Pre-attack surveillance is the most reliable indicator of a credible threat, because most targeted physical attacks are preceded by days, weeks or months of observation aimed at establishing routine, vehicle, family pattern and security posture. This report sets out the surveillance-detection framework in your chosen jurisdiction and industry: the documented surveillance methodologies (foot, vehicle, technical, social-media, drone), the recent threat-actor evolution, the early indicators that experienced protective-intelligence teams use to distinguish ambient observation from credible surveillance, the operational mitigations (counter-surveillance protocols, route variation, technical sweeps, social-media discipline), and the trigger points at which surveillance suspicion warrants engaging a protective-intelligence specialist or executive-protection firm.
Reference material for informed readers, not advice.