Most Manhattan UHNW residents I talk to have a mental model of reconnaissance that comes from movies. Someone in a car with binoculars across the street. Obvious surveillance. Something the doorman would notice.
That’s not what current reconnaissance looks like. What it actually looks like is boring, distributed, and mostly digital. And the people doing it are not the people the doorman is trained to identify.
Let me walk through what I’ve seen.
Our detailed coverage on OSINT threats to executives and wealthy families in 2026 covers the underlying intelligence collection categories. Related coverage on adaptive private security for changing New York threats addresses the operational architecture required.
What reconnaissance actually looks like now
Phase one is public information aggregation. Property records show your address. Real estate coverage shows what you paid. Corporate filings show your compensation and equity. LinkedIn shows your daily location patterns. Instagram shows your family members. Twitter shows your movement history. School social media shows your children. All of it accessible to anyone with a browser.
None of this requires a car across the street. None of it requires anyone approaching your building. Phase one happens entirely at a keyboard.
The October 2025 World Security Report from Allied Universal documented that 44 percent of corporate security chiefs are actively monitoring online threats against leadership. That statistic exists because the threats are actually there. Not theoretical. Observed.
Phase two is pattern identification. Analyzing the aggregated data to identify predictable schedules. When do you leave for work. When do you arrive home. Which restaurants you frequent. Which conferences you speak at. Which board meetings you attend. Which building your office is in. Which entrance you use.
The Brian Thompson killing was operational proof of exactly this pattern. His shareholder meeting was documented publicly. His arrival at the Hilton Midtown was predictable. The operational window between his arrival and his entrance into the building was calculable in advance.
That’s what reconnaissance in Manhattan looks like now. Not someone watching from across the street. Someone reading your public calendar three weeks in advance.
Phase three — physical validation
Only after phases one and two have produced sufficient intelligence does anyone actually approach the physical environment.
Physical validation is short. Someone walks past your building at the times your calendar suggests you arrive and depart. They observe. They confirm. They identify specific patterns that will inform operational planning.
This phase is the one that building security might notice. But building security is trained to identify random or opportunistic reconnaissance. Sustained validation by someone who already has three weeks of digital intelligence looks different. It’s brief. It’s specific. It doesn’t look like reconnaissance because it’s already targeted rather than exploratory.
The doorman doesn’t identify it because the doorman is watching for the movie version.
Phase four — the operational plan
Once phases one through three produce sufficient intelligence, the operational plan gets built.
For Thompson, the plan was execution during arrival transition at a documented location at a documented time. Public event schedule provided the timing. Building layout provided the location. Standard executive protocols provided the vector.
The vulnerability wasn’t at his residence. The vulnerability wasn’t at his office. The vulnerability was in the window between them that documented public schedules made calculable in advance.
For Manhattan UHNW residents whose profile includes documented public exposure, this is the same pattern that applies to you. Not exactly the same threat vector. But the same intelligence collection process. The same pattern of documented schedules producing operational planning windows.
The Billionaires Row specific problem
The Billionaires Row corridor along 57th Street — Central Park Tower, 220 CPS, 111 West 57th, One57, Aman NY Residences — produces a specific reconnaissance problem that other Manhattan luxury buildings don’t face as intensely.
The concentration of ultra-wealth in that corridor is possibly the densest anywhere globally. That produces target concentration that state-level actors and organized crime operations both actively work.
The building-level architecture at these towers wasn’t designed for sustained sophisticated reconnaissance targeting specific residents. It was designed for the categories that building security has traditionally handled — random visitors, delivery coordination, opportunistic access attempts. All of which the buildings handle well.
Sustained reconnaissance operates outside what building architecture is designed to counter.
The FIFA World Cup overlay
The 2026 FIFA World Cup is holding matches at MetLife Stadium through late June and July. The concentration of international visitors, elevated regional security posture, and public event activity produces both direct protective operations and secondary effects on the broader executive protection environment.
For Manhattan executives whose profile includes public appearances during this window, the operational picture is more constrained than normal. Our coverage on executive protection for World Cup visitors moving between Miami and Palm Beach addresses the cross-market movement pattern.
The seasonal migration adds another layer
A significant share of Manhattan UHNW residents maintain Palm Beach County residences. The seasonal migration creates transition windows twice each year. Reconnaissance conducted during the Manhattan season persists through the Palm Beach season and vice versa. Digital intelligence transfers instantly. Physical reconnaissance transfers with slight adjustment for the geographic move.
Fragmented security providers in each market start over at every transition. Threat intelligence doesn’t transfer. Standing relationships don’t transfer. The reconnaissance operators, meanwhile, transfer their intelligence with them.
Our coverage on travel security across the Manhattan-Palm Beach corridor addresses the specific integrated architecture required.
What effective response looks like
Counter-surveillance operations that actively look for sustained observation. Not passive camera coverage that records after the fact. Active operational awareness that identifies the digital signature of intelligence collection and the physical signature of pattern validation.
Digital exposure management. Reducing the public information footprint that phase one aggregation depends on. This is the data broker removal and OSINT reduction work most residents haven’t engaged with.
Operational unpredictability. Varying routines. Non-obvious protective coverage. Access pattern variation. Making phase two pattern identification substantially harder.
Documented pattern-of-life analysis and continuous re-evaluation. What your patterns actually look like from an outside observer’s perspective. What intelligence they produce. What operational planning they enable.
What to do now
If your profile includes documented public exposure, corporate governance visibility, or family office operations — treat reconnaissance as an active operational category. Not something that might happen someday. Something that’s happening now, at some level, whether you’ve engaged with it or not.
Assess your public information footprint. Most Manhattan UHNW residents haven’t engaged with data broker removal, OSINT reduction, or digital exposure management. That’s phase one intelligence collection running against you continuously.
If your last comprehensive security review predates December 2024, you’re operating on assumptions from before the environment permanently shifted.
Where to Go From Here
Start with the Converged Digital Exposure Checklist. It’s the 15-point audit that reveals what an adversary can buy about you for under $100.
If you’re ready for a confidential conversation, request an audit here. We assess reconnaissance environment specifically.
For the seasonal corridor architecture, read our Manhattan-Palm Beach travel security coverage.
I’m John Hamilton, HKDS founder. We provide executive protection, corporate security, and residential security across Manhattan, all NYC boroughs, Westchester County, and the Hamptons. Contact us.