Every protective advance runs the same motion: take something you do not know & make it known. Walk the route. Count the exits. Vet the vendor. By the time the principal steps out, the column of unknowns has shrunk to almost nothing, & that shrinking column is what competence feels like from the inside.
Then something happens that was on nobody's list. Not the risk you weighed & accepted. Not the gap you flagged & ran out of time to close. Something you never wrote down, because it never crossed your mind there was anything there to write. Afterward one question keeps circling with no clean answer: how do you look for a thing you did not know existed?
That loop is the subject. Donald Rumsfeld put the phrase into public vocabulary at a Pentagon briefing in 2002, & he was right. The things it never occurred to us to ask about are the ones that get people hurt. No amount of skill at the threats you can name will ready you for the one you cannot.
The Category You Cannot Put on the List
A protective assessment usually sorts every threat into three kinds. Two are tractable, & every professional works them. Known knowns are handled: the former employee on the watch list, the choke point re-planned around. Known unknowns are the honest gaps: the crowd not yet profiled, the entrance nobody has walked. A good team keeps that second list long & honest.
The third has a different shape, & that is the whole point. An unknown unknown is not a risk you underrated or a gap you ran out of time on. Those are decisions, & a decision requires that you already know the thing exists. This category is defined by the absence of that knowledge. It was never a candidate for handling, because it was never in view. That is why it fits on no list, & why the comfort of a well-worked list should not dictate our posture.
Institutions fail here too, at the largest scale. Asked how the September 11 attacks were missed, the 9/11 Commission concluded: "The most important failure was one of imagination."
Why It Hides Inside Your Expertise
Here is what should unsettle a senior professional most: the better you are, the better the unknown unknown hides, & it hides inside the thing you trust most, your expertise.
In a 1999 experiment now famous, viewers were asked to watch a short video of a group passing basketballs & to count the passes. Midway through, a person in a gorilla suit walks into the middle of the group, turns to face the camera, thumps their chest, & walks off. About half of all viewers, busy counting, never see the gorilla at all. The lesson is not that they were careless. It is that attention works by pattern: you see what you have set yourself to look for, & the thing you never thought to watch for can move through the center of the picture, fully in view, & never register. Expertise only deepens the trap, because the more finely your eye is trained to a pattern, the more completely it filters out whatever falls outside it.
I know the feeling from the inside, & from the lucky side of it. Sometimes the newest person on a detail sees the thing the veterans walk past, & it is tempting to call that talent. It is usually the opposite. The veteran has done the task a hundred times & filed it as handled. The newcomer has not filed it as anything yet, so he is still looking.
Years ago I worked the protective detail for U.S. Secretary of Defense Mark Esper during his February 2020 visit to Afghan President Ashraf Ghani in Kabul. An honor guard would receive the principals in ranks, a few feet away, ceremonial rifles shouldered. Working the advance, I raised two questions about it, more on instinct than analysis: were those weapons inert, & who exactly was responsible for confirming it? They were worked & answered before the principals ever arrived, which is what an advance is for. What stayed with me was not the ceremony, which went as planned, but that the question had surfaced in my head at all.
I did not ask because I knew something the others did not. I asked because I had not yet learned to assume that part of the ceremony was someone else's problem. What I had brushed against I understood only much later, while researching this article, when I read for the first time about the assassination of Anwar Sadat.
On 6 October 1981, at the annual parade marking the 1973 war, an Egyptian Army truck halted in front of the presidential reviewing stand. Soldiers marching in Sadat's own parade climbed down & attacked the stand with grenades & rifle fire. The parade weapons were supposed to be for show, carried empty; the attackers had smuggled in live ammunition. As they advanced, firing, Sadat is reported to have risen & saluted, taking them for part of the show. The U.S. ambassador, seated in the stand, later recalled that because it was a military parade, security was in the hands of the military. The vector, the President's own ceremonial troops turning on the stand with weapons everyone believed inert, was on no one's list.
I want to be careful about the moral. Nobody on that detail was careless, & I was not sharp. An honor guard is a solved problem, worked as routine, & the question about those rifles was raised & answered like any other line in the advance. What unsettled me came later, while writing this: that the instinct behind the question already had a name & a body count, & that I had carried the shape of the Sadat story for years without knowing it existed. The same selective attention that lets half a room miss a gorilla is not a failing of the careless; it is how focus works, & no level of skill closes the gap for good. The unknown unknown reaches the novice & the master on the same terms.
In executive protection, confidence is not competence; competence is structured doubt.
