These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters.
In the immediate aftermath of the Michigan mass shooting and arson attack, the FBI described the incident as an “act of targeted violence” and took lead over the investigation. Acting special agent in charge Reuben Coleman reported that over 100 victims and witnesses had been interviewed, the forensic and evidence teams were deployed and that intelligence units were analyzing motives and planning. Through public statements, the White House and federal officials have noted that Sanford “hated people of the Mormon faith,” though a definitive motive has not yet been confirmed.
In the days before attack, Sanford is reported to have expressed anti-Mormon sentiments to at least one local politician, calling LDS members the “antichrist” and recounting complaints about being asked to remove tattoos. Some witnesses and acquaintances say he previously lived in Utah for a time, where he was involved with a Latter-day Saints woman, and resented expectations or pressures from church members. Neighbors describe him as ordinarily nonviolent, and no prior legal restrictions or red flags are known to have been in place before the attack. In response, local HOWs across Michigan have reportedly begun enhancing security measures while striving to maintain a welcoming atmosphere for worshippers. Meanwhile, state government leaders have called for restraint in rhetorical escalation and urged the public to avoid speculation that could hamper the investigation.
Analyst Comments: The Michigan church attack highlights how personal grievances and ideological hostility can intersect to drive targeted violence against religious communities. While Sanford reportedly expressed anti-Mormon rhetoric, the absence of prior legal restrictions or clear behavioral warning signs reflects the persistent challenge of detecting lone-actor threats before escalation. The attack also shows the difficult balance that HOWs face in enhancing security measures while maintaining openness and inclusivity, especially in the aftermath of a high-profile incident. After any high-profile attack such as this, the potential for copycat attacks increases. Organizations may consider not only traditional physical protections but also community awareness initiatives and threat reporting mechanisms to surface concerning behavior earlier. Members may want to share resources with their communities like CISA’s Pathway to Violence which helps individuals identify warning signs.
October is designated as Cybersecurity Awareness Month, and for over 20 years CISA has used this period to emphasize the everyday actions individuals and organizations can take to reduce cyber risk. For 2025, the theme is “Building a Cyber Strong America”. With spotlight on strengthening the cybersecurity posture of government entities and small to medium businesses, particularly those tied to critical infrastructure. CISA encourages such organizations and their vendors and supply chains to adopt at least one concrete cybersecurity improvement immediately. The agency offers a toolkit of resources, messaging materials, and guidance the help groups launch their own awareness campaign. CISA also collaborates with the National Cybersecurity Alliance to extend advice and tools for individuals and families to stay safer online.
Analyst Comments: Cybersecurity Awareness Month provides an opportunity to reinforce baseline cyber hygiene practices across organizations of all sizes. The 2025, theme, building a Cyber Strong America, places particular emphasis on the vulnerabilities of small and medium businesses and critical infrastructure partners, which remain frequent targets of cybercrime and state-sponsored activity. Members may find value in leveraging CISA’s toolkits and awareness materials not only for internal training but also for engagement with vendors, contractors, and community stakeholders. By encouraging even one measurable security improvement, such as implementing multifactor authentication, updating software, or conducting phishing simulations, organizations can make tangible progress toward reducing their risk profile.
The Gate 15 Security Sprint is a weekly rundown of the week’s notable all-hazards security news, risks and threats and some of the key focus areas for organizations to consider behind the headlines. Gate 15 team members discuss physical security, cybersecurity, natural hazards, health threats and other issues across our environment.
In this week’s Weekly Security Sprint Dave and Andy covered the following topics:
The above Gate 15 Weekly Security Sprint website also provides links to many security-related items of interest.
Information on other Gate 15 podcasts can be found at Podcast.
The Gate 15 Nerd Out! Security Panel Discussion, moderated by Dave Pounder, focuses on physical security topics including terrorism, extremism, hostile events, and other pertinent topics.
In this week’s Nerd Out Dave and Alec talked about the following topics:
Information on other Gate 15 podcasts can be found at Podcast.
The FB-ISAO’s sponsor Gate 15 publishes a daily newsletter called the SUN. Curated from their open source intelligence collection process, the SUN informs leaders and analysts with the critical news of the day and provides a holistic look at the current global, all-hazards threat environment. Ahead of the daily news cycle, the SUN allows current situational awareness into the topics that will impact your organization.