Targeted Violence Prevention Begins With Recognition, Not Reaction

The Missed Window 

Three people saw something. None of them knew the others had seen it too. 

A supervisor had documented two complaints about a former employee’s behavior in the weeks following a termination: a pattern of grievance-focused statements, references to unfair treatment, and one comment, noted briefly in an email and never escalated, about getting even. A security coordinator had flagged an unusual access attempt on a system the individual no longer had authorization to use. And a coworker from a different department had mentioned to a colleague, in passing, that the former employee had been asking specific questions about shift schedules and who worked late. 

Taken alone, each observation fell below the threshold anyone felt comfortable escalating. Taken together, they formed the outline of a threat that was already moving. 

The organization had response plans. They had trained for it. What they had not built was a system to connect what three different people saw, in three different parts of the organization, into a single, reviewable picture. 

That is where prevention failed. 

Prevention Begins Left of Bang 

In their work on combat tracking and human behavior, Patrick Van Horne and Jason Riley built a framework around a single, clarifying distinction. There is the bang — the moment the destructive event occurs. And there is everything before it. Left of bang is where indicators live, where patterns form, and where the initiative still belongs to the people who are paying attention. Right of bang, the initiative has transferred to the attacker. The organization is reacting to terms it did not set. 

Van Horne and Riley were direct on this point: most conventional training focuses on right-of-bang response, but true prevention depends on the period before impact: identifying the pre-event indicators that allow for intervention before the attack ever occurs. That framework originated in combat environments, but they applied it explicitly to civilian, law enforcement, and organizational settings, noting that the behavioral indicators remain consistent regardless of context. 

Most organizations have invested heavily in the right side of that line. Active shooter response protocols. Emergency communications systems. Medical kits staged near exits. Evacuation plans reviewed annually. These investments matter. When prevention fails, response capability determines who survives. But a right-of-bang capability, however well developed, means the attacker has already acted. The organization is executing a contingency rather than preventing a crisis. 

Prevention is left of bang. And left of bang is where most organizations are underinvested. 

Research from the U.S. Secret Service National Threat Assessment Center (NTAC) is unambiguous on this point. In its analysis of 180 mass attackers in 173 mass attacks in public spaces between 2016 and 2020, NTAC found that 76% of attackers exhibited behaviors that elicited concern in others or shared concerning communications prior to their attacks. In nearly every one of those cases (96%), the warning signs were visible to informal community systems: family members, peers, coworkers, bystanders. In 56% of cases, a formal system such as law enforcement, an employer, or school staff also had access to relevant information. Yet in nearly one-quarter of cases where someone observed an objectively concerning behavior, no discernible action was taken to report or intervene. (U.S. Secret Service, NTAC, Mass Attacks in Public Spaces: 2016–2020, 2023.) 

In its analysis of targeted school violence, NTAC found that 100% of attackers exhibited concerning behaviors before their attacks, and 77% either threatened their targets or communicated their intent to carry out an attack. In two-thirds of those cases, the communications gave some indication of imminence. (U.S. Secret Service, NTAC, Protecting America’s Schools, 2019.) NTAC has also applied its behavioral threat assessment principles beyond schools, including workplaces, public spaces, and community organizations. The problem, in case after case, was not that no one saw anything. The problem was that what was seen was never reported, never documented, or never connected across the people who each held a piece of the picture. 

The data makes the prevention gap visible. The response infrastructure exists. What is missing, in organization after organization, is the left-of-bang capability: the culture, the process, and the leadership climate to surface and connect what people are already seeing. 

What Recognition Looks Like in Practice 

Targeted violence is rarely impulsive. Research and operational experience both support the understanding that it typically follows a pathway: a progression of grievance, ideation, research, planning, and preparation before an act occurs. That pathway takes time. And during that time, indicators are often visible. 

Recognition means knowing what to look for and creating the conditions under which people will report what they observe. 

Pre-incident indicators vary by context, but recurring patterns include: 

• Behavioral change: a notable shift from baseline conduct, attitude, or demeanor. 

• Expressed grievance. Sustained complaints about perceived injustice, unfair treatment, or wrongdoing by an individual or organization. 

• Violent or unusual interests: an excessive or inappropriate fascination with violent topics, prior attacks, extremist content, or specific individuals or groups perceived as responsible for a grievance. 

