Subscribe

Resources / Methodology & approach

Methodology & approach

What Is Horizon Scanning? How to Spot Weak Signals Before They Become Risks

Updated 24 October 2026 16 min read
Horizon scanning

Big changes rarely arrive without warning. The warnings are just small, scattered and easy to dismiss, and horizon scanning is the habit of not dismissing them.

This is a companion to our article What Is Emerging Risk? That one explains what emerging risk is. This one covers how you find it, and how horizon scanning in risk management works in practice. In the Horizon Loop, UFOQ's framework for emerging risk, horizon scanning covers the first two steps: Anchor and Scan.

Executive summary

  1. Horizon scanning is the search for early signs of change. It means collecting specific things that have actually happened and asking what they would mean if they spread. It isn't forecasting, and it isn't reading the news.
  2. Horizon scanning collects signals, not trends. A signal is one dated event from a named source. A trend is a direction you can already measure, and by the time you can measure it, everyone else can see it too.
  3. Horizon scanning works as a repeating process. Set a boundary, collect, record, screen, group signals that share a cause, work out why it's happening, hand it to an owner, and retire what goes nowhere.
  4. Horizon scanning is cheap to start. The best sources are free: regulators, court cases, industry reports, job adverts and conversations with people who do the work. A shared spreadsheet is enough to begin with.
  5. Horizon scanning only pays off when someone acts. A theme that stays in the scanning file has achieved nothing. Every one needs a named owner and a short list of things to watch.

02What is horizon scanning?

Horizon scanning is looking for early signs that something is changing, before the change is obvious.

It's easy to confuse with two things it isn't. Forecasting tries to say what will happen; horizon scanning only records what has already happened and asks what it could lead to. Reading the news tells you what everyone else already knows; horizon scanning looks for the things that haven't made the news yet.

The idea goes back to Igor Ansoff. In 1975 he argued that strategic surprises are usually preceded by faint, early information, and that normal planning systems filter it out because it doesn't look important enough [1]. Many organisations still do exactly that.

Horizon scanning is the deliberate habit of keeping those faint signals, usually called weak signals, long enough to see whether they add up to something.

03A signal is not a trend

If you take one idea from this article, take this one. Much of what goes wrong in horizon scanning starts with mixing the two up.

What it isExample
SignalOne thing that happened, with a date and a sourceFebruary 2024: Hong Kong police report that a finance worker paid out HK$200 million after a video call in which everyone else was a deepfake [2]
TrendA direction you can already measure over timeLosses reported to the FBI's internet crime unit reached USD 16.6 billion in 2024, up 33% on 2023 [3]

Horizon scanning collects signals. Trends come later, once enough signals point the same way.

A lot of scanning programmes collect trends and believe they're scanning. But a trend is visible to everyone by definition. If your scanning file is mostly trends, you've built a news digest, and you're already late.

04What counts as a weak signal, and what doesn't

A signal is evidence about the present, not an opinion about the future. These usually qualify:

  • A first-of-its-kind product or service
  • A draft regulation or public consultation
  • A court ruling that reinterprets an existing rule
  • An unusual funding round or acquisition
  • A patent filing
  • A research result that contradicts something you assumed
  • An incident or near miss with a new mechanism
  • A new player entering your market
  • A job advert for a role that didn't exist two years ago

These usually don't:

  • Forecasts. They're someone's view of the future, not evidence of what's happening now.
  • Opinion pieces with no event underneath them.
  • Restatements of something already well known.
  • Anything that's in the news every day. If everyone knows it, you gain nothing by knowing it too.

That last point matters more than people expect. Scanning files fill up with things everybody already knows, because those are the easiest things to find.

05The horizon scanning process in eight steps

1. Set a boundary

Decide what you're scanning for, and write down what you're not scanning for. Without a boundary you drown: "scan for anything important" produces a pile of interesting articles and no decisions.

A good boundary is specific: changes affecting how we verify who someone is. A bad one is a topic: technology. The best boundaries come from what you depend on. That is the Anchor step of the Horizon Loop: list what the organisation relies on, and the assumption behind each, before you start scanning.

2. Collect

Go through your sources on a fixed schedule and pull out anything that fits the boundary. Aim for quality over quantity. Five to ten good items per category beats a hundred weak ones; you're picking the best, not trying to catch everything.

