The U.S. Secret Service is working in a fundamentally different threat environment than it did even a few years ago, and its own records show the workload has surged; the hard question isn’t whether activity is up, but what exactly that activity measures—and how much of it reflects the internet’s rewiring of grievance, access, and imitation.
At a Glance
- Secret Service leaders report roughly a 40% year-over-year increase in threats or threat-related cases involving full-time protectees.
- The agency cites about 10,000 threat or threat-related cases in a single year, consistent with a sharp rise in protective-intelligence workload.
- Officials attribute part of the increase to the dynamics of social media and broader online accessibility; mental-health crises are also a major driver.
- Case counts are broader than confirmed violent plots; they include behavioral warnings and non-direct threats, complicating apples-to-apples comparisons.
What the numbers say—and what they don’t
In an on-record interview, Secret Service Director Sean Curran stated that threats against full-time protectees were “up just over 40%” year-over-year and that approximately 10,000 threats or threat-related cases had been handled since the start of the year. That topline is reinforced by the agency’s formal budget materials, which describe steep growth in operational tempo: protective visits rising from 5,242 in FY2023 to 7,175 in FY2025 (about 37%), and more than 12,300 protective-intelligence investigations in FY2025—nearly 60% above the prior year. Taken together, the public record establishes a sustained increase in activity, not a one-off blip.
However, “threat” in this setting is a term of art. Protective-intelligence encompasses direct threats, implied threats, fixation, stalking, delusional ideation, suicidal behavior, and other warning signs that merit assessment even when no explicit threat is articulated. Media summaries of the agency’s description make that scope clear, noting that not every investigation begins with a direct threat and that online signals, foreign actors, lone offenders, and mental-health crises are all in the mix. This breadth is by design—it is how modern threat assessment prevents violence—but it means a rising case count is not the same thing as a one-for-one increase in imminent assassination attempts. The year-over-year surge is real; the composition within that surge requires care when interpreting risk.
Mechanisms: why online dynamics matter to protection
Curran linked the increase partly to the internet’s effects: accessibility, visibility, and the social feedback loops that normalize escalation—summarized bluntly as “social media changes people”. That judgment tracks with what threat-assessment practitioners see daily. Platforms lower the cost of signaling intent, amplify copycat cues, and make protectees’ schedules, locations, and routines radically more legible to strangers. The agency’s budget testimony points in the same direction, stating plainly that social platforms continue to grow, “making threats more prevalent”. The mechanism is straightforward: more discoverability of targets; faster diffusion of grievance narratives; more vectors—posts, comments, DMs, live streams—for leakage behaviors that trigger assessments.
None of this excludes other drivers. Secret Service leaders also point to mental-health deterioration as a major factor in caseload growth. That comports with decades of protective research: most attackers and near-attackers leak intent and exhibit psychosocial stressors, fixation, or deteriorating functioning well before any act. In practice, the modern protective-intelligence pipeline is built to catch precisely those signals; the cost of catching more is a larger investigative denominator.
What changed since the “six-to-eight-a-day” era
In 2017, then–Director Randolph Alles said the agency was investigating roughly six to eight threats a day—broadly similar to prior administrations over the previous decade. That historical anchor is useful context, but it predates the present mix of platform features, the acceleration in real-time public-facing content about protectees, and the scaling of open-source monitoring tools. Today’s figures—10,000-plus cases in a year and a 40% year-over-year rise—reflect a larger, noisier intake funnel and more capacity to act on it. Importantly, they also reflect operational demands: the same budget testimony documenting investigative growth also details expanded protective operations and visits, which drive exposure and workload in tandem.
A broader lens across U.S. institutions points in the same direction. Threats to judges, legislators, and election officials have risen markedly in recent years, and leading reviews synthesize evidence that online affordances—recommendation loops, virality, and frictionless coordination—facilitate intimidation and episodic violence. While those studies are not Secret Service–specific, they explain why a national protective service that sits at the confluence of politics, celebrity-scale visibility, and grievance would see a rising tide of signals requiring triage.
Separating workload from danger: where reasonable skepticism belongs
Three cautions keep the analysis disciplined. First, the 40% figure conflates in public discussion with “violent threats,” but the official artifacts mostly describe threat-related cases and protective-intelligence investigations—the expansive category that includes nonviolent warning behaviors. Second, growth in monitoring capacity, reporting pathways, and agency resources can elevate recorded case counts even if underlying intent rises more slowly; the same budget submission ties increased cases to resourcing needs, which is appropriate but creates an optics challenge for outside readers. Third, public figures are snapshots without a consistent multi-year series using identical definitions across protectee classes; the year-over-year comparison is strong, but its long-run baseline is less certain.
These caveats do not undercut the core: Secret Service casework has surged. They do constrain the leap from “more cases” to “vastly more imminent plots” absent a breakdown by severity, credibility, and disposition. That disaggregation—violent threats versus harassment, mental-health interventions, online-only referrals, validated plots—would convert a headline statistic into operationally meaningful risk gradients.
Concrete incidents versus ambient risk
The period in question has included real-world attempts and serious breaches, including the Butler, Pennsylvania rally shooting and other cited incidents involving President Trump and nearby events, underscoring that the environment is not purely digital theater. But counting incidents of violence is a different metric from counting investigations, and the public record here does not furnish a complete, normalized time series for attacks, arrests, or prosecutions alongside the investigative surge. The absence of that parallel series is not exculpatory; it simply marks the boundary of what the available data can sustain.
VIDEO – Secret Service Boss Tells 60 Minutes About ‘Massive Increase’ in Violent Threats During Trump Era: ‘Social Media Changes People’ https://t.co/HOq2X7tjAF
— Grabien (@GrabienMedia) October 12, 2026
What better measurement would look like—and why it matters
A robust picture would include, at minimum, annual and monthly counts since 2015 of: direct violent threats; nonviolent threats; stalking and fixation cases; mental-health-driven interventions; online-only referrals; and cases escalated to credible-plot status—each with consistent definitions, de-duplication rules, and protectee categories. The Secret Service’s National Threat Assessment Center already publishes methodological work; extending that discipline to public aggregates would allow Congress, researchers, and the public to separate perception from risk, workload from danger. The agency’s own FY2027 submission demonstrates the value of specificity; it should be the template for a disaggregated time series.
Clarity here isn’t a bureaucratic nicety. Protection is resource-constrained. If online leakage produces an ocean of low-severity cases, the triage system must preserve speed for the needles that matter. If, conversely, there is a genuine shift toward more credible plots, that justifies different posture, technology, and legal authorities. Either scenario can be true simultaneously in different slices of the data; only consistent breakdowns will show where the risk is actually moving.
Bottom line
The agency’s casework is up sharply—about 40% year-over-year for full-time protectees by the director’s account, and roughly 10,000 threat-related matters in a single year—aligned with documented growth in protective operations and intelligence investigations. The dynamics of social media and online access are credible contributors, alongside a rising tide of mental-health crises. But the investigative denominator is broad. Treat the surge as an operational reality; resist equating every case with a violent plot. The remedy is straightforward and overdue: publish disaggregated, methodologically consistent series that let the country see what has changed, where, and by how much—so protection can keep pace with reality, not just with rhetoric.
Sources:
mediaite.com, secretservice.gov, dhs.gov, abcnews.com, cbsnews.com, nbcnews.com, fox11online.com
