In 2025, Super Bowl LIX was watched by a record 127.7 million viewers¹, with approximately 125,000 visitors² flocking to New Orleans, LA. A National Special Security Event (NSSE), the Super Bowl was protected by increased law enforcement presence, detailed security operations and hundreds of Homeland Security Investigations (HSI) special agents.

Weeks earlier, the city of New Orleans suffered a terrorist attack when a driver deliberately plowed a pickup truck through a New Years’ crowd on Bourbon Street, escalating safety concerns around the Super Bowl³. The event received the upmost attention from the U.S. government to ensure spectator safety, with the government conducting a litany of security assessments in the lead up to the Super Bowl⁴. And stadium security is no longer solely a matter of physical protection – it is a data and cyber challenge. So, what kind of attention does a stadium event receive when it is not on the world’s biggest stage?

Each year, the U.S. hosts approximately 5,000 regular season games across the MLB, NBA, NFL and NHL. The top five European soccer leagues—England’s Premier League, Spain’s La Liga, Italy’s Serie A, Germany’s Bundesliga and France’s Ligue 1—host nearly 2,000 regular-season matches combined, not including cup fixtures. Millions of people funnel through thousands of events with one interconnected threat surface, making stadiums vulnerable to potential attacks.

Risk Environment

There are a tremendous number of systems, assets and protocols that must be evaluated in assessing stadium security processes. The architecture, design, technology, policies and procedures, training, staffing, threat management programs, and web threat monitoring represent some of a laundry list of considerations.

Potential operational technology attack surfaces include entrance gates, ticketing kiosks, HVAC systems, concessions, lighting controls, PA systems, video scoreboards, cameras, door locks/keypads, thermostats, generators, alarm systems and fire detection systems, among others.

Interconnected systems create cascading vulnerabilities, making stadium protection such an advanced operation. Cyber-attacks can have physical consequences, and an attack on one system can have domino effects on others. Third-party vendors may bring in their own systems that reach out to the internet via their own connection and provide additional avenues into the digital stadium infrastructure. When planning security procedures, cohorts must be aligned across the entire ecosystem of a stadium operation.

Potential Stadium Targets

Drones

The evolution of drone technology—a potential threat in outdoor and even indoor facilities—has further necessitated the importance of aero defense systems. While stadiums can track drones, only the federal government has the authority to approve interfering actions such as intercepting the drone, shooting it or taking control. For every drone operator, there is a different definition of what qualifies as a threat. The FAA has not been able to establish a wide spanning drone policy despite years of trying. Navigating drone-related protection represents a huge challenge for every outsidevenue.

In January 2025, drone maker DJI—whose drones are banned federally but still may be used in local jurisdictions—announced an update to its software system to remove guardrails that previously prevented drones from flying in restricted areas, such as airports or military bases. Lessened restrictions further convolute regulation in a stadium setting. Globally, recent conflict has redefined⁵ the capabilities of drones as they have gone undetected to wreak havoc.

Complexity of Stadium Protection, on and off the Field

Stadium security functions uniquely in the sense that protocols may differ depending on operators. Teams, the stadium, facilities and leagues all have their own security. The differentiation in standards between sports leagues means that the same venue may have different protocols depending on the event occupant. For example, an NFL owner may have their own security team that works with the local and state police departments to coordinate an operation, while at the same time the overarching league has security representatives that evaluate the same stadium.

More complicatedly, event sponsorship is a bought privilege. Any given stadium or arena could have different sponsorship a year or two from now; team ownership or leadership changes can affect how visitors are processed into a facility. In evaluating the layout of joint operation centers, security “seats” can fill up early with different agencies, meaning the rights to facilitating a secure operation are limited to a distinct number of vendors.

Major events—such as the Super Bowl—receive national security designations and thus are treated differently, with the U.S. Secret Service becoming involved in the operation. Considerations for events such as Super Bowl LX at Levi’s Stadium include:

• Government agencies occupy most seats in joint operations and fusion centers.
• The event has a very prescriptive event timeline, such as when to arrive, where to arrive and what to bring.
• An event at that level includes joint task forces and the potential of air defense assets such as F15s.

Our Role

The global stadium security market, projected to grow to over 20 billion dollars by 2032⁶, has expanded amid increasingly frequent large-scale events and progressively more complex threats. Kroll has developed its offerings to provide guidance, assessments and tangible action for physical and cyber threats throughout the entire lifecycle of stadium security. Once siloed obstacles, risks are evolving, making a holistic security infrastructure ever-more important in mitigating hazards when hosting a stadium-operated event.

Kroll’s Enterprise Security Risk Management (ESRM) and Cyber and Data Resilience (CDR) services help teams conduct stadium assessments and implement security operations to thwart physical and cyber threats. Kroll experts operate across all aspects of the stadium protection ecosystem and are on hand to discuss how to best support stadium security infrastructure and processes.

• Kroll works with teams to conduct assessments of their stadium safety programs, architecture, technology and threat management systems. Kroll can serve as the outside security director for stadium events and has historically worked with stadiums to certify they are prepared to deal with threats. Due to the complex nature of evacuating stadiums, Kroll conducts tabletop exercises with organizations that focus on in-duress events. The team also assists with medical operations, ensuring that leagues’ cardiac policies, protocols and procedures can support emergencies.
• The Operational Technology Security offering—a new cyber security analysis capability for stadiums and arenas—leverages decades of experience in assessing operational technology to provide assessments of stadiums’ cyber security—such as HVAC systems, video monitoring and fan access points—and implement optimal solutions to mitigate risk.

Sources
¹ https://www.cnbc.com/2025/02/11/super-bowl-59-viewership.html?msockid=0549dc3c596b6ebc3533ca67589b6fdd
² https://www.cnbc.com/2025/02/06/super-bowl-59-new-orleans-prepares-for-blockbuster-weekend.html?msockid=0549dc3c596b6ebc3533ca67589b6fdd
³ https://www.nbcnews.com/news/us-news/new-orleans-killed-mass-casualty-bourbon-street-car-crowd-rcna185914
⁴ https://www.dhs.gov/news/2025/02/03/dhs-agencies-support-super-bowl-lix-security
⁵ https://www.politico.com/news/magazine/2025/08/27/ukraine-drones-war-russia-00514712
⁶ Stadium Security Market Size to Reach USD 20.50 Billion by 2032 Due to High Incidences of Security Threats to Aid Market Expansion | Research by SNS Insider