Threat Assessment: How Targeted Violence Risk Is Evaluated
Author: Ukrainian Psychological Hub · Published: October 11, 2026 · Editorial Policy
Threat assessment is a structured process for examining concerning behavior, evaluating the possibility of targeted violence, and choosing actions that can reduce the danger. In American schools, workplaces, universities, health care systems, and public safety agencies, it is frequently called behavioral threat assessment and management (BTAM). A multidisciplinary team identifies a concern, checks the evidence, develops a situation-specific formulation, intervenes proportionately, and revisits the case as circumstances change.
The key question is what the person is doing, what the information reliably establishes, what might change the situation, and which preventive steps are justified. Threat assessment does not determine that someone will attack, establish a psychiatric diagnosis, or decide criminal guilt. The FBI's Making Prevention a Reality guide and the U.S. Secret Service school safety guide frame this as an evidence-led prevention and management task.
This guide explains how threat assessment works, what research actually supports, how teams interpret possible warning behavior, why rare events frustrate numerical prediction, what professional and legal safeguards apply, and how institutions should measure the outcomes and unintended effects of their programs. The discussion focuses on U.S. practice while explicitly separating psychological evidence from jurisdiction-dependent law.
What Is Threat Assessment?
Threat assessment examines whether verified information suggests a developing possibility of violence toward an identifiable person, group, place, or institution, and how that possibility could be reduced. Targeted violence is violence directed toward a selected target. In a referral, the alleged target may be an individual, school, workplace, government office, congregation, or other location. The definition and legal significance of a threat vary with the setting.
Borum, Fein, Vossekuil, and Berglund (1999) described the threat assessment approach developed through U.S. Secret Service protective intelligence. Their framework emphasized investigating behavior, intention, capacity, circumstances, and intervention opportunities. It is particularly useful because it asks about supported facts rather than attempting to recognize a supposedly distinctive violent personality type.
Assessment and management form one continuous process. Assessment determines what is currently known, which competing explanations remain plausible, and what reasonable concern follows. Management addresses factors that can be changed, coordinates protection and support, and specifies the conditions for further review. Department of Homeland Security guidance describes behavioral threat assessment and case management as a collaborative prevention approach.
A team may conclude that a report originated in misunderstanding, a genuine but low-immediacy conflict, a distressing situation requiring support, or a credible developing safety concern. The process needs room for all these outcomes. Its credibility depends on the willingness to correct initial assumptions and reduce restrictions when evidence no longer supports them.
How Is Threat Assessment Different From Violence Risk Assessment?
General forensic violence risk assessment often estimates the likelihood or relative risk of particular violent outcomes during a specified period, sometimes in correctional or mental health populations. Targeted threat assessment focuses on a developing case involving a possible target, the person's observed behavior, means and opportunity, and immediate management decisions. Both rely on evidence, but the populations, time horizons, endpoints, and decision contexts differ.
A validated prediction about general institutional aggression cannot automatically be used to estimate the likelihood of a mass attack or an assault against an identified professor. Violence-related outcome definitions and referral pathways may be very different. For psychometric validity, false positives, and population limits in the wider field, see Violence Risk Assessment: What It Can Predict and Where It Fails.
Threat assessment also differs from emergency response. When there is a current or imminent danger, contacting emergency services and taking immediate protective action take priority. A review team can inform subsequent management, but meetings and routine assessment procedures are not substitutes for an urgent response.
Criminal investigation asks whether particular actions violate a criminal law and what admissible evidence establishes those actions. Threat assessment can inform safety management without answering the legal question of guilt. A behavioral observation, a risk factor, a professional threat assessment opinion, and a judicial finding are distinct kinds of statements.
How a Behavioral Threat Assessment Begins
Referrals arise from direct statements of intended harm, credible reports of preparation, repeated approaches to a target, disturbing messages, or combinations of less direct events. Reporting mechanisms should permit students, employees, families, and other witnesses to submit accurate information without requiring them to diagnose, classify, or predict a person.
