1장
When the Predator Becomes the Prey
The woman walked alone down the dimly lit street, her attention completely absorbed by her smartphone. She didn't notice the two men following her for the past three blocks, gradually closing the distance. She didn't see how they communicated with subtle hand gestures, positioning themselves to approach from different angles. She remained oblivious until the moment they made their move-but by then, it was too late.
This scenario plays out countless times daily across America, but it doesn't have to. Jonathan T. Gilliam's "Sheep No More" has become a cultural phenomenon, endorsed by Sean Hannity and embraced by security professionals nationwide. Drawing from Gilliam's extensive background as a Navy SEAL, FBI Special Agent, and Federal Air Marshal, the book has transformed how everyday citizens approach personal security. Unlike typical self-defense guides that focus on responding to attacks, Gilliam's revolutionary approach teaches readers to think like the predators they fear-not to become attackers, but to anticipate and prevent attacks before they occur.
2장
The Attack and Defend Technique: Seeing Through Predatory Eyes
The cornerstone of Gilliam's methodology is the Attack and Defend technique - a comprehensive mental framework that teaches you to alternate between attacker and defender mindsets. Most security failures stem from a fundamental problem: defenders think defensively while attackers think offensively. This cognitive mismatch creates dangerous blind spots that attackers routinely exploit, often with devastating consequences.
"To truly protect yourself," Gilliam explains, "you must temporarily adopt the attacker's perspective - discarding moral constraints to identify vulnerabilities in your own life that would attract predators." This means examining your daily routines, habits, and environments through the cold, calculating eyes of someone intent on causing harm.
The approach distinguishes between two distinct types of potential threats: Attack Planners and Imminent Attackers. Attack Planners conduct methodical surveillance, studying patterns and weaknesses before striking. They might observe your home for days or weeks, noting when lights go off, which windows remain unlocked, or when children leave for school. They track social media posts that reveal vacation plans or daily schedules. These predators excel at identifying soft targets through patient observation.
Imminent Attackers, by contrast, display more obvious warning signs - nervousness, inappropriate clothing for the setting, or unnatural focus on potential victims. They might wear heavy coats in warm weather to conceal weapons, repeatedly touch concealed areas for reassurance, or position themselves strategically near exits. Their body language often betrays their intentions through subtle cues like target glancing, territorial scanning, and predatory movement patterns.
What makes humans particularly dangerous predators is our unique capacity for conscious killing. Unlike animals who kill instinctually for survival, humans murder with full awareness of life and death, often for reasons entirely unrelated to survival. Serial killers meticulously plan their crimes despite - or sometimes because of - their psychological disorders, creating elaborate fantasies and ritual behaviors. Even more dangerous are ideological killers who fully justify their actions through religious or political frameworks, eliminating any moral hesitation that might otherwise inhibit violence.
The technique teaches specific observational skills to identify these threats. Watch for people photographing security cameras, testing door handles, or lingering without purpose. Notice individuals who seem out of place or whose attention patterns don't match their supposed activities. Pay attention to your own intuition - the subconscious recognition of threat patterns often registers as unease before conscious awareness catches up.
By understanding these mindsets and behaviors, you can recognize the patterns that precede attacks, giving yourself precious time to avoid becoming a target. This isn't about fostering paranoia - it's about developing informed awareness that empowers rather than paralyzes. The goal is to maintain normal activities while incorporating strategic security consciousness into daily life.
3장
Understanding Attack Types: From Military Precision to "Random" Violence
Attacks aren't defined merely by who conducts them or what weapons they use, but by how they target critical assets, areas, times, and vulnerabilities. Even seemingly random attacks follow predictable patterns when viewed through the attacker's lens.
Military attacks represent the pinnacle of attack planning. Gilliam describes a Navy SEAL operation in Afghanistan where operators, supported by Night Stalker helicopters, executed a complex raid on a compound in under ten minutes. This level of precision comes from exhaustive intelligence gathering and target analysis-the same principles that apply to personal security, albeit at a different scale.
