The best protection is not always the most visible.
In many environments, a team can operate more effectively when its presence does not attract unnecessary attention to the principal, interfere with normal activity or reveal how the security arrangement works.
The familiar image of a close protection operative in a dark suit, sunglasses and visible communications equipment still has its place. At a formal event or where deterrence is part of the security requirement, an overt presence may be entirely appropriate. In other circumstances, the same approach can make the principal more noticeable, identify members of the team and give an observer an early indication of how the protection is organised.
This is where the concept commonly known as Grey Man Theory becomes relevant. It is concerned with reducing unnecessary exposure by adapting appearance, behaviour and operating style to the environment.
At Global Protection Group, we treat it as one element of a wider, risk-based approach to executive and close protection. Whether a low-profile posture is appropriate depends on the principal, the environment, the threat picture and the nature of the assignment.
What does ‘grey man’ actually mean?
The term has little to do with colour or with trying to disappear.
The principle is to fit naturally into the environment while retaining the ability to observe, protect and respond. A member of the team should be in the right position, with the equipment and access needed to act, without unnecessarily advertising their role.
People tend to notice what does not belong. Someone who appears out of place will attract attention whether they are wearing a suit, sportswear or tactical clothing. The relevant question is therefore whether they look natural in that particular environment.
The decision to adopt a low-profile posture should form part of a wider risk-based protective methodology. That broader approach is consistent with the principles reflected in ISO 31000 and ISO 18788, as well as the broader framework set out in the ASIS International Executive Protection Standard.
Whatever the jurisdiction, the operating model must remain within the applicable legal and regulatory framework.
Grey Man Theory does not replace planning, procedures, training or professional judgement. It is one method of reducing unnecessary exposure where discretion genuinely improves the security position.
Low profile does not mean low capability.
A discreet team must still be able to observe, communicate, move, assist and, if necessary, move the principal safely away from a developing threat. Communications and other operational equipment need to remain immediately available even where there is no reason for them to be on display.
Where the assessment calls for an overt presence or a deliberate deterrent effect, visibility may be the more appropriate option.
Fitting the environment
Grey Man Theory is sometimes reduced to a discussion about clothing, although clothing is only one part of it.
There is no universal outfit for discreet protection.
Cargo trousers, tactical boots, a MOLLE backpack and an oversized tactical watch may look entirely normal on a shooting range or during field training. The same combination in a high-end hotel, restaurant, corporate conference or private event can immediately suggest a military, law-enforcement or security background.
A suit can create the same problem in reverse. It may be entirely appropriate at a formal business event but make someone stand out immediately in a more relaxed setting.
A close protection operative working low profile should therefore dress for the location, the principal, local conditions, the task, equipment requirements and the assessed threat. Clothing has to support the job without making the individual unnecessarily recognisable.
Behaviour matters just as much.
Repeatedly touching an earpiece, exaggerated scanning, rigid positioning or obvious operational language can reveal someone’s role more quickly than their clothing. Effective low-profile work depends on understanding what is normal in a particular place and recognising the things that are not.
Observation should remain discreet and come from situational awareness, familiarity with the space, natural movement and good teamwork. An experienced CPO should notice more than the average person without making that vigilance obvious.
Low profile applies to the whole operation
Discretion does not stop with the person standing closest to the principal.
It extends to vehicles, drivers, communications, routes, accommodation, liaison with venues and the handling of operational information.
Vehicle selection is a simple example. A car that blends naturally into one city or environment may attract immediate attention in another. The right choice depends on local conditions, the principal’s profile, the level of risk and what the vehicle actually needs to do.
How it is used can be even more revealing. Repeated routes, predictable parking positions, identical departure times and distinctive driver behaviour may expose patterns that are considerably more useful to an observer than the make or model of the car.
The same applies to the team. Matching clothing, identical equipment and repetitive movement patterns make individuals easier to identify and may reveal how the security arrangement is structured.
Changing the appearance of the CPO closest to the principal achieves little if everything else continues to advertise the protective footprint.
For this reason, low-profile work needs to be considered across the entire operation rather than treated as a dress code for the team member nearest the principal.
The information footprint
Discretion also continues after the team leaves the venue.
