FIFA’s World Cup 2026 (FWC26) drew millions of fans, spectators, and athletes from around the world for a 39-day tournament that spanned three countries and 16 host cities.
The tournament fostered a sense of community and pride as international soccer fans and local communities came together to celebrate the world’s largest sporting event. As the world watched the games and cheered on their favored teams, the tournament and surrounding communities were also a target for threat actors seeking to take advantage of the notoriety and heightened emotions that come with an event on a global scale.
Before and throughout the tournament, the Center for Internet Security® (CIS®) worked behind the scenes as a critical partner supporting event security operations. CIS provided strategic analysis, real-time threat monitoring, and weekly analytic review of threats and trends to event organizers, broadcasters, host city organizers, public safety partners, and Multi-State Information Sharing and Analysis Center® (MS-ISAC) members.
CIS brought together partner organizations and security experts to provide real-time operational support, intelligence analysis, and situational awareness. The around-the-clock effort provided deeper insight into the multidimensional threat environment and reinforced best practices for implementing a collective approach to cyber defense.
Upcoming major events, including the Freedom 250 Grand Prix in Washington, D.C., the 2026 midterm elections, and the 2028 Olympics in Los Angeles, can benefit from the lessons learned during FWC26. Here are our key takeaways that event organizers, public safety officials, and local communities can use to secure large-scale events.
1. Build Relationships Well Before a Large-Scale Event
CIS’s efforts to create a safer, more secure FWC26 began more than a year before the June 11 kickoff, providing analytical support and coordinating with public safety and private sector partners before and during both the FIFA Club World Cup 2025 and FWC26.
What We Learned: Collective Defense Starts Before the Event
Strong, pre-established relationships are key to securing a large-scale event. For example, FIFA hosted meetings with multiple stakeholders in the host regions beginning early last year, reviewing scenario planning and information sharing plans. Sasha Larkin, Director of Intelligence and C4 Operations for FIFA World Cup 2026 said the “secret sauce” for successful security was real-time connectivity and synchronization of messaging, pushing out one consistent message. “We started early, communicating to the chiefs and sheriffs to make sure they understood, ‘here’s what’s coming, here’s our process.’ And then we really worked at the line level to permeate that messaging … to make sure they understood how to use the tools we were going to give them and push that messaging through a cross-collaborative platform,” she said on CIS’s Cybersecurity Where You Are podcast.
CIS analysts were operationally embedded within FIFA’s security and intelligence center and a host city’s intelligence command center to provide real-time threat information that supported coordinated decision-making for the tournament’s security. “It doesn’t just happen overnight. It doesn’t just happen organically,” John Cohen, Executive Director for the Office of Strategic Programs & Initiatives at CIS, said. “You have to build those pathways of communication and operational interaction.”
Looking Ahead: Tips to Secure Large-Scale Events Against Emerging Threats
Establish pre-event relationships with partners, including event organizers; local, state, and federal public safety officials, fusion centers, real-time crime centers, Information Sharing and Analysis Centers (ISACs), and other relevant stakeholders.
Conduct regular pre-event joint exercises across law enforcement, emergency management, venue security, emergency medical services, and other event stakeholders.
Establish joint command centers when possibleso event organizers and state, local, and federal authorities can coordinate threat reporting and response efforts.
2. Establish Information Sharing Pathways That Guide Operations
Prior to the tournament, relevant stakeholders, including FIFA Intelligence, public safety officials, and host city jurisdictions, established multiple channels and pathways for sharing relevant threat information and making operational decisions based on that information. “The rise and fall of any organization or major event is communication and without that we will fail,” Larkin said. For example, more than 4,000 Threat Reporting Exchange (TRX) members participated in the first integrated, real-time federal, state, local, tribal, and critical infrastructure protection incident and threat reporting environment during FWC26.
What We Learned: Shared Intelligence Enables Better Security Operations
Clear, timely, and actionable communications are fundamental to executing a safe and secure large-scale event. These communications allow event organizations and public safety officials to communicate effectively with one another and the public, creating trust with attendees and minimizing the impact of potential security breaches. “It’s not just information that’s important, it’s information that guides operations,” Cohen said.
