Five security risks to watch in November 2026

In this monthly series, Mike Evans, Chief Intelligence Officer at Securitas, examines the key developments shaping the security landscape and what they mean for organizational resilience.  

As November begins, my top five issues for security and resilience leaders are: 

1. European unrest and the potential for disruption to spread across borders and groups 
2. The US midterms and the risk period beyond election day 
3. Anti-AI activism and the range of tactics organizations may face 
4. National preparedness and the role of business in building wider resilience 
5. Holiday-season security as familiar threats continue to evolve 

The key message: 

Security leaders don’t need to predict every incident. They need to understand what is changing, how that affects their organization, which warning signs matter, and how to turn assessment into action.

European unrest: a case of contagion risk

November provides a case study in contagion risk, using the example of how unrest can spread across geographies, grievances and communities. 

Potential triggers include French union strikes on 5 November, environmental activism around COP31 from 9–20 November, and anti-war demonstrations and the proposed Gen Z “Revolution Europe Tour” on 20 November. 

These campaigns involve different groups, objectives, and causes. They should not be treated as a single movement. But unrest does not always remain within clear geographic or ideological boundaries. Social networks allow narratives and tactics to be seen, adapted, and repeated elsewhere, even without formal coordination. 

This creates three forms of potential contagion:

• Geographic spread: events in one country encourage activity elsewhere

• Grievance crossover: different causes begin to share narratives, targets, or demands

• Tactical imitation: groups copy methods that appear to have worked for others

Most demonstrations will remain lawful and peaceful. However, periods of heightened mobilization can create opportunities for criminals, extremists, and other actors to exploit disorder, increase division, or attach themselves to legitimate causes.

What to watch

Shared dates of action across countries; common narratives between previously separate campaigns; organizations or sectors being named as targets; calls for escalation or direct action; and signs that criminals or extremists are seeking to exploit protest environments.

So what for security?

• Monitor related activity across borders, rather than assessing each event in isolation

• Identify whether your sites, sector, or supply chains are emerging as shared targets

• Distinguish lawful protests from signs of disruptive or criminal intent

• Prepare higher-exposure sites for demonstrations, blockades, or direct action

• Monitor whether other threat actors are exploiting unrest or reduced security

• Consider the combined effect of simultaneous or consecutive disruption

An individual event tells you what’s happening. The links between events may tell you what happens next.

US midterms: election day is not the end of the risk period 

The US midterms show why heightened security doesn’t necessarily indicate an imminent or severe threat. Elections involve critical people, processes, systems, and locations. Even limited disruption can have wider consequences for public confidence, political legitimacy, or continuity.

Risk is driven by the interaction between the threat, the importance of what could be affected, and an organization’s vulnerability. Additional controls can therefore be proportionate even when the threat itself is considered manageable. Their purpose is often to reduce vulnerability and keep the consequences of disruption within acceptable limits.

Election day should also be treated as a milestone, not an endpoint. Risk can continue as votes are counted, results emerge, and political narratives develop. Delayed or contested outcomes, misinformation, hostile rhetoric, and calls for mobilization may extend the threat window beyond 3 November. Planned demonstrations in Washington, D.C. from 10–12 November show how other political causes may intersect with the post-election environment.

Organizations should not automatically remove heightened measures as soon as polling stations close. Controls should remain tied to the risk picture and clear decision points.

What to watch

Disputed or delayed results; escalating political rhetoric; narratives alleging fraud or illegitimacy; threats against officials or institutions; calls for post-election mobilization; manipulated or synthetic content; and other campaigns seeking to use the political environment for their own aims.

So what for security?

• Manage the election as a cycle covering the campaign, the vote, the immediate aftermath, and later political milestones

• Apply additional controls at sites where even minor disruption could have a disproportionate impact

• Set clear criteria for increasing, maintaining, and reducing security measures

• Monitor online narratives for signs of physical mobilization

• Protect higher-exposure offices, facilities, events, and executives

Good security is not about predicting that disruption will occur. It’s about keeping the consequences manageable if it does.

Anti-AI activism: understand the possible range of tactics 

The security implications of AI increasingly extend beyond cyber threats, information integrity, and digital systems. The physical infrastructure behind AI is becoming more visible. Data centers require land, construction, energy, water, connectivity, and complex supply chains. As investment grows, these projects are attracting opposition linked to environmental impact, housing, energy costs, surveillance, militarization, and supply-chain practices.

A coalition of local activist groups and civil-society organizations across Europe has designated 6–7 November as days of action under the Stop Dirty Data Centers campaign. It is calling for a pause in large-scale data center developments until social and environmental concerns are addressed.

Separate action is planned against a specific data center in the Netherlands by a group previously associated with disruptive activity. This shows why organizations should not assume that every group involved in a wider campaign has the same aims, capabilities, and methods.

Tactics may range from public campaigning and lawful demonstration to blockades, occupations, trespassing, vandalism, property damage, or, at the most serious end, extremist activity.

Escalation is not inevitable, and peaceful activism should not be treated as criminality. Assessments should be based on objectives, intent, capability, and observable warning signs, not on labels.

What to watch

Specific organizations or facilities being named; changes in rhetoric; publication of site details; signs of reconnaissance; instructions for disruptive action; movement from awareness-raising to operational interference; and property damage or suspected sabotage.

