Corporate executives and boards increasingly recognize that executive security involves more than just physical protection. This awareness has driven record demand for IRS 132 audits, also known as an Independent Security Studies (ISS), in 2025, with continued growth expected in 2026. Despite the favorable tax advantages these studies may offer when addressing security risks, the provision has historically been underutilized. Family offices are also finding value in ISS reviews, particularly for enhancing privacy and protection of high‑net‑worth individuals, including assessing the potential tax deductibility of private air travel and the removal of personally identifiable information from online sources.
One substantial piece of the IRS 132 assessment is the digital vulnerability assessment (“DVA”), which is a comprehensive pattern-of-life analysis of the client. More than just a simple background check, the DVA seeks to answer the question: What is the universe of information a motivated individual could find on a person of interest given enough time and resources?
As many people know, finding out where someone lives is only slightly harder than a Google search, but many times personal details such as home address, family member names and birthdays, medical conditions, and travel plans are also posted on social media. Rarely is this information shared directly as such, but as I wrote about in a previous blog, there are tiny pieces of information floating around that, when compiled, create a “dossier” on any one individual.
Often senior executives, by the nature of their position, have carefully curated their online presence, sometimes having only a professional LinkedIn profile and nothing else. However, in every instance, there is always one family member (such as grandma or young teens) who posts way too much information online. It is just a matter of sifting through tweets, TikTok videos, YouTube shorts, and other sources to cobble together important information.
In 2025, we saw a large uptick of professional athletes having their homes burglarized when they were attending away games. Since criminals knew when the owner would be out of the home, it was the perfect opportunity to conduct a raid and walk off with a significant number of valuable items. Social media, particularly as it relates to video content, allows bad actors to construct a layout of the house by looking at what friends and family have posted online. More than just knowing the address, bad actors can see the location of security hardware such as cameras or locks, and they know where the master bedroom is in relation to the front door or the kitchen. Instagram photos from a family dinner may showcase high-value artwork or collectible items in the background. Since rarely does anyone move display items around in the home, bad actors can reduce the time needed to get in, find and then grab what is most valuable, and get out. Similarly, if your children are posting live updates about how great their family vacation is, while they are still traveling, then individuals will know the home is empty.
It is not just the threat of burglary posed by social media. In other instances, digital research can identify things that can harm or embarrass a client, leading to potential blackmail opportunities. This is a particular danger for publicly traded companies, where a social media campaign that highlights deleted tweets, or strong stances on social justice issues by family members can cause stock prices to plummet. Similarly, it puts pressure on executives to have to explain if they too support a particular ideology. During the height of pro-Israel/pro-Palestine protests, corporations and family members were being targeted for in-person harassment based on social media posts or liking of certain content. A question I like to pose to potential clients is if they have an incident response plan if, for example, the CEO’s spouse makes unhinged commentary on X, and those posts go viral. Many, unfortunately, have never considered this potential situation, but the ramifications could be significant.
Similarly, the increase in the sophistication of AI has made identifying potentially controversial content much easier than in the past. In several instances, our research has identified spouses on dating websites or adult children on websites like OnlyFans. While these can be particularly awkward and emotional conversations to have, it is better to learn of this information early, from a friendly source who can help remediate it, than later, from a competitor, rival, journalist, or criminal entity seeking to exploit this knowledge.
When seeking potential vendors for an Independent Security Study, be sure to discuss their capability and work product when it comes to digital vulnerability assessments. Cookie cutter or generic reporting that fails to address all facets of risk can create a false sense of security. Given the sensitive nature of information that may surface during an IRS 132 audit, expertise and discretion are essential. And if there is one thing I learned while working at the Central Intelligence Agency, it was how to be discreet.
