Today's briefing:
Mexico descends into chaos after CJNG leader killed
Seven months of digital surveillance preceded the Guthrie kidnapping
An armed man killed at Mar-a-Lago
Corporate EP spend is up 45% in four years
Welcome to your Tuesday briefing.
Three incidents, three different settings, one thread running through them all. The people and places considered safest may not be. And the people doing the targeting have done their homework.
The most urgent story on the board right now is Mexico. If you have people, assets, or supply chains moving through western or central Mexico, what happened on Saturday changes your risk picture today.
Don’t have time to read?
Listen to an audio version of today’s briefing.
TOP STORY
After El Mencho
On February 22, Mexican special forces raided a property in Tapalpa, Jalisco, and killed Nemesio Oseguera Cervantes, known as El Mencho, the leader of the Jalisco New Generation Cartel (CJNG). The operation was supported by US intelligence. El Mencho had been the most wanted drug trafficker in North America for over a decade.
The story everyone will run is the kill. The story that matters for us is the 24 hours that followed.
What happened next
Within hours of his death, the CJNG activated what appeared to be a pre-planned retaliation protocol. Over 250 vehicles were set on fire to create roadblocks across 20 Mexican states. The city of Guadalajara, home to around five million people and a significant hub for international manufacturing, was effectively shut down. Twenty-five members of Mexico's National Guard were ambushed and killed. The US Embassy in Mexico City issued an immediate shelter-in-place order for American citizens across multiple states.
Why the kill makes things worse, not better
There's a persistent assumption in corporate risk planning that removing a cartel leader reduces the threat. The evidence says otherwise.
The CJNG under El Mencho was brutal, but it operated with a clear command structure and defined territorial control. What follows leadership decapitation is a succession war, with rival internal factions competing for control and external cartels, most likely Sinaloa, moving to claim territory and transit routes the CJNG previously held.
You can model behavior from an established criminal organization. You cannot easily model four competing factions simultaneously asserting dominance over the same geography.
The US dimension
This operation didn't happen in isolation. The Trump administration declared the US to be in a "non-international armed conflict" with cartels late last year, classifying cartel members as unlawful combatants. US military strikes have already hit suspected smuggling vessels in the Caribbean.
Host nations resenting unilateral US military action on their territory are less cooperative with American firms, and cartel factions now have a political framing for targeting US-linked assets that extends beyond purely financial motivation.
Our take:
The 150 days following this kill are the most dangerous period for corporate operations in Mexico in recent memory. The succession war will be violent, geographically unpredictable, and extremely difficult to map in real time. Any security plan built around the assumption that the CJNG maintained a kind of brutal operational order needs to be rewritten now.
Practically: halt non-essential executive travel to Jalisco, Michoacán, and Guanajuato immediately. For supply chains that cannot be paused, move to heavily vetted local logistics providers, upgrade to armored transport on primary routes, and ensure you have a live local intelligence feed rather than relying on static country risk ratings. Static ratings will lag weeks behind what is actually happening on the ground.
READER POLL
Will El Mencho's death ultimately reduce or increase the threat to foreign business operations in Mexico?
INDUSTRY EVENTS
The nation’s leading converged security event, bringing together the industry’s leading professionals, experts, and innovators across physical and digital security. Register to attend →
MEANWHILE…
Seven Months of Surveillance
On February 1, Nancy Guthrie, 84-year-old mother of NBC Today presenter Savannah Guthrie, was abducted from her home in Tucson, Arizona. A $6 million ransom demand in cryptocurrency has been sent to media outlets. The FBI has expanded its search into Mexico.
Investigators found, through Google Trends analysis, that whoever planned this spent at least 7 months collecting intelligence, researching details such as Savannah Guthrie's salary and her mother's specific home address, before anyone moved physically.
Primary principals are increasingly well protected. Their parents and elderly relatives living in modest, low-security settings often are not. For a kidnap-for-ransom operation, the elderly parent of a wealthy or famous person is a high-value, low-resistance target.
The seven-month digital research phase is entirely passive. Public salary data, property records, social media posts tagging family members, and news articles mentioning relatives by name can all be compiled into an accurate targeting package without anyone approaching the property. By the time a team moves, they know exactly what they are walking into.
Family privacy audits need to be part of the protection conversation. Removing family members from data broker sites, reviewing accessible public records, and having a direct conversation with relatives about what they post online are the practical next steps.
The Gate Problem
At 1:30 AM on February 22, Austin Tucker Martin, 21, drove through the north gate of Mar-a-Lago in Palm Beach, armed with a shotgun and carrying a gasoline canister. Secret Service agents and a local deputy confronted him inside the perimeter. He raised the weapon and was shot and killed. Trump was not present.
Martin had no criminal record. He had been reported missing by his family. His documented fixation appears to have been the recently released Jeffrey Epstein files.
The breach happened because a gate opened to let an authorized vehicle exit, and Martin drove through the same opening. This is a known failure point called tailgating. It can happen at any gated facility, regardless of how sophisticated the surrounding security infrastructure is.