3. Record

Use the same format every time. Each record should take about two minutes.

FieldWhat goes in it
IDA number
HeadlineOne line, stated as a fact
Date of the eventWhen it happened, not when you found it
SourceThe link, plus the type of source
CategorySocial, technological, economic, environmental or political
What happenedTwo or three sentences
What it challengesWhich of our assumptions it calls into question
If this scaledWhat would happen if this went from one case to many
Related toIDs of other signals

The "if this scaled" field does most of the work. It makes you describe a mechanism instead of bookmarking something interesting. If you can't fill it in, it probably isn't a signal.

4. Screen

Score each signal and keep only the strong ones. Six questions cover it:

  • Is it new? Have we seen this before?
  • Is it credible? How solid is the source?
  • Does it challenge something we believe? And how central is that belief?
  • Could it spread? Is there a path from one case to many?
  • Would it matter? If it spread, how much would it affect us?
  • How soon? Months, years or decades?

The most valuable signals usually score high on challenging a belief and come from sources you don't normally read. Those are exactly the ones your existing filters are built to throw away.

5. Cluster

Group signals that share a cause. UFOQ's working rule: you have a cluster when three or more independent signals share one mechanism.

The word independent matters. Three articles about the same event are one signal, not three, and this is the easiest mistake to make in clustering. Once a cluster has three independent members, give it a name and write down the driver behind it. It's now a theme rather than a pile.

Before a theme moves on, check it against the four tests in our definition of emerging risk. Something has changed; it can reach something you depend on; you haven't yet measured your exposure; and it could change a decision. A theme that fails any test stays in the file or is retired.

6. Interpret

For each theme, answer one question: why is this happening? You've already recorded what happened. What matters now is the driver underneath, because the driver tells you whether it will continue.

7. Hand it over

A theme that stays in the scanning file has achieved nothing. Give it to someone who can act on it, name them, and attach a short list of things to watch. A theme with no owner is still just an observation. In the Horizon Loop, this is where Trace, Size and Own take over.

8. Maintain

Retire signals that are more than two years old and never joined a cluster; they were noise. If you don't retire anything, the file grows until nobody reads it. That is how many scanning programmes quietly die.

06Horizon scanning template: a signal record, before and after

The difference between a useful scanning file and a reading list shows up in the records. Here's the same story logged twice.

Before: a bookmark

FieldEntry
HeadlineDeepfakes are getting scarier
DateThe day we read it
SourceAn opinion column
What it challenges(blank)
If this scaled(blank)

It's a topic, not an event. There's no date that means anything, the source is someone's view, and the two fields that matter are empty because there's nothing specific to say.

After: a signal

FieldEntry
HeadlineFinance worker pays out HK$200 million after a video call with a deepfaked chief financial officer
Date of the eventEarly 2024, reported by Hong Kong police in early February 2024 [2]
SourceHong Kong police briefing, via CNN [2]; the firm was later confirmed as Arup [4]
CategoryTechnological
What happenedAn employee joined a multi-person video call in which every other participant, including the chief financial officer, was a deepfake. He then made 15 transfers worth about USD 25.6 million [4].
What it challengesOur assumption that seeing and hearing a known colleague on a live call confirms who they are
If this scaledAny payment, access or password reset approved over a call becomes an attack route. Call-back and dual-approval controls in finance, treasury and the IT helpdesk would need redesigning.
Related toEarlier voice-cloning fraud signals in the file

The second record names an event, a date and a source someone else can check. More importantly, it says which belief is under threat and what would happen if this became common. That's what lets it join a cluster later, and what gives an owner something to act on.

07Horizon scanning in practice: the signals before the Strait of Hormuz closure

On 2 March 2026, an adviser to the commander of Iran's Revolutionary Guards declared the Strait of Hormuz closed [5]. To many organisations it felt sudden. The signals had been on public record for about eight months.

Closure threats were not new, so another threat on its own would have scored low on "is it new?" What changed in June 2025 was that different actors started treating closure as a real option. A team scanning with a boundary like disruptions to our imported inputs could have logged these:

DateSignalWho acted
Mid-June 2025Shipping sources report commercial vessels avoiding Iranian waters around the strait [6]Ship operators
21 June 2025Iraq's oil minister says the ministry has alternative export plans ready if the strait is closed [7]An exporting government
22 June 2025Iran's parliament reportedly backs closing the strait, leaving the final decision to the Supreme National Security Council [6]Iran's legislature

These pass the independence test: three different actors, three separate decisions, one shared mechanism. Closure was moving from rhetoric to something people were planning around. The driver, the answer to "why is this happening?", was open military conflict. Israel began strikes on Iran on 13 June 2025 [8], and the United States struck Iranian nuclear sites on 22 June [9].

