Roughly 18 to 19 million fans are expected to enter through the turnstiles of an NFL stadium between the start of the 2026 regular season on September 9 and Super Bowl LXI at SoFi Stadium on February 14, 2027. That’s a massive undertaking for the state and local police departments, sheriff’s offices, fusion centers and real-time crime centers responsible for maintaining public safety.
The upcoming NFL season follows a summer in which the United States hosted 78 World Cup matches across 11 host cities. That tournament generated invaluable operational lessons and new precedents about what bad actors attempt when a global audience is watching. The 2026 NFL schedule will test whether local agencies have operationalized those insights.
Here are the six trends worth tracking, and what each demands from an intelligence standpoint.
1. LONE ACTORS, SHORT TIMELINES AND SOFT TARGETS
Federal threat assessments have been consistent for several years: the most likely perpetrator of an attack on a U.S. mass gathering is a lone offender or small cell, radicalized largely online, using accessible means such as a vehicle, a firearm, an incendiary, a crude improvised device. DHS assessed the terrorism threat environment as heightened, with lone actors and small cells representing the most probable threat. The January 1, 2025, vehicle ramming on Bourbon Street, which killed 14 people, remains the reference case for what happens when the target is a crowded street rather than a hardened venue.
That’s the structural problem for NFL game day. The stadium is screened, magnetometer-equipped and staffed. But tailgate lots, light rail platforms, bar districts, hotel blocks, rideshare queues and fan festivals are not. Security posture is lowest where crowd density is highest.
Lone actors are also the threat category most exposed to open-source detection. Attackers rarely go from grievance to action silently. Leakage, target research, symbolic date fixation, weapons acquisition posts, farewell messaging and manifesto drafting all leave online residue, frequently on platforms and in communities that never appear in a records check. Fivecast ONYX pairs deep targeted collection against a named subject with broad discovery to surface the actor nobody has a file on yet — the two halves of a lone-actor problem.
2. DRONE INCURSIONS & NEW AUTHORITY TO STOP THEM
Unauthorized drone activity over stadiums has moved from anomaly to routine. Reporting tied to the SAFER SKIES Act indicates the NFL has documented more than 2,000 drone incursions per season in each of the last several seasons. In February 2026, federal prosecutors in Northern California charged an operator who allegedly flew inside the three-nautical-mile TFR during an NFL game at Levi’s Stadium.
Two things changed this year.
- First, DHS and DOJ published an interim final rule effective July 1, 2026, implementing the SAFER SKIES Act and building out the framework for state, local, tribal and territorial agencies to conduct counter-UAS operations.
- Second, FEMA stood up a $500 million “Counter Unmanned Aircraft Systems Grant Program,” with an initial $250 million directed to World Cup host states and the National Capital Region. The World Cup was the justification; the capability is permanent and will be pointed at NFL stadiums, concerts and parades.
The World Cup also showed what the workload looks like. In Kansas City, a joint FAMS–FBI–KCPD counter-UAS operation detected 19 drones inside TFR zones in the tournament’s opening days and, on a single match day, intercepted eight drones and seized them along with their controllers.
Detection sensors tell you a drone is up. Who planned the flight and why is context that can be collected from FPV and hobbyist forums, marketplace listings, local flying groups, prior boasting about stadium flights and event-specific coordination chatter. Fivecast ONYX works that layer above the sensor line, facilitating attribution alongside detection.
3. BETTING-DRIVEN HARASSMENT ESCALATING TOWARD REAL-WORLD RISK
Legal sports wagering has created a new and durable threat vector aimed at individuals rather than venues. NCAA-commissioned research found that betting- and match-fixing-related abuse accounted for roughly 11% of nearly 4,000 flagged abusive messages. That’s roughly twice the volume of racial abuse or explicit threats of violence. A 2026 NCAA survey found that 46% of men’s basketball players had received negative or threatening messages from people who bet on their games. The NCAA has since raised similar alarms about prediction markets, which push wagering onto increasingly granular and personal outcomes.
