On Sunday, more than 60,000 people will run 26.2 miles through all five boroughs, and about 2.5 million more will line the course to watch. The police commissioner said this week that there are “no known specific credible threats” to the race, and the security plan reflects a city that has done this many times: thousands of officers along the route, blocker vehicles around the busiest areas, helicopters, police drones, teams to deal with unauthorized drones, bag searches at the finish and intelligence units watching live camera feeds across the city.

That plan protects the event. It is not designed to protect any one person in it. And every year, some of the people in it are executives, founders and public figures who would never walk through Midtown on a weekday without someone thinking about their route.

A schedule anyone can look up

The official race app is a genuinely good piece of technology. Anyone can search for any runner by name or bib number, see their live position on a course map, and follow their pace and split times from the start, every five kilometers, at halfway and at the finish. Friends and families use it to know which corner to stand on and when.

So can anyone else. Type in a name and you know roughly where that person is, which direction they are moving and, from their pace, when they will reach the next mile marker. For about four hours on Sunday, a person who normally keeps their whereabouts private will be broadcasting them, live, to anyone who knows how to spell their name.

Add the rest of the picture. The runner will be in running clothes, with no car and no way to change the route, because the course is fixed and marked with a painted blue line. In the last miles they will be exhausted. And the finish is the most crowded part of the day: the organizers themselves warn that cell service around the post-finish area may be overwhelmed, and tell families to agree on a meeting place in advance.

None of this is a reason for an executive not to run. Nearly everyone will finish, collect a medal and go home. But predictability sits at the center of almost every targeted attack. The killing of a health-insurance chief executive outside a Midtown hotel in December 2024 happened at a place and time that had been announced in advance: his company’s investor conference. How that changed corporate security is still playing out. When ASIS International surveyed security professionals in 2025, 42% said their organizations put significantly more emphasis on executive protection than they had eighteen months earlier.

It does not start on race day

Marathon exposure usually begins months earlier. Charity fundraising pages announce that a named executive is running, sometimes with a target time. Social media posts follow the training. Fitness apps log the same morning route, from the same front door, several times a week.

In 2018, a fitness app’s public heat map revealed the outlines of military bases around the world, simply by showing where soldiers ran. A single person’s routine is much easier to read than a base.

What a sensible plan looks like

For anyone responsible for a high-profile runner this weekend, or for a principal thinking about running next year, a few principles hold up:

  1. Decide what is public before race day. Review fundraising pages, social posts and fitness-app privacy settings. Training routes and home start points should not be visible to strangers. If the race offers a way to limit what appears in tracking or results, consider using it.
  2. Do not publish the plan. Start wave, corral, target time and cheering spots should go to family and to the people responsible for the principal’s safety, not to followers. Post the medal photo after getting home, not from the finish line.
  3. Think about the family, not just the runner. A family standing at a known mile marker at a predictable time is as exposed as the runner. Choose spots that have not been announced and are not the obvious ones.
  4. Plan the finish and the exit hardest. The end of the race is crowded and slow, and phones may not work. Agree on a specific meeting point in advance, know which streets and bridges are closed, and stage the ride home outside the closures rather than at the edge of the park.
  5. Match coverage to the predictable points. If protection is warranted, it rarely means someone running alongside for 26 miles. It means people positioned at the start, the planned cheering points, the finish and the exit: the places where the principal’s location is known in advance.

The point

The marathon is one of the best-protected days of the year in New York, and the police plan is built for the crowd. Personal security is built for the individual, and its first rule is the same on a race course as anywhere else: the less predictable a person is, the harder they are to find. Live tracking makes a runner very easy to find. That is the whole point of the feature. For most runners, it is a gift to their families. For a few, it is the one thing worth planning around.