The "if this scaled" field is where the value lies. For a food producer, it might have read: if the strait closes, Gulf fertiliser stops reaching us on normal routes. Check how much of our supply comes from there. That's a question you can answer in a week, and one that turned out to matter. When the closure came, the United Nations Conference on Trade and Development (UNCTAD) estimated that about a third of the world's seaborne fertiliser trade passed through the strait [10].

None of these signals predicted the date. What they offered was eight months to find out where your fertiliser came from, line up alternatives, and name someone to watch transit counts and supplier lead times. The Horizon Loop follows the same case through every step, to an owned and dated call.

08Where to look: five tiers of sources

Sources differ mostly in how far you can trust them and how early they are. Ranked by trust:

TierSourcesWhy use themWatch out for
1. OfficialRegulators and supervisors, draft laws and consultations, court cases and prosecutions, police and cybercrime agenciesFree, authoritative and dated. Regulators publish rarely, so almost everything they publish is a signal. Compliance teams call this regulatory horizon scanning.Slow. By the time a rule is final, it's no longer early.
2. Industry bodiesReinsurers' emerging risk reports such as Swiss Re's SONAR, the CRO Forum Emerging Risk Initiative, Lloyd's research, your sector's threat-sharing bodyFree and professionally curated, written for exactly this purposeBroad by design. Translate them to your own business.
3. Early capabilityAcademic preprints and conference papers, patent filings, funding rounds, job adverts, conference agendasThis is where you see things first. Money and hiring move before capability does.Lots of noise. Most early research never reaches the real world.
4. Vendor researchReports from security, data and consulting firmsThey see across many customers, which nobody else canOften written to sell something. Use for direction, never for size.
5. PeopleInvestigators, engineers, regulators, suppliers, frontline staffThe best source, and the cheapestNeeds a habit of asking, and a way to record what you hear

A few of these deserve more attention than they get:

  • Court cases. A conviction tells you a method worked well enough to be worth prosecuting, and the judgment often describes exactly how it worked.
  • Job adverts. When companies start hiring for a role that didn't exist before, someone decided it was needed.
  • Conference agendas. Compare this year's sessions with last year's. The new sessions are a ready-made scan.
  • Conversations. Ten good conversations a year are worth more than most subscriptions. Ask one question: what have you seen in the last six months that surprised you?

With vendor research, read the method page first, separate what was measured from what was projected, and ask what the vendor is selling. A report that concludes the vendor's own product is urgently needed isn't independent evidence.

Source habits

  • Record the type of source, not just the link. Regulator, court, academic, vendor or press. You'll want to weigh them differently later.
  • Date the event, not the article. One event has one date, however many times it's written about.
  • Don't let a single secondary source carry a material claim. If it's going to drive a decision, find the original.
  • Prefer the boring source. The findings that change minds usually come from dull datasets, not headline cases.

09How it runs: a simple cadence

Horizon scanning works as a routine, not a project. Most of the effort is small and regular.

WhenWhatTime
WeeklyCheck your feeds and log anything that qualifies. Nothing more.Minutes
MonthlyReview new signals as a group, retire stale ones, note clusters formingA short meeting
QuarterlyRe-cluster, update what you're watching, and brief whoever needs to knowHalf a day
AnnuallyRebuild: revisit the boundary and check your sources still workTwo days

Start with a shared spreadsheet. As a rule of thumb, buy horizon scanning tools only when the spreadsheet visibly breaks, usually past a few hundred items or five contributors. Buying a platform first is the classic mistake: it gives you more volume without more judgement, and judgement is the part that's scarce.

10From signal to risk: where horizon scanning fits

Horizon scanning is the first part of a longer path. A signal becomes a cluster, the cluster passes the four tests, and it becomes an emerging risk once someone owns it.

