(TLP:CLEAR) Gate 15 White Paper – The Hostile Event Attack Cycle, 2026 Update

Summary: Gate 15, a close WaterISAC partner, recently released an in-depth white paper, “The Hostile Event Attack Cycle (HEAC), 2026 Update.” The report examines the seven phases of hostile event planning: initial target considerations, initial surveillance and research, target selection, planning and rehearsals, pre-attack operations, attack, and escape. The update incorporates lessons from recent incidents and explores evolving threats, including online radicalization, encrypted communications, drones, and artificial intelligence (AI) in attack planning.

Analyst Note: Hostile events reinforce a consistent security lesson: hostile acts often involve observable activity before violence occurs. The incidents vary in target type, tactic, and outcome, but each reflects elements of the Hostile Event Attack Cycle. Gate 15’s Hostile Event Attack Cycle, or (HEAC), is intended to help organizations understand how threat actors may plan and execute hostile events so security teams can identify opportunities to disrupt the cycle before an attack occurs.

The paper emphasizes recognizing warning signs and intervening before an incident occurs. It provides practical resources, including phase-specific indicators, checklists, and sample reporting procedures. Recommended measures include employee awareness training, physical security improvements, behavioral threat assessment teams, information sharing, and rehearsed incident response plans.

Moreover, as WaterISAC has previously reported, disgruntled individuals or individuals on a radicalization pathway rarely mask all warning signs of potential violence before carrying out an attack. Instead, many potential attackers exhibit red flags or proximal warning behaviors that together form patterns of risk, which other employees or bystanders can detect and report to help prevent an act of violence. As the threat environment continues to evolve with targeted violence a reoccurring phenomenon, understanding the HEAC is critical for every critical infrastructure employee.

According to Gate 15,  the message remains unchanged in the new update. We cannot stop every threat, but each phase offers a window to detect, disrupt, and prevent. What is new is practical. The update adds three tools built for training:

• A section concerning behaviors and warning signs for each phase.
• A warning signs checklist with real examples that you can add to an existing program.
• A sample awareness email and reporting procedures that you can adapt for your own team.

Original Source: https://gate15.global/white-paper-the-hostile-event-attack-cycle-heac-2026-update/

Additional Reading:

• (TLP:AMBER) Understanding Physical Threat Actors’ Tactics Can Help Thwart Violence and Other Malicious Activities
• Strategies for Designing a Workplace to Prevent and Mitigate Hostile Events
• (TLP:AMBER) Gate 15 Threat Awareness & Resilience Guidance Report: Bystander Intervention – Critical for Mitigating the Risk of Targeted Violence (18 April 2025)

Related WaterISAC PIRs: 1, 2, 3, 4 & 5