Reading the D1–D6 threat matrix
MXSG Intelligence Desk | Reviewed by Mike Mees, Chief Strategy Officer | Current as of 18 October 2026
The D1–D6 matrix answers three questions: how risky is this trip or event overall, which domain is driving that rating, and what posture does the rating require? Read the driver and the posture before you read the number. A "Moderate" overall rating with a "Critical" criminal and kidnap domain calls for a very different plan from a uniform "Moderate" across all six.
Key judgments
- The overall rating is a summary, not the finding. The domain ratings, and the sub-threats behind them, are where the plan comes from. High confidence.
- Weighting is where context enters. The same city can rate differently for a low-profile consultant and a high-net-worth principal with a public schedule, because personal security and kidnap risk carry more weight for the second. High confidence.
- A rating is only as current as its date. Every matrix describes a specific window. A material change in the environment should trigger a re-score, not a footnote. High confidence.
The six domains
Every scored MXSG product, whether travel risk intelligence, event risk intelligence or executive protection support, uses the same six domains.
| Domain | What it covers for travel |
|---|---|
| D1 Personal Security | Assault and robbery, kidnapping, sexual violence, targeted attack, exposure to crowds and unrest, surveillance and tracking, and lodging security |
| D2 Cyber & Digital Risk | Device compromise, network interception, social engineering, digital surveillance, data theft, border device searches and communications security |
| D3 Health & Medical | Infectious disease, quality of medical facilities, food and water safety, access to medication, environmental hazards, stress, and whether medical evacuation is feasible |
| D4 Geopolitical Stability | Government instability, proximity to armed conflict, terrorism, sanctions and legal jurisdiction, protest and civil unrest, border closures and anti-Western sentiment |
| D5 Criminal & K&R | Express kidnapping, ransom and extortion, organized crime, trafficking, corruption, cartel activity and maritime threats |
| D6 Infrastructure & Logistics | Transportation safety, airport and border security, communications and power reliability, natural disaster risk, supply availability and emergency services |
For travel, each domain is broken into seven sub-threats, so a full travel matrix scores 42 items. Event assessments score more than 22 scenarios across the same six domains, tailored to the venue and the principal.
How a rating is built
Each sub-threat is scored for severity, likelihood and impact on five-point scales. Those scores combine into a composite for the sub-threat, the sub-threats roll up into a domain rating, and the domains roll up into an overall weighted rating. Every rating lands in one of five bands.
| Rating | What it requires |
|---|---|
| Critical | Imminent or life-threatening danger. Travel or attendance is strongly discouraged, and evacuation protocols may apply. |
| High | A significant threat that needs strong countermeasures and continuous monitoring. |
| Moderate | Elevated risk with identifiable threats. Enhanced precautions and preparedness are required. |
| Low | Manageable risk. Standard precautions and situational awareness. |
| Minimal | No credible threat identified. Routine protocols apply. |
A domain can also be marked N/A when it doesn't apply or when there isn't enough reliable information to assess it. That is always stated in the product. A domain is never left out silently, because a missing rating reads like a low one.
How weighting works
Domains don't count equally for every client. Weighting starts from a default for the engagement type and is adjusted for the traveler and the destination:
- D1 and D5 go up for regions with kidnap risk and for high-profile principals.
- D4 goes up for conflict zones, sanctioned countries and volatile regions.
- D2 goes up when travelers carry sensitive data or operate where corporate espionage is a concern.
- D3 goes up for remote destinations or travelers with health considerations.
- D6 goes up for complex multi-leg itineraries or heavy dependence on local infrastructure.
For events, there is no fixed weighting table. Weights are set from the venue and principal profile, and the rationale is written into the threat narrative so the client can see why.
Reading a matrix in two minutes
- Read the bottom line and the overall rating. That tells you whether the trip or event can proceed, and under what conditions.
- Find the driving domain. Look for the highest-rated domain and the sub-threats that put it there. That is where most of the mitigation effort should go.
- Read the posture, not just the label. "High" means continuous monitoring and strong countermeasures. If the plan doesn't include both, it doesn't match the rating.
- Check the date and the confidence. Each finding should state its sources and how confident the analyst is. Lower confidence on a high-rated domain is a reason to collect more, not to discount the rating.
- Look for N/A and gaps. They tell you where the picture is incomplete.
When to ask for a re-score
- The official travel advisory level changes for the destination or a region on the route.
- A significant incident occurs near a planned location.
- The itinerary, lodging or principal profile changes.
- The travel window moves, especially into a holiday, election or major event period.
Sources
- International Organization for Standardization, ISO 31000:2018 Risk management: Guidelines. iso.org. Reliability: high.
- International Organization for Standardization, ISO 31030:2021 Travel risk management: Guidance for organizations. iso.org. Reliability: high.
- Office of the Director of National Intelligence, Intelligence Community Directive 203: Analytic Standards. dni.gov. Reliability: high (official); reference for expressing likelihood and confidence.
This article describes MXSG methodology at a general level, current as of 18 October 2026. It is not a tailored assessment for any traveler, trip or event.