Risk Manager of the Year: How Peregrine’s CIR Award Win Reflects Our Approach to Security Risk Management

FIFA President Gianni Infantino has described the upcoming 2026 FIFA World Cup as “the greatest event that humanity will ever see”, reflecting the unprecedented scale and global significance of the tournament. Jointly hosted by Mexico, the United States, and Canada, the competition will feature 48 national teams competing across 104 matches and is projected to attract approximately 6.5 million spectators while generating up to $40.9 billion in global GDP (1). Given its scale and international reach, the World Cup qualifies as a “mega-event”, defined as a large-scale spectacle of dramatic character, mass popular appeal, and international significance (2). Such events extend far beyond sport, carrying substantial political, economic, and social implications for host nations. They provide opportunities to enhance soft power, stimulate tourism, and attract investment, but also generate complex governance and security challenges due to mass mobility, infrastructure strain, and heightened international scrutiny. These challenges are particularly pronounced in Mexico, which enters the tournament amid longstanding concerns relating to organised crime, corruption, and persistent violence. Public discussion of security risks surrounding the 2026 FIFA World Cup has largely focused on cartel-related violence, particularly following the death of CJNG leader Nemesio Oseguera Cervantes (hereafter, “El Mencho”) and the subsequent wave of retaliatory attacks. While cartel violence remains an important security consideration, an exclusive focus on retaliatory cartel violence risks obscuring a wider range of threats that are likely to be more relevant to most visitors. This paper examines the security implications of hosting the 2026 FIFA World Cup in Mexico by first analysing the country’s contemporary security environment and the relationship between cartel leadership removal and retaliatory violence. It then considers the likelihood of cartel-related disruption during the tournament itself before assessing a broader spectrum of risks facing visitors, including kidnapping, extortion, corruption, and opportunistic crime. Finally, the paper argues that situational awareness and protective intelligence represent essential tools for travellers seeking to navigate Mexico’s complex security landscape and reduce their exposure to risk during the tournament. Mexico’s Security Landscape Ahead of the 2026 FIFA World Cup Mexico has long struggled with high levels of organised crime-related violence, driven primarily by competition between powerful transnational criminal organisations, fragmented cartel networks, and weak governance in certain regions. Over the past two decades, the country has experienced persistent levels of homicide, kidnapping, extortion, and armed confrontations linked to criminal groups engaged in drug trafficking and other illicit economies. This environment is further complicated by corruption and significant disparities in law enforcement effectiveness across Mexican states. Criminal organisations such as the Jalisco New Generation Cartel (CJNG) and the Sinaloa Cartel maintain extensive operational reach and have demonstrated the ability to conduct coordinated attacks, disrupt public order, and challenge state authority. Their activities now extend beyond drug trafficking into fuel theft, illegal mining, human trafficking, cyber-enabled crime, and systematic extortion (3). Security concerns surrounding Mexico’s role in the 2026 World Cup escalated following a significant increase in cartel-related violence in February 2026. During this period, Mexican security forces, in coordination with US intelligence, killed El Mencho, leader of the CJNG. In the immediate aftermath, Guadalajara descended into widespread disorder, with violence spreading across multiple states as CJNG members launched retaliatory attacks. Businesses, banks, and pharmacies were set ablaze, while armed cartel members established burning roadblocks, known as narcobloqueos, using hijacked vehicles. Reports of unrest emerged across major urban centres and tourist destinations, including Puerto Vallarta. Although some claims of airport gunfire were later denied, the disruption led to flight cancellations and the temporary displacement of tourists. Authorities advised residents and visitors to remain indoors as the situation deteriorated. A Recurring Pattern of Cartel Retaliation The events that followed the death of “El Mencho” at the hands of Mexican security forces were neither unique nor unprecedented. Rather, they conformed to a pattern Mexico knows all too well: the killing or capture of a prominent cartel leader is often followed by intense retaliatory violence (4). A notable example occurred in 2023 following the recapture of Ovidio Guzmán-López, the alleged leader of a faction of the Sinaloa Cartel founded by his father. The operation triggered widespread unrest across the state of Sinaloa. Two aircraft at Sinaloan airports were struck by gunfire, leading to the cancellation of more than 100 flights and the temporary closure of Culiacán International Airport. Likewise, two Mexican Air Force aircraft were forced to make emergency landings after sustaining gunfire damage. Cartel members erected roadblocks, or narcobloqueos, and set dozens of vehicles ablaze in Culiacán, Los Mochis, and Guasave. The unrest also involved looting, armed confrontations, and widespread disruption to daily life. Similar scenes unfolded