• Concerning communications. Verbal, written, electronic, or online statements indicating violent intent, expressions of grievance, or threats toward others. These are not always direct threats; many are indirect communications of hopelessness, fixation, or intent. NTAC found this pattern in 77% of school attackers and 66% of public space attackers. 

• Stalking and harassing behavior: a pattern of making others feel bullied, stalked, persecuted, or threatened, often directed at a romantic partner, coworker, classmate, or neighbor. NTAC identified this pattern in 22% of public space attackers. 

• Weapons-related actions. Researching explosives, acquiring or brandishing weapons, or communicating an unusual obsession with weapons or prior attacks. NTAC found this pattern in 71% of school attackers and 21% of public space attackers. 

No single indicator constitutes a threat. The work of recognition is to identify patterns across time and context, not to treat isolated observations as proof of intent. NTAC research consistently shows that targeted violence is preceded by a progression of behaviors, and that early intervention at any point in that progression can disrupt the pathway before it reaches an act of violence. (U.S. Secret Service, NTAC, Mass Attacks in Public Spaces: 2016–2020, 2023; Protecting America’s Schools, 2019.) Disciplined recognition is not paranoia. It is organized, structured observation. Applied consistently and reviewed systematically. 

Why Organizations Miss the Signs 

The failure is rarely one of visibility. It is one of connection. 

In most organizations, information about a potential threat is distributed across departments that rarely communicate with each other. Human resources holds documentation of performance concerns and termination records. Security holds access logs and incident reports. A direct supervisor knows about behavioral changes. A peer heard something concerning in a hallway conversation. 

Each of these represents a fragment of the same emerging threat picture. But without a mechanism to collect, compare, and assess dispersed observations, each fragment remains isolated, and below any single person’s threshold for escalation. Several organizational conditions make this worse: 

• Unclear reporting thresholds. Employees do not know what rises to the level of a reportable concern. 

• Fear of overreacting: concern about making a false accusation or damaging someone’s reputation discourages reporting. 

• Inconsistent supervision. Behavioral changes are more likely to be noticed and documented in some units than others. 

• Absence of a review mechanism: even when reports are made, there is no structured process to assess them in context or across departments. 

The intelligence failure is not one of access. It is one of architecture. The 2025 RAND national survey of behavioral threat assessment programs found that while 97% of K–12 public schools engage in some form of threat assessment, only 49% have written standard operating procedures for how their program functions, only 31% use a standardized approach to reviewing and assessing referred cases, and 43% have a regular meeting schedule. Nearly a quarter of principals surveyed did not know whether their school even had a defining policy document for their program. The gap between having a prevention system on paper and having one that functions consistently is significant. And it is not unique to schools. Organizations across sectors that have not built a deliberate process for collecting, documenting, and fusing weak signals will continue to miss the picture that was available to them. (Diliberti, M. K., et al., The State of Behavioral Threat Assessment and Management in K–12 Public Schools, RAND Corporation, 2025.) 

Building a Reporting Culture That Works 

Recognition without reporting is incomplete. An organization can train its people to identify pre-incident behavioral indicators, but if those observations never surface to someone with the authority and process to assess them, the system fails at the second step. 

NTAC research on why bystanders who observed concerning behavior did not report offers a direct window into the barriers that suppress reporting in practice: people believed the threat was a joke or an empty statement; they thought the situation had already resolved itself; they feared retaliation; they planned to handle it personally; or they assumed someone else would take action. (U.S. Secret Service, NTAC, Protecting America’s Schools, 2019.) Each of these is a predictable, addressable failure point. 

A functional reporting culture requires more than a phone number on the wall. It requires: 

• Clear channels: employees must know specifically what to report, to whom, and by what method. 

• Defined thresholds. Training should help people understand what kinds of behavior or statements constitute a reportable concern, so that uncertainty does not suppress reporting. 

• Documentation standards: reports should be recorded in a consistent format that supports later review and comparison. 

• Consistent review. Every report deserves a structured response, even if that response concludes no further action is warranted. 

• Feedback loops: when people report concerns and never hear anything, they stop reporting. Even a simple acknowledgment that a concern was received and reviewed builds trust in the system. 

One additional framing matters: reporting should be positioned as risk recognition, not accusation. The goal is not to punish or label someone. The goal is to ensure that an organization has the information it needs to assess whether intervention is appropriate. That distinction reduces the friction that prevents people from speaking up. 