Large-scale event stakeholders, such as broadcasters, corporate sponsors, venue operators, hospitality partners, transportation providers, and other organizations, operate within the same environment, but face distinct risks and intelligence requirements that can be addressed through customized threat monitoring, situational awareness, narrative intelligence, and strategic risk analysis.
Looking Ahead: Operationalizing Trusted Communications for Large-Scale Events
Establish information sharing protocols with state, local, federal, and international partners, and engage in regular outreach with community stakeholders, including sponsors, nonprofit organizations, and event organizers.
Implement verification protocols to rapidly assess swatting calls and hoax threats, minimizing diversion of resources from legitimate incidents.
Designate authenticated communication channels (e.g., social media, mobile alerts, venue public address systems) that are pre-identified to the public as trusted sources during emergencies.
3. Assess Emerging Threats Before, During, and After the Event
Large-scale events operate within a distinct threat landscape marked by large, dense crowds; a compressed timeframe; and heightened emotional response. High-attendance events represent high-value targets for both physical disruption and information operations designed to generate anxiety and test security response thresholds.
“One of the things we’ve tried to do was to really look ahead as planning for the games evolved,” Cohen said. “What types of things could happen that we hadn’t anticipated.”
Throughout FWC26, stadiums, host cities, athletes, and attendees faced online threats of violence, ticketing scams, suspected swatting incidents, extremist messaging, barrier breaches, and foreign adversarial information operations exploiting the intense, emotional engagement surrounding the games. For example, the Islamic State called the FWC26 a “golden opportunity” to revive “lone wolf attacks” in the U.S. and analysts observed a likely malicious typo-squatted domain and assessed the webpage was impersonating a FWC26 sponsor.
What We Learned: Threat Assessments Improve Event Security and Resilience
Continuous risk assessments can inform resource planning and enable security practitioners to anticipate and respond to physical manifestations of online activity before they escalate. For example, CIS’s pre-tournament white papers included, Deepfakes and Synthetic Media: The Emerging Threat to Large-Scale Public Gatherings, Illicit Sports Betting and Match Integrity Risks to Large-Scale Events, Lone Actor and Small-Group Mass Casualty Tactics in the Context of Major Sporting Events, Transportation Infrastructure Sabotage as a World Cup 2026 Risk Multiplier, and Unmanned Aircraft Systems (UAS): Evolving Risks to Large-Scale Public Gatherings. These pre-event assessments helped lay the groundwork for the potential threats and security responses needed during the tournament, better preparing analysts, public safety officials, security personnel, and event organizers to secure the games.
Additionally, ongoing monitoring of emerging threats amid the tournament allowed public safety officials and event organizers to respond quickly to potential threats of physical violence, cybercrime, and information operations aimed at exploiting the tournament.
Equally important is after-action review that evaluates information sharing protocols, public outreach efforts, and physical and cyber intrusion detection.
Looking Ahead: Build Continuous Threat Awareness
Develop and exercise threat-scenario capability and response plans for the venue and areas outside the venue, such as fan specific zones, watch party areas, or other public gathering places.
Maintain heightened awareness for indicators of lone actor mobilization, particularly individuals exhibiting behavioral signs of radicalization or conducting pre-attack surveillance.
Train public affairs and communications teams to identify and respond to AI-generated or manipulated content using established detection indicators across image, audio, text, and video formats.
Securing Large-Scale Events Through Preparation and Partnership
The success of FWC26 demonstrated that securing large-scale events requires more than physical security measures. It depends on strong partnerships, timely information sharing, and continuous awareness of emerging threats before, during, and after an event. Organizations that invest in these capabilities are better positioned to protect attendees, support operational resilience, and respond effectively to evolving risks.
Given the visibility and public engagement associated with large-scale events, organizers need specialized planning and dedicated resources to deliver a safe and welcoming experience for attendees, entertainers, athletes, and the broader community. For a comprehensive approach to strengthening security before hosting a major event, read our blog, 5 Steps to Help Secure Your City Before a Large-Scale Event.
For event organizers seeking actionable intelligence and expert guidance, Special Event Risk Analysis & Advisory Services help identify potential risks, enhance situational awareness, and support informed decision-making before and during major sporting events, racing competitions, festivals, concerts, and other large-scale gatherings.
