you can reduce it.
Courts and police look for a documented pattern — repeated contact or monitoring over time, not a single incident. Useful evidence includes timestamped screenshots with URLs, contact across multiple platforms, attempts to find your location, and direct threats. A professional report cross-references behaviour across platforms and documents the pattern in a form useful for law enforcement and legal proceedings.