Criminal attacks typically fall into four motivational categories: material gain, monetary profit, emotional satisfaction, or ego fulfillment. A burglar targeting your home for valuables operates differently than someone seeking revenge, yet both conduct some form of pre-attack surveillance and planning.
Terrorism has evolved from spectacular, large-scale attacks to smaller, more frequent bloody incidents in everyday locations. This shift makes terrorism harder to predict and prevent using traditional security measures. The 2004 Madrid train bombings demonstrate how terrorists select targets for maximum psychological impact-killing 192 people and wounding 1,800 through coordinated strikes that ultimately influenced a national election.
Even "random" violence isn't truly random. These attacks occur where potential victims gather, not in empty spaces. Whether on a deserted sidewalk or in a crowded park, the common denominator is the presence of people. Mental instability and substance abuse increase the unpredictability factor, but the targeting remains fundamentally logical from the attacker's perspective.
Perhaps most preventable are instigated attacks-bar fights, sports rage incidents, and road rage confrontations that develop spontaneously between parties. These situations are 100% avoidable if you're willing to set aside pride and walk away. As Gilliam bluntly notes, "A single punch can lead to serious injury, death, legal troubles, and financial ruin."
4장
Building Your Personal Target Package
The most powerful defensive tool isn't a weapon or alarm system-it's information organized into what Gilliam calls a "target package." This systematic approach to understanding your own vulnerabilities mirrors how professional attackers plan their operations.
"Most people," Gilliam observes, "spend more time deciding what to eat for lunch than preparing for life-threatening situations."
Creating your target package involves five key steps:
First, divide your life into sectors-home, work, school, restaurants, places of worship, and other environments you regularly occupy. This organizational approach makes vulnerability assessment manageable.
Second, dissect each sector into critical components: assets (what you value), areas (physical spaces), and times (when vulnerabilities peak). For your home, critical assets include family members, property, weapons, and essential utilities. Critical areas might include entry points, children's bedrooms, or places where valuables are stored. Critical times could include sleeping hours or when the house is empty during work hours.
Third, identify specific vulnerabilities within each category. Perhaps your teenager consistently leaves doors unlocked, or children's bedrooms face outside a privacy fence. These details create a realistic picture of what an attacker might exploit.
Fourth, map all possible avenues of approach-the physical paths attackers would likely take when targeting your vulnerabilities. For a home, this includes nearby transportation infrastructure offering quick access and escape, natural features providing covert neighborhood access, and entry points frequently left unlocked.
Finally, complete the target equation by combining all previous information to identify specific attack scenarios. This reveals exactly who might attack, why, where, when, and how-information that empowers you to implement targeted countermeasures.
What makes this approach revolutionary is its participatory nature. Instead of relying on "experts" to protect you, you become the expert on your own security, understanding exactly where attackers will focus their attention.
5장
Remote Surveillance: How Attackers Study You From Afar
Before an attacker ever approaches you physically, they've likely gathered substantial intelligence from a distance. Understanding these remote surveillance techniques reveals how vulnerable most people are without realizing it - and how much information is readily available to those who know where to look.
The primary tools for remote surveillance are surprisingly accessible: the internet, mapping programs, libraries, newspapers, and social media platforms. These resources provide attackers with operating hours, event schedules, addresses, demographics, incident histories, and shared threats. Through platforms like Google Earth, Street View, and public records databases, attackers can construct detailed profiles of targets, including traffic patterns, security measures, and potential escape routes.
"Attackers prefer gathering intelligence remotely," Gilliam explains, "as physical proximity to targets increases their vulnerability to detection." This principle has become even more relevant in the digital age, where vast amounts of information are available without leaving home. Social media posts, particularly those with location tags or regular check-ins, can reveal daily routines, relationships, and vulnerabilities.
The internet has dramatically reduced the need for on-site reconnaissance, allowing attackers to build comprehensive target packages from a safe distance. Virtual tours, promotional videos, and employee LinkedIn profiles provide insights into building layouts, security protocols, and organizational hierarchies. What's particularly concerning is how cities worldwide share remarkably similar layouts and vulnerabilities despite geographical differences - from shopping centers to government buildings, standardized designs create predictable security weaknesses.