in 2019 during Guzmán-López’s first arrest. On that occasion, the violence escalated to such an extent that Mexican authorities ultimately released him. Approximately 600 heavily armed cartel gunmen threatened mass civilian casualties and launched coordinated attacks throughout Culiacán, including assaults on an apartment complex housing relatives of local military personnel. The scale of the violence demonstrated the cartels’ capacity to exert pressure on the state through the threat of indiscriminate retaliation. Such patterns are deeply embedded in Mexico’s security environment. A further example can be seen in the aftermath of the 2009 killing of Arturo Beltrán Leyva, which was followed by retaliatory attacks, including violence directed at security forces and their families. These cases illustrate that retaliation is not incidental but forms a consistent feature of cartel-state interactions. These examples illustrate a specific form of cartel violence: retaliatory violence. Such incidents are typically directed against the state, security forces, rival criminal organisations, or strategic infrastructure and often occur following actions perceived as threatening cartel interests. While these events generate significant media attention due to their scale and visibility, they should not be conflated with other forms of criminal activity conducted by cartels. Understanding this distinction is essential when assessing the risks likely to face visitors during the 2026 FIFA World Cup. Why Cartels Retaliate After Leadership Removal Before examining why cartels engage in retaliatory violence following leadership removal, it is necessary to understand the role violence plays within criminal organisations more broadly. Violence is a defining characteristic of organised crime, with scholars describing such groups as “violent entrepreneurs” (5). Indeed, it constitutes a core mechanism through which cartels operate and pursue their objectives. One explanation for this lies in market competition (6). Cartels compete over territory, resources, and access to illicit markets, and violence serves to assert control over these assets while deterring rival encroachment. Using violence, cartels signal both their capacity and willingness to defend their interests. A second explanation relates to the illegal environment in which these organisations operate. Because participants in illicit markets cannot rely on state institutions for protection or to dispute resolution, they must develop alternative mechanisms for safeguarding their interests. As a result, violence often functions as a substitute for formal legal institutions, enabling cartels to enforce agreements, punish non-compliance, and maintain order. While cartels may employ violence in different ways, what remains constant is that it is a necessary and recurring feature of their survival. Given this, threats to organisational survival are likely to provoke violent responses. Understanding violence as an integral component of cartel operations therefore helps explain why leadership removal may be followed by retaliation. One key explanation for violence following the death, arrest, or capture of cartel leaders is organisational fragmentation (7). The removal of a prominent leader disrupts power structures and creates new internal dynamics. Potential successors may seek to consolidate authority through displays of strength, often through violence against rivals or dissenting factions. In some cases, leadership removal can trigger splintering, leading to increased intergroup competition and violence. This has been particularly evident in Mexico, where some analysts argue that the government’s “kingpin strategy”, targeting senior cartel figures, has contributed to rising violence (8). For example, following the detention of figures such as “El Chapo” and “El Mayo”, the Sinaloa Cartel fragmented into rival factions: Los Chapitos and Los Mayos. Even where organisations do not fully splinter, internal succession disputes can still generate significant violence. In addition, fragmentation can create opportunities for rival cartels to exploit weakened command structures, challenge territory and expand their influence, further intensifying instability (9). Estimating Cartel-Related Violence During the 2026 FIFA World Cup Given Mexico’s historical experience, major government or security force operations against cartel leadership have often been followed by retaliatory violence. This pattern suggests that Mexican authorities may be hesitant to undertake large-scale operations against cartels or high-profile members in the lead-up to, or during, the World Cup, a caution likely reinforced by the significant operational demands associated with hosting a mega-event. Following the most recent escalation in cartel violence in February 2026, Mexican authorities introduced Plan Kukulkan, a comprehensive security framework designed to ensure public and visitor safety throughout the tournament. Roman Villalvazo, head of Mexico’s World Cup coordination centre, announced that “just over 99,000 personnel” would be deployed under the plan. This includes approximately 20,000 military personnel and 55,000 police officers, alongside private security forces, supported by 2,500 military and civilian vehicles, 24 aircraft, anti-drone systems, and specialist detection dogs trained to identify explosives and substances. The operation also extends beyond stadium venues to encompass key tourist destinations across host cities including Mexico City, Guadalajara, and