Signals Before the Event: Recognizing Threat Indicators Without Chasing False Alarms
Contributed by Jim Brigham, LCG VP of Risk Management, Former Operations Chief, State of Vermont, Office of Safety and Security
Targeted violence rarely begins when someone produces a weapon. It is often the end of a developing process involving grievance, ideation, planning, preparation, and movement toward a target. The challenge is recognizing meaningful escalation without treating every angry comment, personal crisis, or unpopular belief as a threat.
There is no single profile of a violent actor. Behavioral threat assessment, therefore, focuses on what a person is doing—not on appearance, identity, diagnosis, political views, or personal associations. Relevant indicators may include increasing fixation, repeated boundary violations, threatening communications, target research, weapons acquisition, surveillance, sudden desperation, or statements portraying violence as necessary or inevitable. No single indicator proves intent; the concern comes from context, combinations of behavior, and escalation over time.
One particularly important indicator is “leakage”; when someone intentionally or unintentionally communicates violent thoughts, intentions, fantasies, or plans. Leakage may appear in a conversation, a text message, a social media post, a journal, artwork, a video, or a warning to another person. It may be dismissed as venting, dark humor, or attention-seeking, but attention-seeking and genuine risk are not mutually exclusive. The appropriate response is neither panic nor automatic punishment. It is reporting, documentation, assessment, and continued evaluation.
When I worked for the State of Vermont, our team applied this principle by developing the online Safety and Security Incident Reporting system, known as SSIR. The system empowered every state employee to report threatening behavior or security concerns directly, without first obtaining supervisory approval. Employees were trained to recognize concerns and encouraged to report them rather than determine for themselves whether a situation was serious enough to warrant investigation.
From its implementation through the conclusion of my state service, SSIR received more than 1,000 reports annually. Reports were reviewed and investigated by a trained team and, when appropriate, resulted in referrals to law enforcement, mental health agencies, social service providers, or other resources. Cases were documented, monitored, and continually reevaluated as circumstances changed. A report did not mean someone was labeled dangerous; it meant that potentially important information would not remain isolated or disappear within a supervisory chain.
Our team also worked directly with affected employees through personal safety planning. Individual reports frequently prompted reassessments of state offices and facilities, resulting in improvements to access control, surveillance, duress alarms, reception areas, emergency procedures, and other integrated security measures. Reporting trends also contributed to agency-wide training in active-threat response, de-escalation, CPR, Stop the Bleed, and personal safety. SSIR remains operational today.
This illustrates the difference between threat assessment and profiling. Profiling attempts to identify what a dangerous person looks like. Threat assessment examines observable behavior, context, escalation, capability, and movement toward violence. Its purpose is not to predict the future with certainty, but to determine whether intervention or continued monitoring is warranted.
The signal before an event is rarely one dramatic warning. More often, different people observe separate pieces of concerning behavior at different times. Prevention becomes possible when employees know what to report, have a trusted way to report it, and know that trained professionals will evaluate the information responsibly.
Employees cannot report what they have not been trained to recognize, and an organization cannot assess information it never receives.
