CISA urges eventgoers to ‘trust your instinct’ and outlines how to spot and report suspicious behavior at large summer events

Christine Serrano Glassner, chief external affairs officer at the Cybersecurity and Infrastructure Security Agency (CISA), opened a live briefing about personal safety at large summer events, saying the agency wants attendees to be “smart, safe, and aware” as a historic season of major gatherings approaches.

CISA brought two specialists — Kurt Tilly, Office for Bombing Prevention training branch chief, and Dan Abandoglio, portfolio manager for active‑assailant security — to explain how ordinary people can help prevent or limit harm by noticing behavior that deviates from the local or event “baseline,” reporting concerns to on‑site staff or 911, and avoiding direct contact with suspicious items.

Why it matters: With multi‑venue events such as the 2026 FIFA matches and large public celebrations, CISA officials said public awareness can multiply the agency’s protective work. “Trust your instinct,” Tilly said. “When those hairs on the back of your neck go up, they go up for a reason.” The panel framed reporting as empowering: a single report may be one more piece that helps trained responders identify a pattern.

What to watch for: Tilly and Abandoglio urged attendees to look for behaviors that do not fit the environment — for example, attempting to bypass restricted areas, repeatedly photographing security cameras or infrastructure, or other actions that diverge from what’s typical for a concert, parade or fan zone. The panel cautioned against equating cultural differences with suspicious intent and stressed that observers should report the behavior rather than make a final judgment.

Unattended items: CISA’s Office for Bombing Prevention explained the practical test for unattended versus suspicious items: is the object hidden, does it exhibit obvious warning signs (wires, ticking, smell, leaking), or does it not belong in that environment? If any of those apply, the guidance is to keep distance, do not touch or inspect the item, and report it to security or law enforcement.

How to report: The agency recommended reporting first to the nearest venue staff or security personnel, who can escalate to the appropriate authority. If on‑site staff are not available, call local law enforcement or 911. When reporting, give objective details — what you observed, exactly where and when, and any behaviors that made you uneasy — so responders can connect multiple reports into a possible pattern.

Advice for organizers and smaller venues: CISA reminded event planners that a “major event” is one that overwhelms local resources and advised organizers of all sizes to plan ahead, train and exercise staff, post clear reporting contact information, and practice reunification procedures for families. The agency said the same planning resources it uses for large events are scalable and available to smaller towns and pop‑ups.

Conflict prevention and de‑escalation: Abandoglio outlined simple interpersonal tactics the panel calls the “power of hello” — observe, initiate a friendly engagement, assess and navigate the risk, then obtain help if needed. He emphasized attendees should assess their own training and safety before intervening and otherwise remove themselves and inform staff.

Audience questions: In response to viewers, officials said warning signs vary by incident type but that any implied or explicit threat of harm should be reported immediately. When asked whether a bystander has a duty to stay with a suspicious item, panelists reiterated: prioritize personal safety, avoid touching the object, and follow instructions from authorities.

What comes next: CISA encouraged attendees to consult the agency’s website for checklists and guidance, to use venue‑posted local reporting numbers where available, and to participate in planning discussions before attending large events. Glassner closed by noting CISA is hiring and that viewers can submit follow‑up questions through the broadcast chat or provided email contacts.

Quotes in context: “Trust your instinct,” said Kurt Tilly, CISA’s Office for Bombing Prevention training branch chief. “People aren’t suspicious, but their behaviors may be,” the panel added, urging reporters to supply objective “five W” details that help investigators.

Ending: The panel framed public reporting as an adjunct to professional security: attendees should enjoy events while remaining aware, report concerns to trained staff or 911, and follow guidance from authorities on site.