The second point is the profile. No prior history. A sudden intense fixation on material circulating online, translating into physical action within a short timeframe. When controversial document releases or high-profile news cycles are active, threat assessment teams need to account for the speed of that pathway from online obsession to physical approach.
Single-barrier gate entry is not sufficient at a genuinely high-risk site. Secondary vehicle barriers or manual verification during egress cycles are not excessive precautions. They are the minimum.
Sound even smarter:
The CJNG's ability to deploy 250 simultaneous roadblocks across 20 states within hours of El Mencho's death points to a decentralized command structure where retaliation can be executed without central coordination. Disrupting the organization further just got harder, not easier.
The cartel most likely to benefit from El Mencho's death is Sinaloa, which has been rebuilding since the US extradition of Joaquín "El Chapo" Guzmán in 2017. Sinaloa already controls significant portions of the US fentanyl supply chain. A territorial expansion into CJNG-held routes in Jalisco and Michoacán would make it the dominant cartel across both coasts.
SNAPSHOTS
🇫🇷 FRANCE — France's Ministry of Economy confirmed a breach of FICOBA, the national bank account registry, exposing names, home addresses, and financial identifiers for roughly 1.2 million account holders. Attackers accessed the database using compromised government credentials.
🇮🇱 ISRAEL / WEST BANK — Israel's government has resumed land registration processes in Area C of the occupied West Bank, a move the UN Secretary-General and the Organization of Islamic Cooperation have condemned as de facto annexation. The OIC called an emergency meeting in Jeddah to coordinate a response.
🇬🇧 UNITED KINGDOM — Hundreds of Britain First supporters and counter-protesters clashed in Manchester city centre on February 21, prompting Greater Manchester Police to deploy dispersal orders and arrest eleven people for offences including assaulting emergency workers. The willingness of protesters to physically attack uniformed officers is a direct indicator of the environment facing unarmed private security personnel at nearby commercial premises.
🇮🇷 IRAN — The European Union formally designated Iran's Islamic Revolutionary Guard Corps (IRGC) as a terrorist organization this month, triggering asset freezes and travel bans across the bloc. The IRGC operates networks of proxies well beyond Iran's borders, and the designation removes any remaining diplomatic ambiguity about how the EU views those operations.
EXTRA INSIGHT
INDUSTRY DATA — New analysis of corporate filings shows the percentage of executives receiving dedicated protection rose from 23.3% in 2020 to 33.8% in 2024. The technology sector saw a 73.5% jump. Communications companies are now spending a median of $1.2 million annually on EP programs. The trend was already building well before the Brian Thompson assassination last year.
DRONES — Drone incidents near UK military bases doubled in the past year, from 126 to 266 recorded incursions. The proposed Armed Forces Bill would give military personnel legal authority to destroy drone threats near defense sites, but private sector sites have no equivalent cover. For corporate campuses and executive residences, passive detection capability, including radar and radio frequency scanning, is currently the only lawful option and investment in it is overdue.
PREVIOUS POLL - RESULTS
Q: When federal agencies operate without funding like this, which impact hits your operations hardest?
🟨🟨⬜️⬜️⬜️⬜️ A. Client travel gets disrupted by TSA delays and security inconsistency (12%)
🟩🟩🟩🟩🟩⬜️ B. Threat intelligence from CISA dries up when you need it most (38%)
🟩🟩🟩🟩🟩🟩 C. Coordination with federal partners becomes impossible to rely on (42%)
🟨⬜️⬜️⬜️⬜️⬜️ D. Proving ROI on security gets harder when federal infrastructure is down (4%)
🟨⬜️⬜️⬜️⬜️⬜️ E. Other → reply (4%)
Your Comments:
JH: "Federal coordination disappears exactly when you need it. Nobody picks up the phone during a shutdown."
ST: "All of the above, honestly. It compounds. One gap creates three more."
***
The organizations and individuals who assumed the state would absorb the worst of the risk are finding out that assumption has a shelf life. Federal agencies are stretched, local police are overwhelmed, and in places like Mexico the state has ceded the ground entirely. The gap is widening. The teams with their own planning and their own contingency logistics are the ones still running when things go sideways.
See you next week.
– On The Circuit
If you found this useful, forward it to someone who needs to read it. If someone forwarded this to you, subscribe at https://archives.circuit-magazine.com/ . To give or receive feedback, hit reply.
Become An AI Expert In Just 5 Minutes
If you’re a decision maker at your company, you need to be on the bleeding edge of, well, everything. But before you go signing up for seminars, conferences, lunch ‘n learns, and all that jazz, just know there’s a far better (and simpler) way: Subscribing to The Deep View.
This daily newsletter condenses everything you need to know about the latest and greatest AI developments into a 5-minute read. Squeeze it into your morning coffee break and before you know it, you’ll be an expert too.
Subscribe right here. It’s totally free, wildly informative, and trusted by 600,000+ readers at Google, Meta, Microsoft, and beyond.