A useful first report records dates, places, exact words where available, who observed what, relevant messages, available witnesses, and immediate safety concerns. The report should distinguish firsthand experience from secondhand rumor. Labels such as dangerous, unstable, or suspicious have much less evidentiary value than observable behavior.
An intake reviewer determines whether an emergency action is needed and whether the concern belongs within the program's authority. The U.S. Department of Education's school guidance supports a defined team and a holistic review of behavior, communications, and circumstances rather than isolated stereotypes or checklists.
A referral can be closed or redirected when evidence does not support continued involvement. That possibility is essential for protecting procedural fairness, reducing unnecessary stigma, and encouraging reporting based on facts rather than panic.
The Seven Stages of the Assessment and Management Process
Stage 1: Define the referral and scope of authority
The team identifies the relevant behavior, suspected target, setting, decision-maker, urgency, and purpose of assessment. The question might be whether a school needs a student safety plan, whether a workplace should increase protection, or whether law enforcement needs to assess reported preparation. Scope controls what evidence should be sought and what measures can lawfully follow.
Teams also determine who needs to participate. They should not collect every available personal detail merely because the referral is serious. Information collection and interagency sharing must be linked to a legitimate purpose and applicable rules.
Stage 2: Triage for immediate action
Triage tests whether specific current evidence suggests imminent danger. Credible present access to a target, real-time threats, reported ongoing attacks, or verified rapidly escalating conduct can require urgent protective action. The goal is to protect people and coordinate emergency responders while recording what is actually known.
Many referrals do not present an immediate emergency. For those cases, thoughtful inquiry, support, appropriate monitoring, and follow-up may be more useful than an impulsive punitive response. Teams should not equate low immediate urgency with zero need for continued review.
Stage 3: Assemble the multidisciplinary team
A qualified team can integrate behavioral investigation, safety planning, legal obligations, mental health knowledge, administrative authority, and community support. Schools may involve administrators, psychologists, counselors, educators, student support personnel, and law enforcement representatives when appropriate. Health care and workplace cases require a different combination of expertise.
Diversity of disciplines helps only when participants can challenge assumptions and recognize the limits of their expertise. Team procedures should include role clarity, documented decisions, training, supervision, and a mechanism for identifying conflicts of interest. The Secret Service's 2018 guidance presents a detailed school implementation model.
Stage 4: Gather and corroborate relevant evidence
The team reviews the available incident record, interviews relevant people using appropriate procedures, evaluates communications in context, and establishes what corroboration exists. It may examine lawful information about contact with the target, changes in behavior, access and feasibility, and circumstances that could decrease or increase risk.
Every important claim should be traceable to a source. An online screenshot may omit context; a statement may be misquoted; a frightening allegation may turn out to concern someone else. The team should record contradictory accounts rather than resolving every contradiction by assuming the most alarming interpretation.
Interviewing someone of concern may clarify the situation, reveal support needs, or expose additional questions. Noncooperation creates an information limitation; it does not by itself prove an intent to harm. Investigations must respect the legal and professional limits on obtaining private records.
Stage 5: Construct and test a case formulation
A case formulation explains the possible sequence connecting supported facts to a future adverse outcome. It addresses grievance or motivation where relevant, intent, behavior, feasibility, access, situational stressors, protective factors, and alternative explanations. It identifies what evidence would strengthen or weaken each hypothesis.
This is conditional reasoning, not a clinical diagnosis or a mathematical forecast. The formulation should specify the relevant target and timeframe and say what is unknown. Vague declarations of a high-risk personality do not explain how a particular scenario might arise or be interrupted.
Stage 6: Create and carry out a management plan
Possible actions include support services, conflict resolution, safety accommodations, lawful access restrictions, security measures, supervision, target-focused protection, coordinated communication, and referral to emergency or law enforcement authorities when justified. Appropriate responses vary by severity, legal authority, and the effects of intervention.