Through personal experience combining online research with on-site verification, Gilliam discovered how satellite imagery reveals critical patterns that are consistent across different cities. Worn paths showing main entrances and exits at stadiums, parking lot configurations revealing staff entry points, and even landscaping features that could provide cover become apparent through aerial views. Security camera placement often follows predictable patterns, creating blind spots that skilled observers can identify from satellite images alone.
Historical patterns provide valuable insights into potential threats. Different attacker types employ different tactics and targets - lone wolves tend to favor soft targets with minimal security, while organized groups might attempt more sophisticated operations against hardened targets. Anniversary dates hold significant value for potential attackers - September 11 remains tense annually since the 2001 attacks, while April 19 carries significance due to the 1993 Branch Davidian incident and the 1995 Oklahoma City bombing. These dates often see increased security measures, but attackers may view this predictability as an opportunity to strike different targets when resources are focused elsewhere.
Modern surveillance tools have evolved to include social media monitoring software, OSINT (Open Source Intelligence) gathering platforms, and automated data collection systems. These technologies allow potential attackers to track multiple targets simultaneously while maintaining complete anonymity - making traditional counter-surveillance measures increasingly ineffective.
6장
On-Site Verification: The Attacker's Most Vulnerable Moment
Despite technological advances in satellite imagery and digital reconnaissance, ground surveillance remains essential for attackers building accurate target packages. The 2012 Benghazi compound attackers demonstrated this by conducting extensive on-site surveillance before their assault, including measuring precise distances for mortar fire placement and identifying defensive weaknesses. This critical phase of information gathering - when attackers must physically approach their targets - presents their greatest vulnerability and creates unique opportunities for alert defenders to detect hostile surveillance.
Vehicle surveillance provides attackers a mobile observation platform to gather significant intelligence while maintaining relative safety. From vehicles, they can systematically assess police patrol patterns, security force positioning, population demographics, multiple escape routes, and optimal approach paths. Attackers typically use rental cars or unremarkable vehicles that blend with local traffic, often switching between multiple vehicles to avoid detection. However, this surveillance phase creates detectible patterns - attackers focused on gathering information may circle areas repeatedly, park in strategic observation points, or display unusual interest in security features.
Foot surveillance brings attackers into the target's immediate space, allowing verification of critical details that remote or vehicular surveillance cannot provide. During this phase, they determine exact camera coverage angles, study building access points, verify security shift changes, and identify optimal attack timing. Different types of attackers display distinct behavioral patterns - traditional criminals typically avoid crowds and seek isolated opportunities, while terrorists often prefer crowded venues for maximum impact. While foot surveillance provides attackers with the most precise targeting information, it creates their moment of greatest vulnerability, giving trained defenders multiple opportunities to identify suspicious behavior patterns like prolonged loitering, unusual photography, or coordinated observation by multiple individuals.
Understanding predatory behavior patterns requires examining detailed case studies like Hannah Anderson's 2013 abduction. Sixteen-year-old Hannah was kidnapped by forty-year-old James DiMaggio after he murdered her mother Christina, eight-year-old brother Ethan, and the family dog. DiMaggio, a longtime family friend, had displayed typical child predator behaviors that went unrecognized - excessive interest in the child, creating opportunities for isolated contact, and gradually testing boundaries. Unlike many attackers who strike targets of opportunity quickly, child predators often methodically infiltrate families through social connections over months or years, carefully building trust to gain increasingly intimate access to their targets. They frequently volunteer for childcare, create reasons to be alone with potential victims, and systematically groom both the children and their protective adults to accept their presence.
7장
From Awareness to Action: Developing Defensive Strategies
Awareness without action is merely interesting knowledge. The Attack and Defend technique must translate into concrete defensive strategies tailored to your specific vulnerabilities - a process that requires both systematic analysis and practical implementation.
