Every claim in the map classified as evidence, in report order.
NTAC's 2023 report Mass Attacks in Public Spaces: 2016–2020 examined mass violence in public and semi-public spaces over five years.
In 2023, NTAC published Mass Attacks in Public Spaces: 2016 – 2020, a report that examined 173 acts of mass violence
A 45-year-old gunman fatally shot four people across three locations after confronting his wife over divorce papers, including her coworkers and divorce attorney. He then held police off in a three-hour standoff and was shot by law enforcement, dying later of his injuries.
A 45-year-old gunman fatally shot four individuals in a shooting spree across three locations.
After fleeing police, the attacker positioned a rifle at his apartment window and fired at responding officers, killing one.
Afterward, the attacker fled from police, drove to his apartment, positioned a rifle at his window, and fired at responding law enforcement, killing one officer.
A three-hour standoff followed, during which the attacker repeatedly called dispatch demanding reform in how assets are divided during divorce.
A three-hour long standoff ensued, and the attacker called dispatch multiple times, demanding reform in how assets are divided during divorce.
The incident began when the attacker drove to his wife's workplace to demand that she sign divorce papers.
The incident started when the attacker drove to his wife's workplace to demand she sign divorce papers.
When his wife refused, the attacker retrieved a handgun from his car while she escaped.
When she refused, the attacker retrieved a handgun from his car while his wife escaped.
Moments later, the attacker returned and opened fire, killing two of his wife's coworkers.
Moments later, the attacker returned and opened fire, killing two of the wife's coworkers.
The attacker then drove to a law firm and fatally shot his wife's divorce attorney.
The attacker then drove to a law firm and fatally shot his wife's divorce attorney.
The attacker was ultimately shot by law enforcement and later died of his injuries.
The attacker was ultimately shot by law enforcement and later died of his injuries.
A 39-year-old man stabbed a counselor and other employees at a mental health center after the center had determined that morning he was not appropriate for its treatment program. He was subdued by a client until police arrived.
A 39-year-old man entered a mental health treatment center.
The report compares the workplace attackers' suicide rate against the non-workplace incidents in Mass Attacks in Public Spaces: 2016-2020, a prior NTAC study published in 2023.
Mass Attacks in Public Spaces: 2016 - 2020 (2023)
The attacker drew a concealed knife in a room with a female counselor, stabbed her repeatedly, then slashed and stabbed other employees.
When placed in a room with a female counselor, the man drew a knife concealed under his waistband and began to stab her repeatedly before exiting the room and slashing and stabbing numerous other employees.
On arriving at the mental health treatment center, the attacker began to yell and insisted on seeing the employee he had seen on his last visit.
Upon arrival, he began to yell, and insisted that he see the employee he saw on his last visit.
The attacker was chased and subdued by one of the center's clients until law enforcement arrived and arrested him.
The attacker was ultimately chased and subdued by one of the center's clients until law enforcement arrived and arrested the attacker.
Earlier that morning the center had determined the attacker was not appropriate for its treatment program because of his long history of violence and the severity of his mental health needs.
Earlier that morning, the center had determined that the attacker was not appropriate for their treatment program due to his long history of violence and the severity of his mental health needs.
One bladed-weapon attack at a mental health facility was perpetrated by a patient released one month earlier; another by an individual denied entry into a treatment program hours earlier.
including one attack perpetrated by a patient who had been released one month earlier and another who had been denied entry into a treatment program hours earlier
A 22-year-old U.S. military service member facing health, family, peer, and performance stressors, and seeking mental health care for sleep, coping, and belonging problems, fatally shot two civilian workers and injured a third on base before dying by suicide.
A 22-year-old service member in the U.S. military, armed with his service rifle and handgun, fatally shot two civilian workers and injured a third on base
In the year before the attack, the service member experienced chronic pain from a motorcycle accident, a loved one's ailing health, harassment from peers, and numerous work reprimands and citations for poor performance and tardiness.
Within the year prior to the attack, the attacker experienced multiple stressors, including chronic pain resulting from a motorcycle accident, the ailing health of a loved one, harassment from peers, and numerous reprimands and citations at work due to poor performance and tardiness.
At multiple points the service member sought medical attention for mental health problems, including difficulty sleeping and concentrating, coping with stress, and feelings of alienation and not belonging among peers.
At multiple points in time, the attacker sought medical attention for mental health problems, including visits for difficulty sleeping and concentrating, issues coping with stress, and feelings of alienation and lacking a sense of belonging among his peers.
A 53-year-old man killed his estranged wife and one of her students in her classroom, injuring another student, before dying by suicide. He had two decades of domestic violence, including threats to kill, and multiple people had filed restraining orders against him.