A plan specifies the responsible person, the action, its rationale, the review interval, and the conditions for escalation or reduction. The strongest planning links each action to a concrete safety or support objective. Sending a referral that is never completed is not the same as providing a protective service.
Stage 7: Reassess and close when warranted
Threat assessment is dynamic. New evidence, changes in access, successful resolution of a conflict, emerging communications, or shifts in supports can change the formulation. Review should test whether actual circumstances have changed and whether the chosen measures remain lawful, necessary, and effective.
Closure should be documented. Information retention and deletion must follow applicable rules. A former referral should not automatically become a permanent mark of suspected dangerousness after the underlying concern has been resolved.
What Do Threat Assessment Teams Examine?
Teams usually investigate observable behavior, recent changes, the reported target, communications, access, preparation, feasibility, and protective circumstances. Relevant facts are those that help answer the case-specific question. A detail is not meaningful merely because it appears in a list of behaviors retrospectively associated with some attackers.
A grievance, conflict, humiliation, rejection, or loss may explain what the person is focused on, but these experiences are common. The presence of a grievance is not evidence that violence will follow. The evaluator asks whether reliable facts connect it to a credible developing pattern of behavior toward a target.
Direct threats are one source of information. Some explicit threats are impulsive, rhetorical, fabricated, or infeasible; others may be accompanied by concerning actions. Some attackers communicate indirectly or avoid issuing direct threats. Accordingly, neither a threatening statement nor its absence resolves the assessment.
The FBI's guidance on specificity and credibility offers useful distinctions. Specificity concerns details of who, what, when, where, and how. Credibility concerns the quality of the source and corroboration. Viability concerns whether the described conduct is realistically possible. These dimensions should be assessed separately.
Leakage, Fixation, Pathway Behavior, and Other Warning Concepts
Researchers use leakage for some communications suggesting potential intent to cause harm made to third parties. The study by Meloy and O'Toole (2011) developed this concept in the context of targeted violence assessment. Leakage may invite investigation, but it cannot be treated as proof of a specific future attack.
Meloy and colleagues (2012) proposed a typology of warning behaviors, including pathway behavior, fixation, identification, novel aggression, energy burst, leakage, directly communicated threat, and last-resort behavior. These categories provide a vocabulary for examining possible changes in conduct.
They are not clinical diagnoses. The categories have differing empirical support, can overlap, and are not equivalent to a universally calibrated predictive score. A count of warning behaviors is not a percentage likelihood of violence. Teams need contextual corroboration and an explanation of how a particular observation relates to the specific scenario.
So-called pathway behavior may involve verified steps that appear related to planning or preparation. Yet ordinary training, visiting a place, purchasing common equipment, expressing anger, or consuming disturbing media can have legitimate explanations. A sound assessment identifies what makes the act relevant here rather than inferring intention from an isolated activity.
Intent, Capability, Opportunity, and Context
Intent concerns what a person plans or wishes to do. Capability concerns whether the person could carry out the proposed conduct. Opportunity concerns access to people or places under existing conditions. These are separable; an explicit statement may be impracticable, and ordinary access does not establish harmful intent.
Evidence of preparation requires particular care. Investigators should verify timing, authorship, feasibility, the relationship to a possible target, and alternative explanations. The assessment must distinguish a fact, a plausible inference, and an unsupported allegation.
Context also determines what management options exist. A college can change access arrangements within its policies, a workplace can coordinate security and employee services, and law enforcement has different investigative authorities. The same wording in two cases can require different responses because corroboration, access, and timeframes differ.
Protective Factors and Nonviolent Pathways
Protective factors may include trustworthy social connections, a workable avenue to resolve a grievance, appropriate mental health or social support, stable housing, cooperation with a reasonable safety plan, and changes in access to a possible target. Their effect depends on whether the factor actually operates in the person's circumstances.
A protective factor is not a guarantee. Family involvement does not always resolve risk, and a person living alone should not be presumed dangerous. Intervention quality matters: a service that is unavailable, a protective measure that is not implemented, or a plan that nobody monitors may create a false sense of security.
