Choosing hostile environment (HEAT) training for staff going to a high-risk country: what to check
Quick answer, Nov 11, 2026As of 11 November 2026, pick a hostile environment (HEAT) course by the trip, not the brochure. Start from the State Department advisory level and risk indicators for each stop. Then check six modules: advisory reading, kidnap and detention, communications, leaving early, trauma first aid and device security. A course is mitigation, not permission to travel.
Start from the advisory, not the course
Hostile environment awareness training (HEAT) prepares staff for a trip where the risk is higher than normal. The trip sets the syllabus. Read the State Department travel advisory for every stop on the itinerary.
State rates each destination on four levels. Level 3, "Reconsider travel," means "serious risks to safety and security." Level 4, "Do not travel," is "the highest advisory level due to life-threatening risks," and State adds: "The U.S. government may have very limited or no ability to help, including during an emergency" ("Levels 1-4 explained"). The same page defines nine risk indicators, among them Kidnapping or Hostage-Taking (K), Wrongful Detention (D), Unrest (U) and Health (H) ("Risk indicator definitions").
A course worth booking names the level and indicators it was built for. A generic course can still be useful, but it should not be the only preparation for a Level 3 or Level 4 itinerary.
Travel risk management as a whole is the subject of ISO 31030:2021, Travel risk management — Guidance for organizations. Its abstract lists the parts an organization's approach covers: policy; programme development; threat and hazard identification; opportunities and strengths; risk assessment; and prevention and mitigation strategies. Training is one mitigation within that programme.
Six modules, and where each is written
| Module | What staff should leave able to do | Where it is written |
|---|---|---|
| 1. Reading the advisory | Find the level and indicators for each stop, and know the review cycle: every 12 months at Levels 1 and 2, at least every 6 months at Levels 3 and 4 | State, Travel Advisories, "Levels 1-4 explained" |
| 2. Kidnap and detention | Agree one point of contact at home and a proof-of-life protocol before departure | State, High-Risk Areas, "Before you go to a high-risk area"; indicators K and D |
| 3. Communications | Carry a phone that works at the destination, share location with trusted contacts, and enroll in STEP for embassy alerts | Same section; State, STEP, "U.S. embassy and consulate updates and alerts" |
| 4. Leaving early | Know the triggers to leave while commercial flights still run | State, Crisis Response and Evacuations, "What we can do", "What we cannot do" and "Leaving an area in crisis" |
| 5. Trauma first aid | Control severe bleeding until care arrives | DHS, Stop the Bleed (archived page), "Become Empowered"; indicator H |
| 6. Devices and accounts | Use end-to-end encrypted messaging, phishing-resistant sign-in and a carrier PIN, and clear sensitive material from devices and social media | CISA, Mobile Communications Best Practice Guidance (18 December 2024), "General Recommendations" 1, 2, 3 and 5; State, "Before you go to a high-risk area" |
What the sources say each module is for
Leaving early. State's crisis page is blunt: "The best time to leave is before a crisis happens." Under "What we can do," it says: "We always recommend leaving a country while commercial travel is operational." Under "What we cannot do," it says the U.S. government "generally cannot provide in-country transportation during a crisis," and: "We generally do not evacuate or otherwise provide departure assistance to non-U.S. citizens." A course for a mixed-nationality team should cover how each person gets out, not only the U.S. citizens.
First aid. The archived DHS Stop the Bleed page says: "A person who is bleeding can die from blood loss within five minutes." It adds that bystanders "will always be first on the scene." The Health indicator warns that "hospitals, doctors, ambulances, and medical supplies may be low quality or unavailable." Ask who teaches the medical module and what clinical qualification they hold.
Paperwork before the trip. State's "Before you go to a high-risk area" list goes beyond the classroom: share important documents, logins and contacts with loved ones; draft a will and name insurance beneficiaries and power of attorney; leave DNA samples with a medical provider and dental records with family; and: "Make a personal security plan with your employer or host organization." A good course ends with that plan written down.
Devices. CISA wrote its December 2024 guidance for "highly targeted" individuals, and says it applies to all audiences. Where travellers hold specialized roles, NIST CSF 2.0 PR.AT-02 covers awareness and training for "Individuals in specialized roles."
Six questions to ask a provider before you book
- Which advisory level and risk indicators is the scenario written for, and can it be rebuilt around our itinerary?
- Does the course end with each traveller's personal security plan, proof-of-life protocol and home contact on paper?
- Who teaches trauma first aid, and what clinical qualification do they hold?
- How does the evacuation module handle staff who are not U.S. citizens?
- Does the digital module cover the devices and accounts staff will actually carry?
- What changes on a refresher, and how soon after an advisory changes level?
Where training stops and people start
Training prepares the traveller. A protection detail is a separate decision. For that one, see Hiring an executive protection firm for international travel. For a cyber incident on the road, see Choosing a cyber crisis response firm.
An AI assistant can read the current advisory and level for each country with list_travel_advisories on the Distributed Risk MCP server. Distributed Risk arranges hostile environment training with a partner firm that runs it, and protection or medical evacuation and assistance where the trip needs them: brief an advisor.
Questions
Does a HEAT course make a Level 4 trip safe? No. At Level 4, State advises "that U.S. citizens do not travel to the country, or leave as soon as it is safe to do so." Training reduces some risks. It does not change the advisory.
Who on the team needs it? Everyone travelling to the high-risk stop, plus the home contact who would run the proof-of-life protocol. State asks travellers to appoint one family member to that role ("Before you go to a high-risk area").
Is this legal advice? No. This page is a procedural guide drawn from the public record. Counsel decides what your duty-of-care obligations are.