What a Practice Does About It
So why does this matter, & what do you do about it? Start with the honest half: an unknown unknown cannot be found by looking, because you do not know it is there to find. It will never be eliminated, & any firm that says otherwise is selling. The 9/11 Commission, dissecting the largest such failure in living memory, reached the same wall & named the only way through it: find a way of "routinizing, even bureaucratizing, the exercise of imagination."
That is a posture, run as standing practice rather than a burst of vigilance before the big event. It has three moves. Force the question on a schedule, so imagination is routine & not a mood: what would have to be true for this to go wrong in a way none of us has considered? Keep a seat for the person whose aperture is still open, the newest voice in the room, & make it safe to use. And treat the handled list as suspect rather than settled, revisiting solved items precisely because they are the ones nobody is looking at anymore.
Be honest about how well the tools work, because a piece calling confidence dangerous cannot sell its remedies on confidence they have not earned. The strongest is also the cheapest: a room where rank does not decide who gets to speak. In a well-known hospital study, the better nursing teams recorded more errors, not fewer, because they felt free to name them, so what looked like more failure was really more visibility. The formal techniques, red-teaming & structured analysis among them, rest on far weaker ground than their popularity suggests, & their own field admits the evidence is thin. We still use them, because forcing a second look is worth doing even where the proof is incomplete, but we hold them loosely. A discipline built on hunting unknown unknowns has to turn the instrument on itself first.
This is the operating system the last two editions ran on. The pathway to violence is a known known: the pattern is documented, & the real myth is that anyone simply snaps. The exposure in our protective-intelligence issue is a known unknown: the surface is known to exist, the how & the when are not. This edition is the third case, the unknown unknown, the one never in view to be worked at all. None of the three is a failure of effort. They are three distances from what a team can know, & the work is to keep pressing toward the farthest one even though it can never be fully reached. We cannot promise to see everything, & we do not. What we can do is put most of the effort where the naming stops & keep the act of surfacing routine, so the thing nobody knew to look for runs into a practice built to keep asking. That is the work at Scopos Strategies, & the only confidence worth carrying, the earned kind.
In the last security review you sat through, who was new enough to see what everyone senior walked past, and safe enough to say it out loud?
Sources
- National Commission on Terrorist Attacks Upon the United States: "The 9/11 Commission Report" (2004). Executive Summary, General Findings: "The most important failure was one of imagination." Chapter 11, page 344: "It is therefore crucial to find a way of routinizing, even bureaucratizing, the exercise of imagination." Executive Summary and Chapter 11. The top-authority statement that an unassessed vector is an institutional failure, and the remedy that body named.
- Simons, D. J., and Chabris, C. F.: "Gorillas in Our Midst: Sustained Inattentional Blindness for Dynamic Events," Perception, 28(9), 1999, pages 1059 to 1074. https://doi.org/10.1068/p281059. The experiment in which about half of viewers counting basketball passes fail to notice a person in a gorilla suit who walks into the scene, faces the camera, and departs. The basis for the article's account of selective attention.
- Farrell, William E.: "Sadat Assassinated at Army Parade as Men Amid Ranks Fire Into Stands," The New York Times, October 6, 1981. Contemporaneous primary reporting that soldiers marching in the parade dismounted and fired into the presidential reviewing stand. Anchors the account of the attack.
- Association for Diplomatic Studies and Training: oral history of Ambassador Alfred Leroy Atherton, Jr., eyewitness in the reviewing stand. https://adst.org/2013/09/the-assassination-of-anwar-sadat-part-ii/. Primary eyewitness testimony that, because it was a military parade, security was in the hands of the military.
- NBC News: "Sadat's assassination plotter remains unrepentant," July 6, 2011. https://www.nbcnews.com/id/wbna43640995. Carries the detail that the parade weapons were believed inert and the attackers smuggled in live ammunition, and that Sadat rose to salute the advancing soldiers, taking them for part of the ceremony.
- Edmondson, A. C.: "Learning from Mistakes Is Easier Said Than Done: Group and Organizational Influences on the Detection and Correction of Human Error," Journal of Applied Behavioral Science, 32(1), 1996, pages 5 to 28. The hospital study behind the counterintuitive result: better-performing nursing units reported higher medication-error rates because they were willing to discuss them. The evidentiary basis for the article's strongest recommendation, the rank-flat room.
- Mandel, D. R., and Tetlock, P. E.: "Correcting Judgment Correctives in National Security Intelligence," Frontiers in Psychology, 9:2640 (2018). https://doi.org/10.3389/fpsyg.2018.02640. That structured analytic techniques spread through the intelligence community on institutional endorsement rather than demonstrated efficacy. The article's audit of its own tools rests here.
This article was produced with AI assistance. The perspective and security expertise are the author's own.