Evidence about protective factors in wider forensic assessment is examined in Protective Factors in Violence Risk Assessment and Risk Management. A targeted assessment still requires evidence that the particular protective action is feasible and relevant to this particular situation.
Support-based prevention can also reduce harm from the threat assessment process itself. Where appropriate, services and restorative approaches may preserve trust and encourage future reporting. Safety precautions, rights, and support needs can be considered together.
Psychiatric Diagnosis and Targeted Violence
Clinical diagnosis describes patterns of symptoms and functioning established through a qualified clinical assessment. It does not determine criminality, violent intent, or future behavior. Most people with mental health conditions do not perpetrate targeted attacks, and many warning behaviors are not symptoms of any mental disorder.
Mental health expertise may matter if observed symptoms, severe distress, impaired judgment, or treatment needs are relevant to a supported case formulation. Teams should avoid diagnosing people from social media, clothing, behavior reported out of context, or a reporter's assumptions.
Threat assessment may also identify someone who needs urgent care without posing a credible danger to others. An appropriate health response depends on clinical and legal criteria distinct from any institutional concern about safety. Involuntary hospitalization, a protective order, arrest, and ordinary supportive outreach have different evidentiary requirements.
The separation of referral questions, diagnostic evidence, psychometric results, and forensic opinions is addressed further in Forensic Psychological Assessment: Purpose, Methods, and Limits.
Can a Threat Assessment Tool Predict Targeted Violence?
Prediction depends on the precise outcome, population, interval, and decision threshold. Targeted mass attacks are rare events, and models developed for other violence outcomes may not transport accurately. A method tested among forensic patients cannot be presumed valid for anonymous social media posts or university disciplinary referrals.
Many threat assessment programs use structured professional judgment: professionals examine specified domains, document reasoning, review alternative scenarios, and choose management options. Structure can improve consistency, but it does not eliminate subjectivity, measurement error, or implementation differences. Professional experience alone is not a substitute for population-relevant validation.
Discrimination concerns whether a method ranks cases with and without an outcome differently. Calibration asks whether stated probabilities correspond to observed outcome frequencies. Sensitivity and specificity describe different classification errors. Overall accuracy can be misleading when most people in the assessed population never experience the defined outcome.
The related article Actuarial vs. Structured Professional Judgment in Violence Risk Assessment explains these measurement distinctions. Threat assessment teams should avoid quoting exact probabilities unless the relevant measure has been validated for the same endpoint, population, and conditions.
The base-rate problem and false positives
Imagine a hypothetical group of 100,000 people in which 100 experience an outcome during a defined interval. If a screening procedure has 80 percent sensitivity and 95 percent specificity, it will flag 80 eventual cases correctly and 4,995 people who do not experience the outcome. Among 5,075 people receiving a positive result, about 1.6 percent will experience it.
This is an illustration, not an estimate of any actual threat assessment tool's performance. Actual referral samples differ from the general population, and a threat assessment program may intervene after identifying a problem, changing the observed outcome. A prevented incident cannot be naively counted as evidence that the underlying concern was false.
False negatives also matter. An assessment may miss a person whose concerning behavior remains invisible, is misreported, or changes rapidly. No checklist can eliminate these limitations. Fairness demands considering both errors and whether proposed actions are proportionate to the quality of the information.
What Does the Research Show About Effectiveness?
Evidence needs to be divided into descriptive case studies, implementation studies, outcome studies, and predictive validation. Known-attacker case reviews can identify behaviors documented before attacks, but usually lack a suitable comparison population of people who showed similar behaviors without attacking. Consequently, they cannot establish an individual's risk from an isolated warning sign.
A 2012 randomized study by Cornell and colleagues examined a structured school threat assessment model and reported beneficial aspects of school handling and disciplinary outcomes. The result is relevant to school practice in the studied setting, but it cannot determine whether an individual would have carried out a rare mass attack.