A 53-year-old man arrived at the elementary school where his estranged wife worked
A 38-year-old gunman with a two-decade criminal history, including felony convictions and domestic violence against his ex-girlfriend, was served a civil protection order at work on the day of his attack. He killed three and injured fourteen before being shot by law enforcement.
A 38-year-old gunman armed with a pistol and a rifle killed three and injured fourteen others
The attacker's domestic violence spanned two decades and included assaults and threats to kill women, two previous wives, and his own children.
The attacker had a history of domestic violence spanning two decades, which included numerous assaults and threats to harm and kill women, including two previous wives, as well as threats to kill his own children.
The attacker was motivated to shoot after his estranged wife moved out three months earlier and refused his attempts to force her return.
The attacker was motivated to engage in the shooting after his estranged wife moved out of his home three months earlier and refused his attempts to force her return.
Although barred from owning firearms by prior felony convictions, the attacker threatened his ex-girlfriend until she supplied the guns used in the attack.
Although the attacker could not legally own firearms due to his prior felony convictions, he threatened his ex-girlfriend until she provided him with the firearms he ultimately used in his attack.
At his estranged wife's classroom, the man fired ten shots from a revolver, killing his wife and one of her students and injuring another student before dying by suicide.
When he arrived at her classroom, the man drew a revolver and fired ten shots into the classroom, killing his wife and one of her students and injuring another student before dying by suicide.
The attacker's violent and threatening behavior led both of his ex-wives, an ex-girlfriend, and a local female pastor and her husband to file restraining orders against him.
The attacker's violent and threatening behavior prompted multiple parties, including both of his ex-wives, an ex-girlfriend, and a local female pastor and her husband, to file restraining orders against him.
The gunman whose spree ended at his workplace was shot and killed by responding law enforcement officers.
The attacker was ultimately shot and killed by responding law enforcement officers.
Earlier on the day of the attack, the gunman was served a civil protection order at his place of employment.
Earlier that day, the attacker was served a civil protection order at his place of employment.
The gunman's criminal history spanned two decades, including multiple felony convictions for burglaries and gun charges, an arrest after a brawl, and many other charges that were dismissed.
The attacker had a long criminal history spanning two decades, including multiple felony convictions related to burglaries and gun charges, an arrest after the attacker got into a brawl with others, and many other charges that were ultimately dismissed.
The gunman had numerous law enforcement encounters for domestic violence against his ex-girlfriend, which prompted her to file for the protection order served on the day of his attack.
The attacker had numerous other encounters with law enforcement for domestic violence he perpetrated against his ex-girlfriend, prompting her to file for the protection order he was served on the day of his attack.
A 24-year-old man opened fire with two shotguns at the grocery store where he worked, killing three coworkers. In the months before, he created videos glorifying school shootings and described admiration for past attackers and plans in journal entries.
A 24-year-old man armed with two shotguns opened fire almost two hours into a night shift
The attacker held delusional beliefs that after death he would become a cartoon female ghost and join violent cartoon characters in an afterlife.
The attacker harbored delusional beliefs that when he died after his attack, he would become a cartoon female ghost character and join other violent cartoon characters in an afterlife.
In the months before the attack, the grocery store attacker created and shared videos glorifying school shootings and wrote in numerous journal entries about his admiration of past attackers and his attack plans.
In the months prior to his attack, the attacker created and shared videos glorifying school shootings, and described his admiration of past attackers and his plans for his attack in numerous journal entries.
One attacker accused his wife of spying for the government and made her write to him, then burned the pages. Another threatened coworkers at a cemetery, prompting his termination, and then complained about them for seven years.
For example, one attacker accused his wife of collaborating with the government to spy on him
A 64-year-old man who had been fired from a cemetery seven years earlier vowed revenge and threatened employees. He shot one person dead and injured two more at the cemetery before surrendering.
A 64-year-old man rode his bike to a cemetery where he used a handgun to shoot and kill one person
Two days before the attack, the attacker received an eviction notice from the apartment complex where he lived and worked.
Two days prior to the attack, the attacker received an eviction notice from the apartment complex where he lived and worked.
Before the cemetery attack, the attacker rigged his apartment, garage, and an adjacent residence with a series of incendiary devices, which were detected before they could detonate.
Prior to the attack at the cemetery, the attacker rigged his apartment, garage, and an adjacent residence with a series of incendiary devices, which were detected before they could detonate.
Another employee attacker threatened coworkers at the cemetery where he worked, prompting his termination.
Another attacker threatened coworkers at the cemetery where he worked, prompting his termination.
For seven years after his termination, the cemetery attacker complained to others about the cemetery and its employees before carrying out his attack.
For seven years following his termination, the attacker complained to others about the cemetery and its employees before perpetrating his attack.
After being terminated from the cemetery seven years earlier, the attacker had vowed revenge and threatened to kill cemetery employees.
The attacker had vowed revenge and threatened to kill cemetery employees after he had been terminated from the cemetery seven years earlier.
