How early recognition and structured readiness shrink risk when seconds matter…

Contributed by Jim Brigham, LCG VP of Risk Management, Former Operations Chief, State of Vermont, Office of Safety and Security

Series context. This is Part 4 of the Mindset Shift series, advancing from personal preparedness toward organizational prevention. Understanding how violent events unfold helps employees and leaders recognize early indicators, intervene sooner, and act decisively when threats materialize. [1]

The Storm Before the Strike: Why Event Anatomy Matters

Every active threat incident begins long before the first act of violence. Federal research consistently shows that attackers progress through identifiable behavioral, logistical, and environmental stages before executing an attack. Recognizing these stages transforms preparedness from reaction to prevention.

The Federal Bureau of Investigation has documented that most active shooters displayed multiple observable warning behaviors leading up to the incident, including grievances, fixation, deterioration in functioning, and interpersonal decline. [2][3] OSHA guidance echoes these findings, emphasizing that hostility, behavioral shifts, and sudden isolation often appear prior to workplace violence. [4]

Despite these warning signs, organizations often rely on reactive models. However, research from FEMA and the United States Fire Administration confirms that active threat incidents unfold rapidly and frequently end before law enforcement can intervene. [5][6] The window for prevention closes quickly after violence begins, making earlier recognition essential.

Understanding how threats develop equips leaders and employees with the practical awareness required to identify concerning patterns, evaluate escalation, and shape the physical and procedural environment to support faster response. This aligns directly with national guidance from the Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency, both of which emphasize proactive detection and environmental readiness. [7]

LCG perspective. The earliest phases offer the most significant opportunity for intervention. Teaching teams to observe patterns and report concerns gives organizations time and distance, two variables that directly correlate with survivability.

The Six Phases of an Active Threat Event

The FBI Behavioral Analysis Unit identifies six recurring phases in active shooter and violent actor incidents. While not every attacker follows each stage, this model represents a defensible framework for evaluating risk escalation and early intervention opportunities. [3]

1. Grievance and Ideation

Violent actors typically begin with a grievance, rooted in perceived injustice or humiliation.
Common indicators include:

• Expressions of hopelessness or anger.
• Fixation on a person, institution, or ideology.
• Social withdrawal or deteriorating interpersonal relationships.

2. Research and Planning

The individual begins to gather information needed to carry out the attack.
Indicators include:

• Inquiries into facility layouts or access points.
• Online research into prior attacks or weapon use.
• Probing or testing organizational boundaries.

3. Preparation and Acquisition

The subject accumulates the tools required to execute the attack.
Indicators include:

• Acquisition of weapons, ammunition, or protective equipment.
• Stockpiling materials or increasing time at firing ranges.
• Secrecy and abrupt behavioral changes.

4. Pre-Attack Leakage

Many attackers communicate intent before acting. FBI data shows that more than half of the leaked violent intentions were shared with someone. [3]
Indicators include:

• Direct or veiled threats.
• Statements suggesting finality or revenge.
• Concerning notes, drawings, or social media content.

5. Attack

Violence begins. FEMA and USFA research indicates that most attacks conclude within minutes, often before first responders arrive. [5][6] In this phase, Run, Hide, Fight training directly governs survivability.

6. Resolution

The incident ends through law enforcement action, subject suicide, or bystander intervention. Post-incident focus shifts to emergency medical aid, evidence preservation, and recovery.

LCG perspective. Each phase offers a distinct intervention window. Organizations that align their behavioral threat assessment programs with these phases dramatically increase their chances of preventing escalation.

Translating Phases Into Preparedness: Organizational Actions

Effective organizations convert threat-phase knowledge into structured, defensible actions consistent with DHS, CISA, OSHA, and FEMA best practices.

Behavioral and Reporting Actions

• Establish confidential and multi-channel pathways for reporting concerns.
• Train supervisors and HR teams to document and escalate pre-incident indicators.
• Stand up a multi-disciplinary threat assessment team using recognized behavioral assessment models.

Physical and Environmental Actions

• Map facility line-of-sight, ingress, and egress for vulnerability analysis.
• Ensure door hardware and barriers function predictably under stress.
• Apply environmental design techniques that increase time and distance during fast-moving incidents.

Procedural Actions

• Develop Emergency Operations Plans that integrate behavioral threat assessment and active threat response.
• Conduct regular scenario-based drills with leaders, employees, and facilities staff.
• Coordinate with local responders to share floor plans, access protocols, and communications standards.

Frameworks, Pitfalls, and Mitigation Strategies

Relevant Frameworks

• FBI Pre-Attack Behavior Framework. [3]
• DHS Behavioral Indicators of Pre-Attack Preparations. [7]
• FEMA Comprehensive Preparedness Guidance emphasizes whole-community readiness. [5]
• OSHA Workplace Violence Prevention Guidelines. [4]

Common Pitfalls

• Treating threat indicators as isolated incidents.
• Overreliance on external responders instead of internal capability.
• Gaps between policy, physical security, and training.

Mitigation Strategies

• Use a layered framework combining behavioral, environmental, and procedural controls.
• Conduct joint exercises to reveal siloed decision paths.
• Update EOPs through recurring after-action reviews.

Quick Checklist

1. Teach employees the six-phase progression of violent events.
2. Build integrated behavioral, environmental, and procedural readiness.
3. Exercise plans regularly to reinforce rapid decision-making.

Final thought

Understanding how active threat events evolve gives organizations a practical pathway to earlier recognition and more effective intervention. When leaders embed this knowledge across operations, employees gain the confidence and capability to act decisively before violence occurs. Time and distance become assets reclaimed through awareness, planning, and practice.

References (endnotes)

[1] Mindset Shift Series Outline, LCG Discovery Internal Planning Document.
[2] Federal Bureau of Investigation. A Study of Active Shooter Incidents in the United States Between 2000 and 2013. https://www.fbi.gov/file-repository/active-shooter-study-2000-2013.pdf/view
[3] Federal Bureau of Investigation. A Study of the Pre-Attack Behaviors of Active Shooters in the United States Between 2000 and 2013. https://www.fbi.gov/file-repository/pre-attack-behaviors-of-active-shooters-in-us-2000-2013.pdf/view
[4] Occupational Safety and Health Administration. Workplace Violence Prevention Guidance. https://www.osha.gov/workplace-violence
[5] Federal Emergency Management Agency. Active Shooter Coordination. https://apps.usfa.fema.gov/pdf/efop/efo48002.pdf
[6] United States Fire Administration. Fire and EMS Considerations for Active Shooter and Mass Casualty Incidents. https://www.usfa.fema.gov/downloads/pdf/publications/active_shooter_guide.pdf
[7] Department of Homeland Security. Behavioral Indicators of Pre-Attack Preparations. https://www.dhs.gov/national-threat-evaluation-and-reporting

This article is for general information and does not constitute legal advice.