A 2022 systematic review considered the school threat assessment literature and identified promising findings alongside implementation differences, design limitations, and questions about equity. A National Academies workshop in 2024 specifically considered the difficulties of evaluating prevention programs for rare severe outcomes.
Program operation also matters. A 2026 implementation fidelity study involving 584 team members in 314 schools reported associations between team fidelity, favorable team perceptions, and reduced exclusionary school discipline. These findings concern implementation and associated outcomes; they are not direct proof of the number of serious attacks prevented.
The 2026 Evidence on Violence After School Threat Assessment
A major 2026 study examined 14,126 school threat assessment cases across 1,692 schools in Florida. Researchers recorded a subsequent attack of the study's specified kind in 10.9 percent of cases and serious injury in 0.4 percent. More serious threat classifications were associated with higher rates of subsequent attacks than lower-concern categories.
The denominator is cases already receiving school threat assessment, not the entire student population. The outcome category attack should not be confused with mass shooting or homicide. These distinctions make the findings useful for understanding follow-up risk and case classification in the studied system while preventing the exaggeration of risk to any individual student.
Another 2026 analysis of 2,349 cases from 166 schools found that subsequent attacks differed by threat classification and serious injury was uncommon. In that sample, recorded safety measures were not significantly associated with attack or injury outcomes. Such observational results cannot isolate every treatment effect, but they challenge assumptions that applying a measure necessarily demonstrates prevention.
The new studies illustrate why empirical evaluation should report absolute outcome frequencies, the classification rules used, case selection, and intervention context. They do not establish universal predictive validity of threat assessment tools or prove that every serious classification is correct.
Threat Assessment in K–12 Schools
School programs need a defined referral path, trained multidisciplinary team, fact-based classification, coordinated intervention, and appropriate record handling. School safety is intertwined with developmental differences, academic consequences, student support, disability accommodations, parental engagement where appropriate, and procedural fairness.
Some school frameworks distinguish transient from substantive threats. Definitions are specific to the selected model, and classification is an operational decision rather than a psychological diagnosis. The newer follow-up research found that serious classifications were associated with higher attack rates within studied school samples, but those results do not authorize blanket punishment for all serious referrals.
The Secret Service's operational guide for schools describes how teams can gather evidence, evaluate circumstances, and manage cases. The Department of Education gives related guidance on team composition and privacy considerations.
A school should track who is referred, which evidence supports decisions, which services are delivered, and how discipline differs across student groups. Its performance cannot be judged solely by the number of cases closed.
Universities, Workplaces, and Health Care
College and university teams may review conduct involving students, staff, former students, visitors, and outsiders. The institution must consider campus access, residence life, academic grievances, counseling resources, privacy, and public safety coordination within the relevant legal framework. An assessment should identify the actual case-specific threat scenario rather than treating every student conflict as an attack precursor.
Workplace teams face different concerns: current and former employees, customers, contractors, occupational grievances, access to facilities, and employee well-being. A termination or workplace dispute is not independently a predictor of violence. The organization should address reported threatening conduct, feasible protection, and conflict resolution.
Health care institutions have patients, visitors, emergency services, clinical confidentiality, and special environmental vulnerabilities. The FBI announced health care-focused targeted violence guidance in March 2026. Specialized resources illustrate the need to adapt a general process to the actual setting.
Public safety agencies may organize behavioral threat assessment units for cases crossing institutional boundaries. The Secret Service's 2024 law enforcement guide supplies an operational framework. Such guidance is a practice resource rather than proof of perfect predictive accuracy.
Online Threats and Digital Evidence
Online reports can concern direct messages, forum posts, school platforms, email, anonymous submissions, or public social media. The team needs to distinguish source attribution, exact wording, timestamps, edited or missing context, anonymity, and whether offline evidence corroborates the allegation.