Leadership Creates the Prevention Climate 

The strength of a reporting culture is a direct function of leadership behavior. Leaders determine whether weak signals are reviewed or dismissed. They set the tone for whether documentation is treated as a bureaucratic burden or as a protective discipline. They decide whether HR, security, and operations function as separate silos or as a coordinated prevention system. 

Leaders who want to build a genuine prevention capability should be operating on the following principles: 

• Establish multidisciplinary coordination. Create a standing mechanism for HR, security, legal, and operational leadership to share relevant information and assess concerns together. 

• Set documentation standards: require that behavioral concerns, unusual access events, and relevant observations are recorded, dated, and retained. 

• Train threshold judgment. Help supervisors and employees understand what warrants escalation and what the escalation process looks like. 

• Protect early reporters: make clear that reporting a concern in good faith will not result in professional or personal consequences, even if further assessment concludes no threat exists. 

• Review consistently. Apply the same standard of review to every reported concern, regardless of who the subject is or how unlikely the risk may appear. 

The organizations that prevent targeted violence are not the ones with the most sophisticated response protocols. They are the ones that have built a culture in which weak signals surface, get reviewed, and receive a proportionate response before the situation escalates. 

Recognition is a force multiplier. It creates time. It preserves options. It allows for intervention before the pathway to violence reaches a point where only response remains. 

From Observation to Intervention 

Recognition and reporting create the conditions for intervention. But intervention requires a repeatable process — one that moves observations from raw report to structured assessment to coordinated action. 

A functional process generally includes the following phases, consistent with NTAC’s behavioral threat assessment guidance described in its 2024 guide for law enforcement and organizations: (U.S. Secret Service, NTAC, Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence, October 2024.) 

• Document. Record the concern with specificity: what was observed, by whom, in what context, and when. 

• Assess context: review the report in the context of other available information, including prior reports, access records, and known behavioral history. 

• Coordinate internally. Bring the relevant parties together, including HR, security, legal, and operational leadership, to share information and build a complete picture. 

• Intervene appropriately: intervention should be proportionate to the assessed level of concern; options range from a supervisory conversation to a formal threat assessment, a wellness referral, or involvement of law enforcement. 

• Monitor when warranted. Some situations do not require immediate intervention but do require continued observation; a structured monitoring process ensures that new indicators are captured and assessed. 

The goal of this process is to interrupt movement along the pathway to violence before it reaches the terminal phase. Early intervention — even an informal check-in or a supervisory conversation — can disrupt that progression without the organization ever reaching a response scenario. 

Recognition Is Where Prevention Begins 

Response capability saves lives. No organization should be without it. 

But response is the last available option, not the primary prevention strategy. By the time an organization is executing its emergency protocols, the window for prevention has already closed. 

That window opens earlier: in the behavioral change a supervisor noticed but did not escalate, in the access anomaly that was logged but never reviewed, in the comment a coworker heard and did not know what to do with. Prevention is possible when organizations build the systems to surface those observations, connect them across silos, and assess them before the situation reaches a point where only reaction remains. 

Most organizations are better prepared to react than to recognize. Closing that gap is not a technology problem. It is a leadership and culture problem — and it is solvable. 

Prevention is not a luxury. It is a leadership mandate. 

References 

1. Diliberti, M. K., Moore, P., Jackson, B. A., Morris, K., Buckland, W., Alathari, L., Driscoll, S., Drysdale, D., & Glidden, J. (2025). The State of Behavioral Threat Assessment and Management in K–12 Public Schools: Findings from a 2025 American School Leader Panel Survey (Report No. RR-A3658-1). Homeland Security Operational Analysis Center/RAND Corporation. 
2. U.S. Secret Service, National Threat Assessment Center. (2024, October). Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence. 
3. U.S. Secret Service, National Threat Assessment Center. (2023). Mass Attacks in Public Spaces: 2016–2020. 
4. U.S. Secret Service, National Threat Assessment Center. (2019). Protecting America’s Schools: A U.S. Secret Service Analysis of Targeted School Violence. 
5. U.S. Secret Service, National Threat Assessment Center. (2018, July). Enhancing School Safety Using a Threat Assessment Model: An Operational Guide for Preventing Targeted School Violence. 
6. Van Horne, P., & Riley, J. (2014). Left of Bang: How the Marine Corps’ Combat Hunter Program Can Save Your Life. Black Irish Entertainment.