A CPO may work in a disciplined, low-profile manner throughout an assignment and then disclose more than intended through a single social-media post.
Modern reconnaissance does not always require physical surveillance. Public profiles, photographs, videos and posts can be collected, compared and analysed over time. Images taken around vehicles, hotels, airports, aircraft or events may reveal locations, transport arrangements, frequently used venues, team composition and elements of the security structure.
Real-time posting creates the most immediate risk, but delayed content can still expose routes, travel patterns and recurring arrangements.
The significance of a single photograph may not be obvious. The concern arises when photographs, event schedules, travel information, public posts and details shared with third parties can be combined into a coherent picture of the principal’s routine and the way their security is organised.
This is why OPSEC should not be limited to information formally marked as confidential. Apparently ordinary details can become operationally valuable when combined with information from other sources.
Access should therefore be based on genuine need-to-know. The same principle applies to messaging groups, travel documentation, attendee lists and information passed to drivers, hotels, venues and subcontractors.
Managing the information footprint is therefore as much a part of low-profile protection as managing physical visibility.
The principal is part of the security picture
The team’s behaviour is only part of the equation.
Maintaining a discreet operation becomes considerably harder when the principal routinely publishes locations, travel plans, accommodation, family information or details of daily movements.
The principal — and, depending on the circumstances, members of their immediate circle — should therefore be included in the security process.
This does not mean asking clients to abandon social media. In most cases, a better approach is to agree sensible and proportionate rules concerning real-time posting, location disclosure, private residences, images of team members and predictable routines.
The reasoning behind those recommendations should also be explained. People are much more likely to follow security advice when they understand what an apparently harmless photograph, check-in or post may reveal when viewed alongside other information.
Effective protection depends on cooperation. The principal is not simply the person being protected; their decisions and behaviour can directly influence the effectiveness of the wider security arrangement.
The principal is not marketing material
A separate issue is the use of photographs with principals to build a personal profile, promote services or demonstrate professional status.
For anyone working in executive or close protection, this deserves particular caution.
Publishing photographs with a principal may conflict with confidentiality obligations and can undermine the trust on which the professional relationship depends. Permission to take a photograph should not automatically be treated as permission to publish it or use it for marketing.
Before any such material is made public, contractual obligations, confidentiality requirements, privacy and image rights, data-protection considerations and, above all, the principal’s security interests need to be considered.
In this sector, professional credibility is built primarily on discretion, competence, responsibility and trust. A portfolio of recognisable clients is not a substitute for any of them.
When should protection be visible?
Low-profile protection is not appropriate in every situation.
An overt security presence can provide deterrence, support access control, help maintain space around the principal or meet a particular operational or representational requirement.
Visibility, however, can also draw attention to the principal and reveal team numbers, positions, vehicles and operating methods.
The decision between a discreet and overt posture should come from the risk assessment, the environment and the purpose of the assignment rather than habit or personal preference.
In some operations, a hybrid model may provide the best balance. Part of the team can remain visible while other members operate at a lower profile, observing the environment, protecting routes or supporting the immediate protection function.
The posture can also change during the assignment as the environment, threat or operational requirement changes. A team does not need to remain permanently discreet or permanently overt simply because that was the model adopted at the beginning of the task.
Professionalism often stays out of the frame
Effective protection rarely needs to look dramatic.
Its quality is usually found in preparation, anticipation, information control and the decisions made before a situation reaches the point where direct intervention becomes necessary.
Grey Man Theory is useful because it highlights something that can easily be overlooked: attention itself can create exposure. The aim is to control how much of the protective operation is visible, who can recognise it and when that visibility is actually necessary.
Ultimately, the result matters more than the appearance.
The principal is able to carry out their activities safely, the team retains the ability to act when required, the situation remains controlled and the security system reveals no more about itself than is operationally necessary.
In executive and close protection, genuine professionalism often stays out of the frame.
The original Polish-language version of this article appeared in the special 04/2026 issue of SPECIAL OPS magazine. It forms part of a series developed by the Global Protection Group team in response to recurring questions about professional practice and training in executive and close protection. The aim of the series is to explain key protective-security issues clearly, address common misconceptions and provide practical context for those working in or entering the sector.