A disturbing quotation, political opinion, artistic expression, or hostile joke is not necessarily a genuine plan. Conversely, the absence of public communications cannot establish that someone has no harmful intent. Context, corroboration, and lawful investigative boundaries remain indispensable.
Institutions should avoid broad surveillance and preserve only information necessary for the authorized referral and management purpose. Social media content, education records, and medical information have different access and disclosure rules.
Legal Standards, Confidentiality, and Due Process
Threat assessment is applied within law, not above it. A threat formulation does not itself establish probable cause, criminal guilt, the elements of a criminal threat, a basis for compulsory treatment, or a court's finding about responsibility. Those standards depend on jurisdiction and on the decision being made.
In American education, FERPA can govern use and disclosure of records during a threat assessment. The Department of Education explains when outside participants may access education records and places limits on redisclosure. The health or safety emergency exception applies in specific circumstances and does not create general permission to share student information.
Clinical confidentiality, employee privacy, child-protection rules, disability rights, freedom of expression, reporting duties, and duties involving identifiable potential victims can also be relevant. Their boundaries vary by state, country, professional role, and factual situation. Teams need local legal review for consequential actions.
The rights of the person assessed and the safety of potential targets both require attention. Serious measures should have a recorded factual basis and review process, with opportunities to correct errors where compatible with legitimate safety needs.
Fairness, Disability, and Bias in Assessment
Race, religion, gender, cultural communication styles, disability, unusual mannerisms, and a psychiatric label are not substitutes for behavioral evidence. Stereotyping can increase reports against some groups and distract attention from concerning behavior by others.
A 2025 study examined school threat assessment referral rates and demographic variation. Referral processes shape who enters the assessed population in the first place. A procedure can appear consistent at the final stage while creating unequal burdens through earlier reporting, information collection, disciplinary action, or restricted access to supports.
A fair team should test alternative explanations, seek corroboration, document disagreements, and assess the effect of decisions across groups. It should not confuse a high rate of referrals with a high rate of violent conduct. Data systems should enable appropriate audits of false positives, false negatives, accessibility, and disparate interventions.
Professional forensic guidance from the American Psychological Association reinforces the importance of competence, appropriate methods, impartiality, and clear statements of limitation.
Reporting Conclusions Without False Precision
A strong report states its referral question, sources, verified facts, conflicting information, interpretation, uncertainties, possible scenarios, and management rationale. It also records the review interval and what evidence would change the conclusion. This makes the decision understandable and correctable.
Words such as low, moderate, high, or imminent need definitions. They are ambiguous if the reader does not know the event, timeframe, reference population, and method. Some teams make structured categorical judgments without validated numeric probabilities; they should not imply statistical calibration that has never been demonstrated.
The FBI's description of specific and credible threat warning emphasizes describing what is known, unknown, corroborated, and operationally feasible. This is preferable to language that converts an incomplete concern into certainty.
Reporting should distinguish an evaluator's interpretation from legal findings and from any clinical diagnosis. The purpose is defensible decision-making and preventive management, not dramatization.
Common Mistakes in Threat Assessment
Profiling is one error: deciding someone is likely to attack because they resemble a famous perpetrator or have unusual interests. Retrospective offender studies can identify potential inquiry topics, but they do not show how often similar characteristics occur in people who never attack.
Another error is treating one threat statement as sufficient evidence of a completed plan or treating an absence of statements as proof of safety. Threats, preparations, intentions, and capabilities have different meanings and must be corroborated independently.
A third mistake is assuming a psychiatric diagnosis or a risk tool settles the case. A fourth is counting every intervention as a success and every referral that did not lead to violence as a correctly predicted non-event. Interventions themselves can change outcomes, and rare-event base rates make superficial success statistics misleading.
Finally, punitive overreaction can harm students, workers, and trust in reporting channels. Effective management considers protection, available help, lawful proportionality, and the consequences of false accusation.
