Base Operations|World Cup 26 ReportThe largest sporting event in North American history demands the most comprehensive security analysis ever conducted.
Base Operations analyzed 24 months of validated threat data across every FIFA World Cup 2026 host venue.
The tournament spans three nations. Mexico hosts three venues, including Estadio Azteca with the second-highest BaseScore in the tournament.
What is BaseScore?
BaseScore is a 0 to 100 threat score that allows you to compare locations across the globe. BaseScore™ is normalized based on population density, weighted based on crime severity, and standardizes reporting differences. Learn more about our methodology
The Pacific coast hosts four venues from Vancouver to Los Angeles, with BaseScores ranging from 44 to 77.
The Eastern seaboard and heartland host the majority, including NRG Stadium in Houston with the highest BaseScore of any venue.
What the data reveals challenges assumptions.
A 13x risk differential between the safest and most dangerous venue
Transit hubs that score higher than the stadiums they serve
Crime patterns that peak exactly when matches kick off
Threat actors ranging from street-level opportunists to state-sponsored cyber operations
Cartel territorial dynamics at three Mexico venues
Search any location to get a free threat assessment in 90 seconds.
Base Operations|World Cup 26 ReportThe largest sporting event in North American history demands the most comprehensive security analysis ever conducted.
Base Operations analyzed 24 months of validated threat data across every FIFA World Cup 2026 host venue.
The tournament spans three nations. Mexico hosts three venues, including Estadio Azteca with the second-highest BaseScore in the tournament.
What is BaseScore?
BaseScore is a 0 to 100 threat score that allows you to compare locations across the globe. BaseScore™ is normalized based on population density, weighted based on crime severity, and standardizes reporting differences. Learn more about our methodology
The Pacific coast hosts four venues from Vancouver to Los Angeles, with BaseScores ranging from 44 to 77.
The Eastern seaboard and heartland host the majority, including NRG Stadium in Houston with the highest BaseScore of any venue.
What the data reveals challenges assumptions.
A 13x risk differential between the safest and most dangerous venue
Transit hubs that score higher than the stadiums they serve
Crime patterns that peak exactly when matches kick off
Threat actors ranging from street-level opportunists to state-sponsored cyber operations
Cartel territorial dynamics at three Mexico venues
Search any location to get a free threat assessment in 90 seconds.
BaseScore by Venue
Source: Base Operations Threat Intelligence
The Rankings
Which stadiums carry the most risk?
Three venues stand out. NRG Stadium leads with a BaseScore of 90, followed by Estadio Azteca (80) and BC Place (77). These are the venues that demand the most security attention.
The middle of the table is crowded. Venues ranked 4th through 12th cluster within a narrow band, making the difference between “moderate” and “high” risk a matter of a few points.
The gap between #Lumen Field and #Estadio BBVA is just 29 points, yet it spans half the table.
The average BaseScore across all 16 venues is 54. Five venues score above 60, placing them in the “High” or “Very High” risk tier.
The top five venues account for a disproportionate share of total threat density across the tournament.
The operational implication is clear: a uniform security posture across all 16 venues would either over-resource the safest locations or leave the riskiest exposed.
BaseScore by Venue
Source: Base Operations Threat Intelligence
The Rankings
Which stadiums carry the most risk?
Three venues stand out. NRG Stadium leads with a BaseScore of 90, followed by Estadio Azteca (80) and BC Place (77). These are the venues that demand the most security attention.
The middle of the table is crowded. Venues ranked 4th through 12th cluster within a narrow band, making the difference between “moderate” and “high” risk a matter of a few points.
The gap between #Lumen Field and #Estadio BBVA is just 29 points, yet it spans half the table.
The average BaseScore across all 16 venues is 54. Five venues score above 60, placing them in the “High” or “Very High” risk tier.
The top five venues account for a disproportionate share of total threat density across the tournament.
The operational implication is clear: a uniform security posture across all 16 venues would either over-resource the safest locations or leave the riskiest exposed.
Stadium vs. Transit Hub BaseScore
Source: Base Operations Threat Intelligence
The Transit Gap
How do nearby transit hubs compare to the stadiums themselves?
Every fan passes through a transit hub. They arrive through rail stations, bus stops, and interchanges that carry their own risk profiles, often different from the venue itself.
Transit hubs carry their own risk. At Lincoln Financial, the transit hub scores 30 points higher than the stadium itself.
The biggest gap: Lincoln Financial's transit hub scores 88 vs. the stadium's 58, a 30-point swing.
The gap is the blind spot. Security plans that focus only on the stadium perimeter miss the risk fans encounter on their way in. Transit corridors demand their own threat assessment and resource allocation.
Stadium vs. Transit Hub BaseScore
Source: Base Operations Threat Intelligence
The Transit Gap
How do nearby transit hubs compare to the stadiums themselves?
Every fan passes through a transit hub. They arrive through rail stations, bus stops, and interchanges that carry their own risk profiles, often different from the venue itself.
Transit hubs carry their own risk. At Lincoln Financial, the transit hub scores 30 points higher than the stadium itself.