Monterrey. However, despite the scale of this security provision, it is likely to place considerable strain on Mexico’s operational and institutional capacity. Securing multiple high-profile venues at once, alongside managing large volumes of movement, may limit the ability to carry out additional counter-cartel operations. As a result, although the security presence will be extensive, large-scale actions against cartel leadership are less likely during the tournament period, reducing the likelihood, but not eliminating the risk of retaliatory violence. More importantly, past experience demonstrates that aggressive counter-cartel actions can provoke violent reprisals, creating security risks that authorities will seek to avoid during a period of heightened international attention. However, this does not imply that travellers will not face risks. Highlighting Key Risks in Mexico This article in no way seeks to downplay the risk posed by cartel-related violence. In fact, such violence remains a significant concern, particularly given the succession crisis and instability likely to emerge within the CJNG following recent leadership removal (11). Rather, this paper seeks to draw attention to a range of security risks that have received comparatively less attention amid the focus on recent retaliatory cartel violence. Kidnapping Kidnapping remains a significant security concern in Mexico. At the time of writing, the issue has received heightened public attention following the widely publicised kidnapping of journalist Roxana Berenice Guzmán in the state of Veracruz, footage of which has circulated extensively online. According to Alto al Secuestro, Mexico recorded 2,844 kidnappings between October 2024 and April 2026, equating to an average of approximately 4.9 incidents per day. However, the prevalence of kidnapping varies considerably between states and regions. The nature of kidnapping threats also differs depending on the intended victim. While residents may be targeted for financial, criminal, or personal motives, foreign travellers often face distinct risks. One notable tactic involves criminals using dating applications to lure victims to predetermined locations where they are subsequently abducted and extorted. Such incidents prompted the U.S. State Department to issue a security alert following multiple kidnappings of American citizens in the Guadalajara, Puerto Vallarta, and Nuevo Nayarit areas in June 2025. The influx of international visitors during the 2026 FIFA World Cup may create additional opportunities for criminal groups to target foreign nationals. Travellers unfamiliar with local security risks, transportation networks, or high-risk areas may be particularly vulnerable to opportunistic kidnappings, express kidnappings, and extortion schemes. Criminals may exploit situations where visitors are travelling alone, arranging informal transport, or displaying signs of wealth. The heightened concentration of foreign visitors is likely to increase the attractiveness of these targets for organised criminal actors operating in host cities and surrounding regions. Extortion and Corruption Extortion represents one of Mexico's most pervasive criminal threats and is often referred to as the country's "silent crime." During the first four months of 2026 alone, authorities recorded approximately 3,600 extortion cases nationwide (12). However, the true scale of the problem is likely substantially higher. Estimates suggest that only around 0.2% of extortion incidents are formally reported, largely due to victims' fears of retaliation from criminal groups. This widespread underreporting contributes to extortion's reputation as a crime that frequently remains hidden from official statistics. According to the Global Organized Crime Index, Mexico ranks among the five countries most severely affected by extortion worldwide (13). Extortion affects all levels of society, from large business owners to small shopkeepers, many of whom are coerced into making regular payments to organised criminal groups. The practice takes various forms, including direct extortion, indirect extortion, and virtual extortion schemes conducted via telephone or online platforms. Criminal organisations frequently leverage threats of violence and property damage to compel compliance from victims. Closely related to this issue is corruption, particularly in the form of petty bribery. In Mexico, the term la mordida ("the bite") is commonly used to describe informal payments or bribes, most often involving public officials (14). Travellers may encounter situations in which local officials, particularly during traffic stops, allegedly fabricate or exaggerate minor infractions to solicit cash payments. Although such incidents do not occur universally, they remain a widely reported concern and contribute to broader perceptions of corruption within certain institutions. Opportunistic Crime While public attention is often focused on high-impact crimes such as homicide, kidnapping, and extortion, opportunistic crime frequently poses a greater day-to-day risk to travellers. Although generally less severe in its consequences, crimes such as pickpocketing, theft, scams, and robbery occur far more frequently and are therefore more likely to affect visitors. Opportunistic crime is prevalent throughout Mexico, particularly within densely populated urban centres, tourist destinations, and transportation hubs. Criminals frequently exploit crowded environments, distractions, and lapses in situational awareness to target victims. Public transportation