An Illustrative Case Formulation
Imagine a student reports that a classmate sent angry messages after an academic conflict. At intake, the team has screenshots but has not verified their completeness, authorship, or the apparent target. A responsible review checks the context, conducts appropriate interviews, considers relevant independent reports, and explores whether existing grievance procedures or supports can resolve the matter.
Suppose additional credible evidence later shows target-focused planning and a recent effort to bypass an access restriction. That would change the immediacy and potential management actions. The team would explain exactly how these facts change its assessment and which protective measures are justified.
Alternatively, the screenshots may prove misleading, the supposed approach may never have occurred, and the conflict may already have been resolved. The team should then correct its account and avoid leaving unsupported dangerousness labels in institutional records.
This scenario illustrates how new evidence changes a case formulation. It is not an algorithm, diagnosis, legal opinion, or verified prediction of individual behavior.
What Should Someone Do if They Receive a Threat?
For a credible immediate danger, contact the local emergency service and follow the setting's emergency procedure. Avoid privately confronting or investigating someone who may pose an imminent threat. Protect people in the affected location first.
For other concerning behavior, use the institution's designated threat reporting system or contact an appropriate safety professional. Share exact statements, dates, messages, witness information, and facts that show why the concern is current. Explain what you personally saw and what others reported.
Do not circulate private records or allegations widely. The person receiving the report should acknowledge it, check urgency, protect relevant evidence, and route the concern to a qualified team. Reporters should not have to make psychological diagnoses or guarantee a prediction.
How Should Threat Assessment Programs Be Evaluated?
Programs should be judged on clearly defined process and outcome measures. Process indicators include report accessibility, timely triage, training, documented case review, implementation of support and protective plans, periodic reassessment, and accurate recordkeeping.
Outcome evaluation must distinguish an argument, minor assault, serious injury, weapon incident, and targeted mass attack. These have different base rates and mechanisms. Evaluators must identify their population, follow-up time, interventions, and comparison conditions before making effectiveness claims.
Equity evaluation covers who is reported, investigated, disciplined, supported, and retained in records. Research such as the 2026 school team fidelity study shows why implementation quality matters; it should not be reinterpreted as a precise count of attacks prevented.
The research base is growing, including more direct follow-up studies, but evidence from one jurisdiction, population, and threat model may not generalize. Transparent limitations are part of scientific quality and good public safety policy.
Frequently Asked Questions
Is threat assessment a psychological test?
Threat assessment is an investigation and management process. Some teams use structured frameworks or clinical consultation, but there is no single psychological test that can reliably identify everyone who will commit targeted violence.
Can a threat assessment team predict a mass shooting?
No team can predict an individual mass shooting with certainty. It can review corroborated concerning behavior, formulate plausible scenarios, and implement measures intended to lower the likelihood or potential impact of violence.
What is the difference between a threat and a risk factor?
A threat may refer to a communication or behavior suggesting an intention to harm. A risk factor is a characteristic or circumstance associated with an outcome in a defined context. Both require interpretation; neither alone establishes future conduct.
Are all school threats serious?
Schools must evaluate context and evidence. Some adopted models distinguish transient concerns from substantive ones requiring intervention. The 2026 school follow-up study found differing outcomes across these classifications, but the definitions and findings belong to that studied setting.
What is a behavioral threat assessment team?
It is a multidisciplinary group with assigned responsibilities for receiving concerns, gathering relevant information, assessing changing circumstances, developing protective and supportive responses, and reviewing the case. The Department of Education explains the structure in school settings.
Does mental illness mean a person is dangerous?
A diagnosis does not establish violent intent or criminal behavior. Clinical needs should be evaluated appropriately, while threat assessment conclusions depend on verified case-specific behavior and circumstances.
Can a threat assessment score be used to convict someone?
A score or professional formulation cannot replace evidence meeting the legal standard for a criminal finding. Rules of evidence and criminal procedure vary by jurisdiction.
Can FERPA records be shared with a threat assessment team?
Certain sharing is permitted under specified school-official and emergency rules, subject to restrictions on use and redisclosure. The answer depends on the records, team structure, purpose, and factual situation. See official FERPA guidance.