Local law enforcement inherits the tail end of this. Prop-bet and player-performance wagering personalizes the loss, and personalization drives escalation: abuse, then doxxing of home addresses and family members, then in-person contact attempts at practice facilities, hotels and residences. The NFL’s own posture reflects the broader trend — after the July 2025 shooting at the Manhattan building housing league headquarters, the league recommended enhanced security measures at team and league facilities, including refreshed threat assessments and armed law enforcement presence when players and staff are present.
The intelligence requirement here is triage. When thousands of angry posts follow a tough game, law enforcement must determine which are venting or trolling; and which represent legitimate threats based on capability, proximity and intent. Fivecast ONYX risk detectors assess that volume against customizable criteria, and network analysis then shows whether a flagged account connect to something more coordinated.
4. HOAX THREATS AND SWATTING AS A RESOURCE ATTACK
A hoax can cost nothing to produce yet consume an entire tactical response. The FBI’s IC3 issued a fresh public service announcement on swatting in August 2026, noting its capacity to trigger evacuations and lockdowns, spread misinformation, divert emergency resources and generate copycats. Campuses saw waves of false active-shooter reports through 2025 that locked down institutions across more than a dozen states at significant cost. Ahead of the World Cup, the FBI signaled it would pursue hoax threat cases aggressively.
For a stadium environment, the second-order risk is worse than the first. A fabricated shooter report that reaches 60,000 people through social media before it reaches the command post can produce a crowd crush independent of any actual threat. Departments need two capabilities running simultaneously: attribution of the originating account, and rapid situational awareness of how fast and how far the rumor is propagating. Fivecast ONYX supports both at once, saving precious time while working back toward the source.
5. PROTEST, COUNTER-PROTEST AND POLITICALLY CHARGED FLASHPOINTS
Stadiums are civic stages, and the 2026 season arrives in a polarized environment where enforcement activity itself has become a mobilizing issue. The runup to last season’s Super Bowl was accompanied by an online petition with well over 100,000 signatures opposing federal immigration enforcement presence at the event, planned demonstrations near the venue, a planned counter-event and performers publicly weighing in, all of which law enforcement had to account for as part of Level 1 special event security operation.
The operational needs include permitted-route awareness, early identification of unpermitted convergence and counter-convergence and transparent assessment of whether groups planning to attend intend confrontation or civil disobedience. The line matters enormously; constitutionally protected assembly is not an intelligence target. Indicators of planned violence, weapons or coordinated confrontation are. Any OSINT program touching this space needs that distinction written into policy before Week 1, not litigated in midseason retrospect. Fivecast LUNEX clarifies the strategic picture of groups or ideological movements active in the AOR, while Fivecast ONYX handles specific, policy-based risk indicators.
6. FRAUD, COUNTERFEITING AND EXPLOITATION ECOSYSTEMS AROUND THE EVENT FOOTPRINT
High-demand tickets attract organized fraud. Before the World Cup, an FBI IC3 alert in May 2026 identified dozens of spoofed FIFA domains, including typosquatted variants and fake employment portals. Delivered primarily by malvertising, the spoofed domains were used to harvest personal data and sell worthless tickets and hospitality packages. Other scams featured fake merchandise. Toronto Police executed what Reuters reported to be “the largest known seizure of counterfeit soccer jerseys in Canadian history,” valued at more than C$3.5 million.
The same infrastructure and the same operators will work NFL regular season games, playoff runs and Super Bowl LXI. Outside the stadium, counterfeit credentials, organized vehicle burglary and retail theft crews will be active.
Commercial sex activity will require trafficking-indicator awareness. Most of this ecosystem advertises itself, as exemplified by the August 23 arrest of San Francisco 49ers owner Jed York, whom ESPN reports “allegedly responded to an undercover ad on a known prostitution website and “arranged to have sexual activity with the female in exchange for $140.’”
Promotional activity makes sex trafficking easier to monitor using open-source intel. Fivecast ONYX follows that advertising trail, with multilingual triage for rings operating from outside the country, while Fivecast MATRIX handles the adjacent challenge of screening event staff, vendors and contractors at scale.
BUILDING A REGULAR SEASON RHYTHM
The most useful trends translate into a repeatable cycle that law enforcement can assess and anticipate.