  1. Signal
  2. Cluster
  3. Emerging risk: passes the four tests, then traced, sized and owned
  4. Known risk that can be measured and priced

Horizon scanning owns the first two stages. The Horizon Loop takes a cluster through the third. It traces how the change would reach you, sizes it with a stated confidence level, and names an owner. From there, normal risk management takes over once the risk is measurable and priced.

The international guidance on emerging risk points the same way. Published summaries of ISO/TS 31050 describe a repeating cycle of framing, collecting and analysing, interpreting, and turning the result into intelligence for decisions [11]. Horizon scanning is how that cycle is carried out in practice.

Themes are also good raw material for scenario planning. Each driver you've written down is a question about which way things could go, and a handful of them is enough to build a small set of scenarios.

Scanning vs watching

The two are often confused, and you need both.

Scanning is open. You don't know exactly what you're looking for, so you cast wide and see what turns up.

Watching is targeted. You've already decided what matters, picked specific indicators, and you check them on a schedule.

Scanning finds the issue; watching tells you whether it's arriving. A scanning programme with no watchlist never turns into action, and a watchlist with no scanning only tracks what you already thought of.

11Why horizon scanning programmes fail

The failures are predictable, and most come from treating scanning as reading rather than as a process with an end point.

  • No boundary. You drown in interesting material and make no decisions.
  • Collecting what everyone knows. The file fills up with news, and nothing in it is early.
  • Treating volume as success. "We logged 400 signals this quarter" isn't an achievement. It's a warning sign.
  • No owner at the end. Things get spotted, discussed and forgotten.
  • Never retiring anything. The file becomes unreadable and people stop opening it.
  • Buying the tool first. You get more input with the same judgement, and the signal-to-noise ratio gets worse.
  • One person's hobby. When they leave, it stops. It needs to be part of someone's role, not their enthusiasm.
  • Confusing signals with trends. In our experience, the most common failure of all. If everything in your file is a trend, you've built a news digest.

12Six tests of a working horizon scanning programme

Give a new programme a year, then check it against these six questions:

  1. Did we spot at least one thing before it was widely discussed?
  2. Did our risk register change because of something we found?
  3. Does at least one theme have a named owner outside the scanning team?
  4. Can we show the source and date for every claim we've made?
  5. Have we retired roughly as much as we've added?
  6. Could someone who wasn't involved read a scan record and understand it?

If none of these is true after a year, the programme isn't working, and no amount of extra tooling will fix it.

For what a good entry looks like once a theme reaches the risk register, see the register entry in the Horizon Loop.

13Conclusion

Horizon scanning isn't about predicting what happens next. It's about noticing what has already happened, while it's still small, and deciding whether it matters to you.

The method fits in a few lines. Collect things that actually happened. Write down what each one would mean if it spread. Group the ones that share a cause. Hand those groups to someone who can act. Retire the rest.

Everything else is detail, and the detail mostly exists to stop you drifting back into reading the news.

UFOQ scans for signals like these every week and traces them through their first-, second- and third-order impacts. Read the latest Weekly Risk Foresight.

Further reading

UFOQ

Standard

  • ISO/TS 31050:2023, Risk management — Guidelines for managing an emerging risk to enhance resilience.

Free sources worth subscribing to

Background

See every trend in Risk Foresight

All 32 sectors, every trend traced three orders deep, with the signals behind each one.

See what's included

14Frequently asked questions

What is horizon scanning?

Horizon scanning is the regular search for early, weak signals of change that could affect an organisation. It collects specific, dated events and asks what each would mean if it spread, so that emerging risks are found before they reach the risk register.

What is a weak signal?

A weak signal is an early piece of evidence that something may be changing, such as a first-of-its-kind incident, a court ruling or a new kind of job advert. It's "weak" because it's easy to miss or dismiss, not because it's unimportant.

How is horizon scanning different from forecasting?

Forecasting tries to say what will happen. Horizon scanning records what has already happened and asks what it could lead to. A good scan gives you several possibilities and things to watch, not a single prediction.

What's the difference between a signal and a trend?

A signal is one dated event from a named source. A trend is a direction you can already measure over time. Horizon scanning collects signals; trends appear later, once enough signals point the same way.

How often should we scan?

Weekly for collecting, monthly for reviewing, quarterly for re-clustering and briefing, and once a year to rebuild the boundary and sources. The weekly step should take minutes, not hours.

Do we need horizon scanning tools or software?