While consulting for a major hotel chain experiencing increased criminal activity, Gilliam led the owner and staff through comprehensive awareness training focusing on three critical areas: identifying structural vulnerabilities, analyzing potential attackers' approach routes, and understanding criminal methodology. By first conducting remote surveillance using publicly available information - including Google Earth imagery, street-level photos, and social media posts - then methodically walking the property perimeter while thinking like criminals, they identified numerous security gaps that weren't apparent during routine operations.
The diverse perspectives of staff proved invaluable in this process. Bellmen noticed suspicious vehicles circling the property during specific times. Housekeepers identified unsecured service entrances. Night auditors reported patterns in after-hours foot traffic. Security guards shared blind spots in their patrol routes. This collective intelligence painted a complete picture of vulnerability that no single perspective could have provided.
They implemented three seemingly simple but strategically significant changes: repositioning existing security cameras to cover likely approach routes rather than just entry points, restricting nighttime access to the main entrance only (eliminating multiple vulnerable points), and creating an informal perimeter patrol system by having smoking employees take their breaks in designated outdoor areas around the property. These changes virtually eliminated theft while increasing customer satisfaction ratings by 22% and profits by 15% - demonstrating how awareness training can transform vulnerability into strength through collective vigilance.
Unfortunately, many contemporary security measures amount to mere theatrics - actions that provide an illusion of safety without substantive protection. As former Delta Force operator Pat McNamara notes, "institutional inbreeding" perpetuates ineffective security practices, with organizations copying superficial measures without understanding underlying principles. Security theater often includes highly visible but ineffective measures like random ID checks, unsupervised security cameras, or untrained guards positioned at entrances.
The 2008 Marriott Hotel attack in Islamabad serves as a sobering example of inadequate threat assessment. Despite its prestigious location near government buildings and diplomatic missions placing it under constant threat, the hotel's security measures proved catastrophically insufficient. While the facility had implemented standard security protocols - including vehicle barriers and screening procedures - terrorists simply built a larger bomb than anticipated, demonstrating how rigid, checkbox-style security thinking can create dangerous blind spots.
The fundamental lesson is clear: if a security measure doesn't actively mitigate specific identified vulnerabilities, help develop realistic contingency plans, or effectively guide people away from critical areas, it's likely useless theatrics that may actually worsen the situation by creating a false sense of security. Effective defensive strategies must evolve from genuine awareness, incorporate multiple perspectives, and focus on practical countermeasures that address real rather than perceived threats.
8장
The Crisis Response Triad: Escape, Evade, Fight
When prevention fails and you find yourself in a dangerous situation, your response options fall into three categories: escape (run), evade (hide), or fight. Each requires specific preparation and understanding.
Contrary to popular belief, tough guys do run. As a Navy SEAL, Gilliam trained extensively for running-in BUD/S training, averaging 9-13 miles daily. This wasn't just physical conditioning; it prepared him for the fog of war. Knowing when to run is crucial in dangerous situations, but effective escape requires more than just movement.
When you hear gunfire, assess before fleeing-sound travels unpredictably in buildings, reflecting off walls and potentially misleading you about the danger's direction. Even after locating the threat, plan an effective escape route that doesn't lead to greater danger. Multiple attackers often approach from different directions, causing panicked victims to run directly into additional threats.
Vehicle attacks have become increasingly common due to their simplicity. The 2016 Nice, France attack during Bastille Day killed 86 people when a truck plowed through crowds. In both this and the London Bridge attacks, victims could have improved their chances by staying near barriers, avoiding the center of crowds, and running perpendicular to the attack path rather than along it.
If escape isn't possible, evasion becomes necessary-but consciously hiding during an active-shooter scenario essentially puts your fate in the hands of the attacker. Understanding the difference between cover (actual protection) and concealment (merely being out of sight) is critical. A 7.62mm round from an AK-47 can penetrate cinderblock walls, while wooden doors, drywall, and glass offer no meaningful protection even against handguns.
