The OSINT Advance Toolkit Every Protective Detail Should Run

On July 13, 2024, a gunman climbed onto a roof outside a Trump rally in Butler, Pennsylvania, and came within a few centimeters of changing American history. The failure that day was not muscle at the rope line. The Senate report that followed called the tragedy preventable, and traced it to the part of the job that happens before anyone deploys: the advance, and the intelligence that was supposed to flow through it. Threat information existed. It never reached the people standing the post.

Most of us will never work a national political event. But every one of us runs an advance, and the same truth holds at any scale. The work that decides whether a detail succeeds is done days earlier, on a laptop, by whoever bothered to look. Here is the uncomfortable part: the adversary is running an advance too. The man who traveled to Justice Brett Kavanaugh's home in 2022 had researched the address extensively before he ever set out. He built his targeting picture from open sources. Whoever maps the ground first has the advantage.

This piece is a field-ready open-source intelligence method for advance work: a repeatable workflow for building a venue, a route, an event, and a threat-actor picture before your principal moves, using tools a working operator can actually run. It names the specific tools, sets out the sequence, and flags where the legal lines sit. It comes with a downloadable OSINT advance toolkit, a multi-tab workbook your team can run before every job and log findings across details, so the process survives past the one operator who happens to be good at it.