Updated by David Pounder and Andy Jabbour
Hostile events rarely come out of nowhere. Attackers follow a pattern, and each step in that pattern offers an opportunity to notice and intervene. That idea underlies the Hostile Event Attack Cycle (HEAC), introduced by Gate 15 in 2016 and last updated in 2021. Today we are sharing the 2026 update.
The seven phases remain the same: initial target considerations, initial surveillance and research, target selection, planning and rehearsals, pre-attack operations, the attack, and the escape. The update walks through each phase in light of recent events, including the 2025 New Orleans truck attack, the 2022 Uvalde school shooting, and the 2024 Crocus City Hall attack in Russia. It reviews how online radicalization, geopolitical conflict, domestic extremism, and workplace violence shaped the threat from 2022 through 2025. It also shows attackers turning to encrypted communications, drones, and artificial intelligence (AI) to plan and rehearse.
What is new is practical. The update adds three tools built for training:
- A section on concerning behaviors and warning signs for each phase.
- A warning signs checklist with real examples that you can add to an existing program.
- A sample awareness email and reporting procedures that you can adapt for your own team.
The message remains unchanged. We cannot stop every threat, but each phase offers a window to detect, disrupt, and prevent. Read the update, identify where your organization is strongest and weakest, and use the checklist to start the conversation with your people. Then act to protect your People, Places, Data, and Dollars. Our team is glad to help turn the update into training for your organization.