Not at the start. A shared spreadsheet works until you have a few hundred items or more than about five contributors. Buying a platform first tends to add volume without adding judgement.

Who should do horizon scanning?

It works best as a named part of someone's role, usually in risk or strategy, with contributors from operations, procurement and other teams. If it depends on one enthusiast, it stops when they leave.

What is the difference between scanning and monitoring?

Scanning is open: you don't know what you're looking for, so you cast wide. Monitoring, or watching, is targeted: you track specific indicators you've already chosen. Scanning finds the issue; monitoring tells you whether it's arriving.

Is horizon scanning the same as environmental scanning?

Largely, yes. Environmental scanning is the older term from strategy textbooks, usually organised around political, economic, social and technological change. Horizon scanning is the more common term in government and risk management, and it puts more weight on early, weak signals.

How does horizon scanning relate to ISO 31050?

ISO/TS 31050 is the international guidance on managing emerging risk. Published summaries describe a repeating cycle of framing, collecting and analysing, interpreting, and producing intelligence for decisions. Horizon scanning is how that cycle is carried out in practice.

How does horizon scanning fit into the Horizon Loop?

It covers the first two steps, Anchor and Scan. The remaining steps, Trace, Size, Own and Review, turn what scanning finds into owned risks and a scored record of calls.

How do we know horizon scanning is working?

After a year, ask three questions. Did you spot anything before it was widely discussed? Did your risk register change because of something you found? And does at least one theme have an owner outside the scanning team?

15References

All sources accessed 24 October 2026. Evidence current as of October 2026.

[1] Ansoff, H. I. (1975). "Managing strategic surprise by response to weak signals". California Management Review, 18(2), 21–33. DOI 10.2307/41164635. https://cmr.berkeley.edu/1975/02/18-2-managing-strategic-surprise-by-response-to-weak-signals/

[2] CNN (2024). "Finance worker pays out $25 million after video call with deepfake 'chief financial officer'". CNN, 4 February 2024. https://edition.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk

[3] FBI (2025). "The FBI Released Its Internet Crime Report 2024". FBI Atlanta Field Office, 23 April 2025. https://www.fbi.gov/contact-us/field-offices/atlanta/news/the-fbi-released-its-internet-crime-report-2024

[4] CNN (2024). "British engineering giant Arup revealed as $25 million deepfake scam victim". CNN, 16 May 2024. https://edition.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk

[5] MI News Network (2026). "Iran's IRGC Declares Strait of Hormuz Closed, Warns It Will Set Ships Ablaze If They Attempt Transit". Marine Insight, 3 March 2026. https://www.marineinsight.com/shipping-news/irans-irgc-declares-strait-of-hormuz-closed-warns-it-will-set-ships-ablaze-if-they-attempt-transit/

[6] The New Arab (2025). "Iran's top security body to decide on Hormuz closure after parliament approval, Press TV reports". The New Arab, 22 June 2025. https://www.newarab.com/news/iran-mulls-hormuz-closure-after-parliament-approval

[7] PUKmedia (2025). "Iraq Has Oil Export Alternatives if Strait of Hormuz Closes, Says Oil Minister". PUKmedia, 21 June 2025. https://pukmedia.com/EN/Details/78401

[8] NPR (2025). "Israel launches 'preemptive strikes' on Iran nuclear program". NPR, 13 June 2025. https://www.npr.org/2025/06/12/nx-s1-5431956/israel-strikes-iran-and-braces-for-retaliation

[9] Associated Press (2025). "U.S. strikes 3 Iranian sites, joining Israeli air campaign against nuclear program". AP via WBEZ, 21 June 2025. https://www.wbez.org/nation-world/2025/06/22/u-s-strikes-3-iranian-sites-joining-israeli-air-campaign-against-nuclear-program

[10] UNCTAD (2026). Strait of Hormuz Disruptions: Implications for Global Trade and Development. UNCTAD, 10 March 2026. https://unctad.org/system/files/official-document/osgttinf2026d1_en.pdf

[11] WTW (2024). "ISO 31050: introducing the risk intelligence cycle for emerging risks". WTW, February 2024. https://www.wtwco.com/en-gb/insights/2024/02/iso-31050-introducing-the-risk-intelligence-cycle-for-emerging-risks

See where change leads before it reaches you.

UFOQ analyses the trends already shaping 32 sectors, and traces their impact three orders deep.