Lessons in Large-Scale Event Security at Churchill Downs
Share Post
The Kentucky Derby is often called the most exciting two minutes in sports. But behind the scenes, securing an event of that scale is anything but simple. Over Derby Week, more than 150,000 attendees pass through Churchill Downs, which is roughly five times the size of a Super Bowl crowd.
Recognizing that today’s threat landscape demands more than traditional event security, Churchill Downs partnered with Rozin Security to shift toward a more proactive approach centered on behavioral threat detection, intelligence sharing, and early intervention. Drawing on lessons from major events, including Rozin’s support of Super Bowl LII, the team focused on three priorities:
- Identifying risks before they reached the gate
- Connecting information across partners
- Building a security posture that could adapt to changing conditions
Here’s a look inside how they accomplished this:
Strategy: Early, Connected Action
Together, these challenges drove Churchill Downs toward a more connected security model built on early detection, intelligence sharing, and coordinated action.
Building a Network of Partners
In today’s environment, no organization operates independently. Threats move across jurisdictions, agencies, online spaces, and physical environments faster than ever. Security teams that rely on isolated communication or fragmented systems struggle to keep up.
With more than 150,000 attendees and a complex network of stakeholders, Churchill Downs relies on close coordination among local law enforcement, federal agencies, emergency responders, private security teams, transportation providers, and executive protection details. Planning begins more than a year before Derby Week, creating a shared operating picture that helps partners identify risks earlier and respond more effectively.
Led by Director of Security Dustin Clem, Churchill Downs has prioritized collaboration, intelligence sharing, and proactive risk identification—recognizing that effective security starts long before attendees arrive.
As Clem notes:
“The goal is shared. We want them to achieve their goal and enjoy the event safely.”
Moving Detection Beyond the Gate
Churchill Downs also recognized that security cannot begin at the checkpoint. To better understand potential risks, the organization partnered with Rozin Security to conduct physical security assessments and red-team exercises that evaluated the venue from an adversary’s perspective.
At the same time, the organization expanded its focus on behavioral detection, training personnel on SIRA®, Rozin Security’s behavior-based threat detection methodology, to identify suspicious behaviors—not just prohibited items—before individuals reached the venue.
Together, behavioral detection, enhanced physical security measures, and intelligence sharing created a layered approach focused on identifying and mitigating risk as early as possible.
Establishing Real-Time Intelligence Sharing
One of the biggest challenges in securing an event this large isn’t necessarily collecting information. It’s connecting it. Across dispatch systems, incident reports, security requests, threat tips, and law enforcement channels, teams are processing enormous amounts of information in real time. Without centralized systems, critical context can easily get lost.
Churchill Downs uses TIPS (Threat Information Protection System) to centralize threat information, document concerns, and connect related incidents over time. Instead of relying on disconnected emails or informal communication, teams can maintain a complete case history and quickly identify when new information relates to an existing concern.
Someone reported months earlier may resurface again through a separate incident, interaction, or tip. Without centralized systems, those connections can be missed entirely. The challenge isn’t simply gathering information. It’s ensuring information moves fast enough and clearly enough to support real-time decisions.
Result: Better Visibility, Faster Decisions
By combining behavioral detection, intelligence sharing, physical security enhancements, and centralized case management, Churchill Downs created a more proactive security posture. That visibility is critical at large-scale events where conditions can change rapidly, from crowd flow issues and severe weather to emerging threat information.
Technology played an important role by helping teams connect information, surface patterns, and maintain a shared operating picture across a complex environment. But tools alone don’t prevent incidents. Clem adds:
“Nothing is black and white. You have to stay flexible.”
Conclusion
The Kentucky Derby demonstrates a reality many organizations are now confronting: by the time a threat reaches the gate, the opportunity to prevent it may already be shrinking. Modern security starts earlier—with connected intelligence, coordinated partnerships, and the ability to recognize risk before it becomes an incident.
Interested in building a more proactive security program? Connect with our team to learn how organizations are using behavioral detection, intelligence sharing, and threat assessment to identify concerns earlier.