As a last resort, fighting requires mental preparation long before the crisis occurs. Gilliam emphasizes that winning a fight requires 25% mental preparation, 25% pre-committed will, and 50% technique-and having even half of this equation puts you significantly ahead of most people. The key is committing to action before the crisis occurs, not waiting until the moment of danger to decide.
9장
Conquering Fear Through Preparation
Fear is not a gift but a primal emotion designed to trigger fight-or-flight responses that, when unchecked, can paralyze you or lead to irrational decisions. While this survival mechanism served our ancestors well when facing predators, today's complex threats require a more nuanced approach. Overcoming fear in crisis situations requires developing specific skills, mental frameworks, and muscle memory well before facing danger.
The key to controlling fear is systematic preparation and detailed contingency planning. Just as you would prepare thoroughly for a high-stakes presentation by outlining content, testing equipment, and rehearsing multiple times to build confidence, you must apply the same methodical approach to personal security. When you act rather than react, you maintain control during crisis situations. This means developing specific protocols for various scenarios - from active shooter situations to natural disasters - and regularly practicing these responses until they become second nature.
Consider a family vacation scenario: instead of passively ignoring potential threats, develop a detailed "Tactical Airport Plan" with specific steps for moving through security checkpoints efficiently while maintaining situational awareness. This includes designating clear roles (point person carrying electronics, parents positioned first and last in the group), wearing appropriate clothing (slip-on shoes, no belts, easily removable jackets), maintaining communication protocols (hand signals, code words), and establishing predetermined meeting points in case of separation. The plan should also include contingencies for medical emergencies, lost documents, or security incidents.
By rehearsing these plans beforehand through both mental visualization and physical practice, your family can respond effectively during an attack rather than freezing in fear. Even in chaotic situations like a coordinated bombing and shooting, prepared individuals can maintain mental clarity while others remain paralyzed by fear. This preparation extends beyond physical actions to include psychological readiness - understanding how stress affects decision-making, recognizing the signs of panic in yourself and others, and having pre-established triggers for specific responses.
Remember: "where chaos reigns, chaos rules." Reactions are directed by emotion, while actions are guided by critical thinking and predetermined tactics. The goal is not to eliminate fear - that's neither possible nor desirable - but to channel it productively through preparation, practice, and purposeful planning. This approach transforms fear from a paralyzing force into a focusing mechanism that enhances rather than impairs performance under pressure.
10장
Breaking the Cycle of Learned Helplessness
Today's world has become a training ground for learned helplessness-a mindset of dependency that pervades all aspects of our lives. This manufactured state emerges through rules, regulations, and a culture of "I want it and you should get it for me." We're told to want things without working for them, valuing possession over earning-a cancer that strikes free societies as people drift from self-responsibility toward dependency.
This crippling state exists everywhere-from cyber security where people rely on technology while using weak passwords, to online dating where people thoughtlessly share personal information. Dependency is the self-imposed shroud that blocks awareness and prevents action when action is needed.
Susan's Philippines trip illustrates how awareness can make the difference between safety and danger. Despite her friends' dismissal of her security concerns, Susan's preparation-including building a comprehensive target package, preparing appropriate clothing and improvised defensive items-likely prevented their group from becoming kidnapping victims when they were directed through suspicious territory by resort staff.
The Attack and Defend methodology empowers you to identify threats and high-risk areas in your life. This approach targets civilians rather than security experts because ultimately, your safety depends on you, not authorities. Police and firefighters can't protect you proactively-they're primarily reactive responders.
With limited resources and widespread leadership incompetence, law enforcement can't be everywhere. By understanding Attack and Defend principles, you'll recognize threatening behavior and distinguish between normal and suspicious activities. This methodology scales from individuals to entire cities. Imagine if everyone understood potential attack vectors-police could position proactively, venue security would be enhanced by vigilant attendees, and schools would operate with greater awareness.
You don't need expensive consultants or fancy diagrams-you now possess the tactical understanding to identify critical areas, vulnerabilities, and approaches. With proactive awareness, you'll rarely be caught in a surprise attack and will be prepared to act, not merely react, when necessary. Remember: awareness, not fear, is the true gift that can save lives.