- Pre-season. First, investigators establish the baseline. Which local groups, grievance networks and issue campaigns are active in the AOR? Which players, coaches and officials are already receiving sustained targeted abuse? What does normal chatter volume look like, so anomalies are visible later? Investigators can develop and legally review collection plans and standing requirements now.
- Game week (T-72 hours). As games approach, investigators can advance to requirement-driven collection in specific areas, such as opponent travel-fan behavior, announced demonstrations, threats referencing the venue or date, drone activity discussion, resale and counterfeit activity spiking around the game or any conversations that connect to a named individual of concern.
- Game day. Investigators should prioritize near-real-time monitoring focused on three things: pre-attack indicators, rumor propagation velocity, and crowd condition reporting from inside the footprint that hasn’t reached the UCP yet. Every intel product needs a named consumer — an incident commander, a venue security manager, a bike squad supervisor — and an action it enables.
- Post-game and season-long. Investigators should review and continuously analyze their findings, the resulting interventions and opportunities for improvement. Escalation patterns across weeks are where the genuinely dangerous individual becomes visible.
WHERE FIVECAST FITS
Fivecast was built to help investigators balance too much data, too little time and a legal obligation to get it right.
Fivecast ONYX integrates broad discovery, deep targeted collection and AI-enabled risk detection in a single platform, across surface, deep and dark web sources. For event security, three capabilities matter most:
- Customizable risk detectors let a department encode its own requirements, such as threats to the venue, weapons references, drone and TFR discussion or doxxing of players or officers. Analysts triage a ranked queue instead of scrolling feeds, moving rapidly from a single concerning post to close inspection to confident intervention.
- Persons-of-interest search and network analysis surface previously unknown actors and reveal whether a threatening account is an isolated individual or one node in a coordinating group. Data triage across more than 100 languages matters in cities hosting international visitors.
- Built-in anonymization and misattribution removes the need to maintain covert online infrastructure, alleviating a persistent tradecraft and liability burden for small units. API-based data fusion pushes findings into whichever real-time crime center or fusion platform the command staff already watches.
At the strategic layer, Fivecast LUNEX delivers curated datasets to expose the foundational networks and movements behind recurring activities.
To vet event staff, vendors, contractors and volunteers, Fivecast MATRIX offers automated account resolution and configurable analytics for screening at a scale manual review can’t achieve.
AVOID PENALTIES. DO IT LAWFULLY.
The fastest way to lose an OSINT program is to run it without a policy. Before the season starts, an agency should be able to answer, in writing: What are our standing collection requirements, and who approved them? What documented nexus to criminal activity or a specific public safety threat justifies collecting on a named individual? How do we ensure we are assessing behavior and capability rather than belief, affiliation or protected expression? What is our retention and purge schedule, and does the system meet 28 CFR Part 23 requirements where applicable? Who reviews the audit log, and how often?
These policy requirements ensure an OSINT program can withstand defense motions, oversight hearings and public records requests. Perhaps more importantly, transparent policies build the trust in the community that lets the program exist at all.
KEEPING SCORE
The metric for game-day intelligence impact is not reports produced or accounts reviewed, but interventions enabled. Success could be exemplified by contacting a subject on Thursday instead of searching for them on Sunday, or locating a drone operator in a parking structure before the flight, or disrupting a fraud ring before 400 fans arrive with worthless tickets.
Eighteen weeks. Thirty metro areas. An Olympics in the rearview mirror and a Super Bowl ahead. The signals are already out there. The time to act is now.
About Fivecast
Fivecast delivers intelligence solutions built for clarity, powered by AI and trusted to surface what matters. Engineered to solve complex intelligence challenges our platform cuts through digital noise to help those protecting nations, borders, businesses and communities uncover critical insights – before risk becomes reality.
Trusted by agencies and enterprises across national security, law enforcement, defense, corporate security and financial crime, Fivecast was born from collaboration between governments and research institutions. Headquartered in Australia with a global footprint, we support the world’s most critical missions.
Fivecast. Engineered for Intelligence.