What if there is no direct threat?
A team may still evaluate other credible concerning behavior, such as corroborated preparation or target-related conduct. It should not assume either imminent danger or complete safety merely because no direct statement was made.
How do teams avoid false accusations?
They document firsthand facts, obtain corroboration, consider reasonable alternatives, allow corrections where appropriate, monitor potential bias, and match interventions to evidence and legal authority.
Is a school suspension the same as prevention?
No. Discipline is one possible institutional response. The effectiveness of prevention requires examining safety, support, follow-up, the seriousness of the outcome, and unintended consequences.
When should a case be closed?
Closure follows documented reassessment of the facts, remaining uncertainty, protective conditions, and the need for continued management. Policies should address oversight and lawful retention of information.
Related Articles
References
American Psychological Association. (2013). Specialty guidelines for forensic psychology. American Psychologist, 68(1), 7–19. APA guidelines.
Borum, R., Fein, R., Vossekuil, B., & Berglund, J. (1999). Threat assessment: Defining an approach for evaluating risk of targeted violence. Behavioral Sciences & the Law, 17(3), 323–337. PubMed.
Cornell, D., Allen, K., & Fan, X. (2012). A randomized controlled study of the Virginia Student Threat Assessment Guidelines in K–12. School Psychology Review, 41(1). DOI.
Cornell, D., Konold, T., Maeng, J., Kerere, J., Cowley, D., Huang, F., & Afolabi, K. (2026). School team fidelity in behavioral threat assessment. Journal of Threat Assessment and Management. OJP.
DePaoli, J. L., & Loewe, S. B. (2025). Keeping schools safe? The research on behavioral threat assessments. Learning Policy Institute. Original report.
Federal Bureau of Investigation. (2017). Making prevention a reality: Identifying, assessing, and managing the threat of targeted attacks. FBI report.
Federal Bureau of Investigation. (2026). FBI releases new guidance to help health care organizations prevent targeted violence. FBI release.
Federal Bureau of Investigation. (n.d.). The FBI's use of specific and credible in threat warning. FBI guidance.
Kerere, J., Maeng, J., & Huang, F. (2026). Student attacks following a school threat assessment: Statewide trends in student and case characteristics. Journal of Threat Assessment and Management, 13(1), 100–111. NIJ.
Meloy, J. R., & O'Toole, M. E. (2011). The concept of leakage in threat assessment. Behavioral Sciences & the Law. DOI.
Meloy, J. R., Hoffmann, J., Guldimann, A., & James, D. (2012). The role of warning behaviors in threat assessment: An exploration and suggested typology. Behavioral Sciences & the Law. DOI.
National Academies of Sciences, Engineering, and Medicine. (2024). K–12 behavioral threat assessment efficacy and implementation evaluation research: Proceedings of a workshop—in brief. National Academies.
Office of Justice Programs. (2026). Violence following a threat assessment: Do threat classification and school safety measures matter? Research record.
Ross, D., von der Embse, N., Andrews, J. L., Headley, M. M., & Mierzwa, C. (2022). School-based threat assessment: A systematic review of the literature. Journal of School Violence. DOI.
U.S. Department of Education. (n.d.). Does FERPA permit the sharing of education records with outside law enforcement officials, mental health officials, and other experts on a school's threat assessment team? FERPA guidance.
U.S. Department of Education. (n.d.). When is it permissible to utilize FERPA's health or safety emergency exception? FERPA guidance.
U.S. Department of Homeland Security. (2024). Enhancing behavioral threat assessment and case management capabilities through a public health-informed approach. DHS publication.
U.S. Secret Service, National Threat Assessment Center. (2018). Enhancing school safety using a threat assessment model: An operational guide for preventing targeted school violence. Official guide.
U.S. Secret Service, National Threat Assessment Center. (2024). Behavioral threat assessment units: A guide for state and local law enforcement to prevent targeted violence. Official guide.