The investigation into and search for the masked gunman who stalked and killed the head of UnitedHealthcare has moved into its third day. Possible leads have emerged about his travel before the shooting and a message scrawled on ammunition found at the crime scene.

Here's the latest:

Police and federal agents have been collecting information from Greyhound in an attempt to identify the suspect and are working to determine whether he purchased the ticket to New York in late November, a law enforcement official said.

Investigators were also trying to obtain additional information from a cellphone recovered from a pedestrian plaza through which the shooter fled.

The fatal shooting of Brian Thompson while walking alone on a New York City sidewalk has put a spotlight on the widely varied approaches companies take to protect their leaders against threats.

Experts say today's political, economic and technological climate is only going to make the job of evaluating threats against executives and taking action to protect them even more difficult, experts say.

Some organizations have a protective intelligence group that uses digital tools such as machine learning or artificial intelligence to comb through online comments to detect threats not only on social media platforms such as X but also on the dark web, says Komendat. They look for what's being said about the company, its employees and its leadership to uncover risks.

? Read more about the steps companies take to protect their leadership

Police said Thursday they found a water bottle and protein bar wrapper from a trash can near the scene of the ambush and think the suspect bought them from a Starbucks minutes before the shooting. The items were being tested by the city's medical examiner.