networks, major tourist attractions, markets, and entertainment districts provide ideal conditions for thieves to operate discreetly among large crowds. The risk of opportunistic crime may increase during mega-events such as the FIFA World Cup, when substantial numbers of domestic and international visitors converge on host cities. Increased footfall crowded public spaces, and visitors' unfamiliarity with local environments can create additional opportunities for criminal activity. Consequently, maintaining situational awareness, safeguarding personal belongings, and exercising caution in crowded areas remain important preventative measures for travellers. The Need for Situational Awareness and Protective Intelligence The principal security challenge facing visitors during the 2026 FIFA World Cup is unlikely to be retaliatory cartel violence alone. While the prospect of shootouts, narcobloqueos, and large-scale cartel-state confrontations often dominates public discourse, most travellers are more likely to encounter lower-level but more prevalent threats, including theft, scams, extortion, corruption, and, in some circumstances, kidnapping. Many of these threats may still be linked to organised criminal networks, but they differ significantly from the forms of violence typically associated with cartel warfare. As such, safe travel requires more than reliance on state security measures. It requires an understanding of situational awareness and protective intelligence. Situational awareness refers to an individual's ability to understand their environment, recognise potential risks, and anticipate how circumstances may develop. In practice, this involves more than simply being alert to one's surroundings. It requires the continuous assessment of information, understanding how different factors interact, and using that understanding to make informed decisions. For visitors to Mexico, situational awareness may involve recognising when an area feels unsafe, identifying suspicious behaviour, understanding local security dynamics, or adapting travel plans in response to emerging incidents. This is particularly important during a mega-event such as the World Cup. Millions of visitors will move through airports, public transport systems, fan zones, stadiums, and tourist districts, creating crowded and often unfamiliar environments. Such conditions can present opportunities for criminal actors, whether organised groups conducting targeted criminality or opportunistic offenders seeking easy victims. The ability to recognise risks before they escalate can significantly reduce an individual's vulnerability. Closely linked to situational awareness is protective intelligence. Whereas situational awareness focuses on understanding the immediate environment, protective intelligence is concerned with gathering and analysing information to identify potential threats before they materialise. Rather than reacting to incidents, protective intelligence seeks to anticipate them. This may involve monitoring security developments, assessing emerging risks, analysing criminal trends, or identifying indicators that suggest conditions are deteriorating. For travellers attending the World Cup, protective intelligence can provide a clearer picture of the operating environment. Pre-travel risk assessments, local threat reporting, transport disruption alerts, and real-time security updates can all help visitors make more informed decisions regarding accommodation, movement, and personal security. Importantly, protective intelligence does not eliminate risk; rather, it reduces uncertainty by providing timely and actionable information. Specialist security providers can play an important role in this process, leveraging open-source intelligence (OSINT), security monitoring, and intelligence analysis to support travellers operating in unfamiliar or complex environments. Services such as destination-specific risk assessments, real-time travel alerts and OSINT can help individuals remain informed and adapt to changing circumstances. During a tournament expected to attract millions of visitors across multiple Mexican cities, access to accurate and timely information may prove just as valuable as visible security measures on the ground. Ultimately, the success of Mexico's World Cup security effort will not depend solely on the number of police officers or security personnel deployed. Security is also shaped by the decisions individuals make prior and during their travels. Situational awareness and protective intelligence provide a framework through which visitors can better understand their environment, identify potential threats, and reduce their exposure to risk. In a country with a complex and evolving security landscape, these capabilities may be among the most effective tools available to travellers. Conclusion While cartel-related violence remains a defining feature of Mexico’s security environment, focusing solely on retaliatory violence presents an incomplete picture of the risks facing visitors during the 2026 FIFA World Cup. A distinction must be made between retaliatory cartel violence and cartel-linked criminality. The former encompasses highly visible incidents such as shootouts, attacks on security forces, and narcobloqueos that frequently dominate international headlines. The latter includes criminal activities such as kidnapping, extortion, coercion, and other forms of predatory criminality that may be conducted by the same organisations but present a different and often more direct threat to visitors. Although