The biggest gap: Lincoln Financial's transit hub scores 88 vs. the stadium's 58, a 30-point swing.
The gap is the blind spot. Security plans that focus only on the stadium perimeter miss the risk fans encounter on their way in. Transit corridors demand their own threat assessment and resource allocation.
Incidents by Time of Day
Source: Base Operations Threat Intelligence
The Clock
When does risk peak across tournament venues?
Crime doesn't keep office hours. Understanding when threats concentrate is just as critical as understanding where.
Morning hours are relatively calm. The 6 AM to 2 PM window accounts for the lightest share of total incidents across all 16 venues.
The afternoon holds steady. Incident counts tick upward between 2 PM and 6 PM, but the real shift is still ahead.
Then evening hits. The 6 PM to 6 AM window is where the majority of incidents cluster.
55% of all incidents occur during evening and nighttime hours. The exact window when fans travel to and from matches.
This is when most World Cup matches kick off. The overlap between peak crime hours and peak match scheduling means security operations need to be at full capacity during evenings, not wound down.
Incidents by Time of Day
Source: Base Operations Threat Intelligence
The Clock
When does risk peak across tournament venues?
Crime doesn't keep office hours. Understanding when threats concentrate is just as critical as understanding where.
Morning hours are relatively calm. The 6 AM to 2 PM window accounts for the lightest share of total incidents across all 16 venues.
The afternoon holds steady. Incident counts tick upward between 2 PM and 6 PM, but the real shift is still ahead.
Then evening hits. The 6 PM to 6 AM window is where the majority of incidents cluster.
55% of all incidents occur during evening and nighttime hours. The exact window when fans travel to and from matches.
This is when most World Cup matches kick off. The overlap between peak crime hours and peak match scheduling means security operations need to be at full capacity during evenings, not wound down.
What Lurks Where
Every stadium has a different threat fingerprint
BaseScore doesn't just give you a number. It shows you what's driving the risk. Each threat category receives its own BaseScore from 0 to 100, so you can see exactly what makes each venue different.
NRG Stadium: Theft from Vehicle scores 90. With Burglary and Theft from Vehicle all in the top quintile, property crime defines the security challenge here.
Mercedes-Benz: Theft from Vehicle scores 88. This is the highest concentration of top-quintile categories among all venues.
Estadio Azteca: Regulatory Offenses at BaseScore 97 reflects a fundamentally different risk landscape than the US venues.
This is the value of transparent scoring. You don't just know a venue is risky, you know why. Each venue requires a tailored security posture that matches its specific threat composition, not just its overall score.
What Lurks Where
Every stadium has a different threat fingerprint
BaseScore doesn't just give you a number. It shows you what's driving the risk. Each threat category receives its own BaseScore from 0 to 100, so you can see exactly what makes each venue different.
NRG Stadium: Theft from Vehicle scores 90. With Burglary and Theft from Vehicle all in the top quintile, property crime defines the security challenge here.
Mercedes-Benz: Theft from Vehicle scores 88. This is the highest concentration of top-quintile categories among all venues.
Estadio Azteca: Regulatory Offenses at BaseScore 97 reflects a fundamentally different risk landscape than the US venues.
This is the value of transparent scoring. You don't just know a venue is risky, you know why. Each venue requires a tailored security posture that matches its specific threat composition, not just its overall score.
Seasonal Pattern (Index: 100 = venue average)
Source: Base Operations Threat Intelligence
The Summer Surge
Seasonal patterns that overlap with the tournament window
The tournament window has consequences. The highlighted yellow zone marks June and July, when the World Cup will be played.
Start with NRG Stadium, the highest-risk venue with monthly data. Its trend line reveals clear seasonal peaks during the summer months.
Adding Estadio Azteca and BC Place confirms the pattern. Summer spikes are not isolated to a single city.
With Lumen Field added, the full picture emerges. All four highest-risk venues show elevated incident rates during the tournament window.
June-July aligns with seasonal peaks. This is not coincidence. Warmer months consistently drive higher incident volumes. Security planning must account for this compounding effect: more fans arriving during the highest-risk period of the year.
Seasonal Pattern (Index: 100 = venue average)
Source: Base Operations Threat Intelligence
The Summer Surge
Seasonal patterns that overlap with the tournament window
The tournament window has consequences. The highlighted yellow zone marks June and July, when the World Cup will be played.
Start with NRG Stadium, the highest-risk venue with monthly data. Its trend line reveals clear seasonal peaks during the summer months.
Adding Estadio Azteca and BC Place confirms the pattern. Summer spikes are not isolated to a single city.
With Lumen Field added, the full picture emerges. All four highest-risk venues show elevated incident rates during the tournament window.
June-July aligns with seasonal peaks. This is not coincidence. Warmer months consistently drive higher incident volumes. Security planning must account for this compounding effect: more fans arriving during the highest-risk period of the year.