So what for security?

• Map exposure across sites, projects, suppliers, and business associations

• Protect vulnerable construction sites, infrastructure, and critical equipment

• Scenario plan for blockades, occupations, or other non-violent disruption

• Ensure escalation procedures distinguish clearly between protest and criminality

• Assess the operational and financial effects of unlikely but high-impact activity

Do not assume that backlash will escalate. But understand what escalation would look like before it happens.

AI generated image

National preparedness: what is the role of business?

More governments, particularly in Europe, are encouraging citizens to prepare for potential crises. The scenarios differ, from severe weather and prolonged infrastructure disruption to cyberattacks, terrorism, and geopolitical conflict. The common message is that societies must be able to absorb disruption instead of relying only on emergency services or government intervention.

That raises a related question for the private sector: what role should organizations play in national preparedness and resilience?

Businesses employ people, operate facilities, manage supply chains, and deliver services on which communities and economies depend. Some own or support critical infrastructure. Others provide security, technology, logistics, communications, or other capabilities that keep essential activity moving. Organizational resilience and national resilience are therefore closely connected.

Security and business leaders should be able to answer two questions. First, what is the organization doing to support preparedness? The answer should go beyond having a crisis-management or business-continuity plan. It should explain how the organization protects its people, operations, assets, supply chains, customers, and reputation, and how it contributes to the wider system around it.

Second, what would cause the organization to act? A single cyber incident, suspicious drone flight, infrastructure failure, or suspected act of sabotage may be difficult to interpret. Several related indicators could point to a meaningful pattern. Leaders need agreed thresholds for deciding when a pattern justifies a change in posture.

What to watch

Changes in government preparedness guidance; new resilience initiatives; updates to official threat assessments; unusual disruption affecting critical infrastructure; suspected sabotage or reconnaissance; and clusters of incidents with similar targets, timing, or methods.

So what for security?

• Define the organization’s role in national and societal resilience

• Identify which people, assets, operations, and services are genuinely critical

• Map dependencies on infrastructure and services managed by others

• Test resilience against prolonged and overlapping disruption

• Agree thresholds for changing security posture or activating plans

• Assign clear decisions, owners, and actions to each threshold

Warning is only useful when it is connected to decisions: when to act, why, and with what objective.

Holiday-season security: reassess familiar threats 

Thanksgiving, Black Friday, Christmas, and New Year’s celebrations bring a recurring concentration of people, travel, commerce, and online activity. The broad threat categories are familiar: theft and organized crime, fraud, cyberattacks, risks to crowded places, pressure on transport networks, and continued concern around extremism.

But familiar threat categories do not mean the risk environment is the same. Threat actors learn and adapt. Technology gives them new capabilities, while established tactics become cheaper, faster, and more convincing. Generative AI, for example, can improve the quality and scale of phishing, impersonation, and social-engineering campaigns.

Threat-actor intent and target selection can also change. Developments during the year may alter the importance of aviation, transport, retail locations, seasonal events, or specific organizations. Last year’s reporting remains a useful baseline, but it should not become this year’s assessment.

The key question is therefore not whether the same threats will return. It’s how threat actors, capabilities, tactics, and targets have changed since last year.

What to watch

AI-enhanced phishing and impersonation; changes in social-engineering methods; criminal targeting of retail, logistics, and payment systems; hostile reconnaissance around crowded places; threats to aviation and transport; extremist narratives focused on seasonal gatherings; and adaptations of previously successful attack methods.

So what for security?

• Build the seasonal assessment from current intelligence, not last year’s conclusions

• Reassess threat-actor intent, capabilities, tactics, technologies, and preferred targets

• Test whether existing controls address current rather than historic threats

• Reinforce employee awareness of increasingly credible impersonation attempts

• Review travel security during peak movement periods

• Maintain clear escalation and decision-making arrangements during reduced-staff periods

The threat category may be familiar. The actor, capability, and method may not be.

Key Dates for November 

• 3 November: US midterm elections
• 5 November: Million Mask March annual hacktivist actions
• 5 November: French union strike activity
• 6–7 November: European days of action against large-scale data-center development
• 9–20 November: COP31, Antalya, Türkiye
• 10–12 November: Planned demonstrations in Washington, D.C.
• 20 November: Anti-war protest and strike activity in Europe
• 20 November: Proposed Gen Z “Revolution Europe Tour”
• 26 November: Thanksgiving
• 27 November: Black Friday
• 25 December: Christmas Day, looking ahead
• 31 December: New Year's Eve, looking ahead

Final thoughts

November’s five developments illustrate how quickly familiar issues can acquire new significance. Protest narratives and tactics can travel more quickly. Election-related risk can continue beyond the vote itself. AI infrastructure is creating new targets and grievances. Governments are placing greater emphasis on shared resilience. Seasonal threat actors are gaining new tools and adapting established methods.

The role of security and intelligence is to identify these changes early enough for organizations to act. That means separating threat from risk, likelihood from impact, and isolated reporting from meaningful patterns. It also means understanding where the organization is vulnerable and which people, assets, and operations are critical enough to require action.

Most importantly, warning must be connected to decisions. The organizations best placed to navigate November will not be those trying to identify every incident before it occurs. They will be those that recognize when risk has changed, understand why it matters, and already know what they will do next.