the probability of tourists becoming caught in large-scale retaliatory violence may remain relatively low, exposure to cartel-linked criminality and opportunistic crime is considerably more plausible. The scale and complexity of the tournament will place significant pressure on Mexico’s security infrastructure. Despite extensive state planning under frameworks such as Plan Kukulkan, the realities of managing an influx of international visitors across multiple cities mean that risk cannot be fully mitigated through policing and military deployment alone. Security at mega-events is therefore not only a matter of state capacity, but also of individual behaviour and decision-making within the environment. In this context, situational awareness and protective intelligence offer a practical and necessary addition to formal security provisions. Situational awareness enables travellers to interpret their surroundings and respond dynamically to changing conditions, while protective intelligence provides the anticipatory layer of analysis needed to understand risks before they materialise. Together, they reduce uncertainty and improve decision-making in complex and fast-moving environments. Ultimately, the effectiveness of security during the World Cup will depend on a combination of institutional measures and individual preparedness. For visitors, the ability to understand risk, interpret context, and act on timely information may be just as important as the visible security presence on the ground. In a country with a layered and evolving threat landscape, these capabilities are not supplementary; they are essential to safe and informed travel. References 1. FIFA. FIFA-WTO study estimates USD 47 billion economic output from FIFA Club World CupTM and FIFA World CupTM in the US. 2025. Available from: https://inside.fifa.com/organisation/media-releases/fifa-wto-study-estimates-usd-47-billion-economic-output-from-fifa-club-world 2. Rookwood J, Oates TP. Coordinating security, managing crowds, and marketing social control: examining key organizational challenges facing the 2026 FIFA Men’s World Cup in Canada, Mexico, and USA. Soccer & Society. 2026 Mar 10. Available from: https://doi.org/10.1080/14660970.2026.2640519 3. Mexico. ACLED. 2023. Available from: https://acleddata.com/country/mexico 4. Gambetta D. The Sicilian Mafia: The Business of Private Protection. Cambridge MA: Harvard University Press; 1996. 5. Jordan J. When Heads Roll: Assessing the Effectiveness of Leadership Decapitation. Security Studies. 2009 Dec 2;18(4):719-55. https://doi.org/10.1080/09636410903369068 6. Grillo I. El Narco: Inside Mexico’s Criminal Insurgency. Bloomsbury Publishing USA; 2011. 7. Jordan J. Attacking the Leader, Missing the Mark. International Security. 2014 Apr;38(4):7-38. https://www.jstor.org/stable/24481099 8. Rios V. Why did Mexico become so violent? A self-reinforcing violent equilibrium caused by competition and enforcement. Trends in Organized Crime. 2012 Aug 9;16(2):138-55. https://doi.org/10.1007/s12117-012-9175-z 9. Kroc J. Drug Violence in Mexico Trans-Border Institute Special Report by Viridiana Ríos and David A. Shirk Special Report by Viridiana Ríos and David A. Shirk. 2011. Available from: https://justiceinmexico.org/wp-content/uploads/2014/09/2011_DVM.pdf 10. Schedler A. The Criminal Subversion of Mexican Democracy. Journal of Democracy. 2014;25(1):5-18. https://doi.org/10.1353/jod.2014.0016 11. Graham T. After “El Mencho”, Mexico braces for cartel succession battle. The Observer. 2026. Available from: https://observer.co.uk/news/international/article/after-el-mencho-mexico-braces-for-the-coming-cartel-succession-battle 12. Breña CM. Extortion: Mexico’s new battle against a deeply rooted crime [Internet]. EL PAÍS English. 2025. Available from: https://english.elpais.com/international/2025-07-08/extortion-mexicos-new-battle-against-a-deeply-rooted-crime.html 13. Global Organized Crime Index. Criminality in Mexico - The Organized Crime Index. 2023. Available from: https://ocindex.net/country/mexico 14. Miller K. Managing la mordida: Gringo Tourism, Police Shakedowns, and the Nature of Traffic Ticket Bribery in Quintana Roo, Mexico. Deviant Behaviour. 2023 Jan 8. 1-18. https://doi.org/10.1080/01639625.2023.2165198

The 2026 FIFA World Cup creates a premium threat environment for VIPs and executives. Peregrine Risk Management explains what rigorous protection requires.

How does the Iran war affect domestic terror threats in the UK? Peregrine’s intelligence analysts assess the risk using patterns from Afghanistan, Iraq, and Syria.

Protective intelligence is the proactive collection and analysis of information to identify threats to people before they materialise. Expert guide from Peregrine.

Planning Easter security? Peregrine Risk Management covers the key threats facing churches, events and public gatherings, plus the practical steps every organisation should take.

The Middle East conflict is escalating. Find out what organisations with staff in the region must do to meet duty of care obligations and how Peregrine can help.

Explore the best security jobs for veterans after leaving the Armed Forces. Learn career paths, qualifications, and how to use ELCAS funding.

Learn what a Close Protection Course involves, who it’s for, and how to start a career in private security with a Level 3 qualification from Peregrine Risk Management.

Use your ELCAS credits to fund a Level 3 Close Protection Course with Peregrine Risk Management. Highfield-endorsed training for military career transition.