Organized Crime
Terrorism & Extremism
Cyber & Intelligence
The Threat Landscape
Beyond the BaseScore
The BaseScore quantifies ambient crime risk. But event-level threats: terrorism, organized crime, and cyber espionage require a different lens.
At Mexico venues, Transnational Criminal Organizations define the security landscape.
CJNG maintains territorial control around Estadio Akron. A Sinaloa Cartel facilitator was arrested in Monterrey in October 2025. Assessments identify a medium-confidence risk of kidnapping targeting high-net-worth attendees and a risk of corrupt security personnel infiltration.
“While cartels possess sophisticated capabilities, they generally avoid high-profile attacks that would invite federal scrutiny. The threat is primarily indirect, related to background criminal activity rather than targeted attacks.”
The World Cup is designated a National Special Security Event (NSSE).
This triggers a federal security umbrella across US venues: Secret Service lead, FBI counterterrorism, DHS coordination. Potential actors include ISIS/Al-Qaeda-inspired individuals, domestic violent extremists, and state-sponsored disruptors. Historical precedents (Munich 1972, Paris 2015, Boston Marathon 2013) inform planning.
“As of the assessment date, no specific plot against any venue has been identified. However, the event remains a high-value target for symbolic attacks.”
The digital attack surface is as important as the physical one.
State-sponsored cyber actors are assessed as likely to target high-profile attendees for intelligence collection (High Confidence). Risks include phishing campaigns targeting executive travel, hotel WiFi compromises, and social engineering against support staff. The Boston-area assessment notes “uneven cybersecurity maturity” in regional infrastructure. VPN mandates and TSCM (Technical Surveillance Countermeasures) are recommended at every venue.
These threats operate independently of ambient crime levels. A venue with a low BaseScore can still face significant event-level risk. This is why comprehensive assessment matters.
Organized Crime
Terrorism & Extremism
Cyber & Intelligence
The Threat Landscape
Beyond the BaseScore
The BaseScore quantifies ambient crime risk. But event-level threats: terrorism, organized crime, and cyber espionage require a different lens.
At Mexico venues, Transnational Criminal Organizations define the security landscape.
CJNG maintains territorial control around Estadio Akron. A Sinaloa Cartel facilitator was arrested in Monterrey in October 2025. Assessments identify a medium-confidence risk of kidnapping targeting high-net-worth attendees and a risk of corrupt security personnel infiltration.
“While cartels possess sophisticated capabilities, they generally avoid high-profile attacks that would invite federal scrutiny. The threat is primarily indirect, related to background criminal activity rather than targeted attacks.”
The World Cup is designated a National Special Security Event (NSSE).
This triggers a federal security umbrella across US venues: Secret Service lead, FBI counterterrorism, DHS coordination. Potential actors include ISIS/Al-Qaeda-inspired individuals, domestic violent extremists, and state-sponsored disruptors. Historical precedents (Munich 1972, Paris 2015, Boston Marathon 2013) inform planning.
“As of the assessment date, no specific plot against any venue has been identified. However, the event remains a high-value target for symbolic attacks.”
The digital attack surface is as important as the physical one.
State-sponsored cyber actors are assessed as likely to target high-profile attendees for intelligence collection (High Confidence). Risks include phishing campaigns targeting executive travel, hotel WiFi compromises, and social engineering against support staff. The Boston-area assessment notes “uneven cybersecurity maturity” in regional infrastructure. VPN mandates and TSCM (Technical Surveillance Countermeasures) are recommended at every venue.
These threats operate independently of ambient crime levels. A venue with a low BaseScore can still face significant event-level risk. This is why comprehensive assessment matters.
Preparing
Five principles from 16 venues
The assessments converge on consistent operational guidance despite different threat profiles.
Know Your Transit Corridor
At multiple venues, the nearest transit hub scores significantly higher than the stadium itself. Every assessment recommends dedicated ground transportation for VIPs and protective escorts for staff using public transit.
Time Your Movements
Evening and nighttime hours concentrate the majority of incidents across all venues. The assessments consistently recommend: arrive mid-afternoon (3 to 5 PM), avoid immediate post-match departure, shelter-in-place in VIP suites for 45 minutes after final whistle.
Tailor by Venue
A uniform security posture fails. Houston requires anti-vehicle-crime operations. Atlanta needs violent crime deterrence. Mexico City demands anti-fraud measures and cartel-aware protocols. Vancouver requires property crime task forces. The BaseScore breakdown by category tells you exactly what to prioritize.
Secure the Digital Perimeter
State-sponsored actors are assessed as likely to target high-profile attendees at every venue. Mandate VPN use, prohibit public WiFi, deploy TSCM for sensitive meetings, and brief all personnel on phishing campaigns.
Plan for Three Countries
No single federal structure covers all 16 venues. US venues operate under NSSE protocols. Mexico venues contend with cartel territorial dynamics. Canada venues face different intelligence-sharing frameworks. Cross-border coordination is not automatic. It requires deliberate planning.
This is what data-driven security planning looks like.
Want this level of analysis for your organization?
Assess your hotel, venue, or office near any World Cup stadium.