While employed, the cemetery attacker made threatening statements that concerned coworkers, leading to calls to law enforcement and eventually his termination.
As an employee, the attacker had made threatening statements that concerned coworkers, prompting calls to law enforcement and his eventual termination.
The first of the two resigning attackers submitted his two weeks' notice at the start of his workday, completed his shift, and then began his attack.
The first attacker submitted his two weeks' notice at the beginning of his workday, completed his shift, and then inittiated his attack.
The second resigning attacker was a former employee who had resigned in lieu of termination two years earlier after sexually harassing and threatening colleagues.
The second attacker was a former employee who resigned in lieu of termination two years earlier after he had sexually harassed and threatened colleagues.
A 45-year-old man opened fire at a hospital where he had been a resident physician, killing one and injuring six, then died after setting himself on fire and shooting himself. He had resigned two years earlier in lieu of being fired for sexual harassment and threats, and his badge was not revoked.
A 45-year-old man armed with a semiautomatic rifle opened fire at a hospital where he had formerly been employed as a resident physician
A 45-year-old gunman with a reputation for confrontation and fights at work, who had been fired two months earlier for stealing company equipment, opened fire at his former workplace and killed five former coworkers before dying by suicide. He had struggled financially and had asked to be rehired.
A 45-year-old gunman opened fire with a pistol at his former workplace, killing five of his former coworkers before dying by suicide.
The hospital did not revoke the attacker's identification badge when he resigned, and he used it to access the hospital on the day of the attack.
At the time of his resignation, the hospital did not revoke his identification badge, which he used to access the hospital on the day of the attack.
The attack took place on the day of the hospital's residency program graduation.
The attack date coincided with the hospital's residency program graduation.
During his employment the attacker was known for confrontation and fights with coworkers, including punching and attempting to strangle one.
During his employment, the attacker had a reputation for being confrontational and frequently getting into fights with coworkers, including one instance in which he assaulted a coworker by punching and attempting to strangle him.
After the shooting, the former resident physician set himself on fire and shot himself in the chest, ultimately dying of his wounds.
The attacker then set himself on fire and shot himself in the chest before ultimately succumbing to his wounds.
Two years before the attack, he resigned from the hospital in lieu of being fired over allegations that he sexually harassed and threatened colleagues.
Two years prior, he had resigned from the hospital in lieu of being fired due to allegations of sexually harassing and threatening his colleagues.
The attacker blamed hospital staff, including a residency student, for ruining his medical career and threatened to return to the hospital and kill colleagues.
The attacker blamed hospital staff, including a student in the residency program, for ruining his medical career, and threatened to return to the hospital and kill colleagues.
The gunman who killed five former coworkers had been fired two months earlier for stealing company equipment.
The attacker had been fired two months earlier for stealing company equipment.
Since his termination, the gunman faced financial difficulties and struggled to find a new job.
Since his termination, he faced financial difficulties and struggled finding a new job.
At one point the gunman emailed a manager at the targeted site to request his old job back, and the request was denied.
At one point, the attacker emailed a manager at the targeted site to request his old job back, but his request was denied.
According to neighbors, the gunman's rent was due on the day of his attack.
According to neighbors, the attacker's rent was due on the day of his attack.
An employee with numerous rule violations drew a concealed handgun during a disciplinary meeting, killing four coworkers and injuring one. He then killed another coworker who had reported his safety violation, and the attacker injured five officers in a shootout before dying of his wounds.
the individual drew a concealed handgun and opened fire, killing four coworkers and injuring another
One organization published a report a week after the attack finding the targeted facility had a below-average climate, poor morale, and low belonging.
published a report one week after the attack that revealed the targeted facility had a below-average climate, poor morale, and employees who lacked a sense of belonging
Employees from another organization reported that personnel at the targeted facility faced racial discrimination and harassment for years before the attack.
personnel at the targeted facility suffered from racial discrimination and harassment for years leading up to the attack
A man with two handguns killed five coworkers and then himself at an organization with a history of racial discrimination and harassment. According to a coworker, he had reported at least one exchange to HR, but the case was closed when the complaint could not be corroborated.
the case was closed when the complaint could not be corroborated
A 45-year-old employee entered an office for a disciplinary meeting at which he was informed he would be fired.
A 45-year-old employee entered an office to attend a disciplinary meeting where he was informed that he would be fired.
The employee had numerous rule violations on his record, including a safety violation from one day earlier.
The employee had numerous rule violations on his record, including a safety violation from one day prior.
After the meeting shooting, the attacker went to another area of the campus and shot and killed the coworker who had reported his most recent safety violation.
The attacker then proceeded to another area of the workplace campus and shot and killed a coworker who had reported his most recent safety violation.
When police arrived, the attacker engaged in a shootout, injuring five officers before dying from gunshot wounds sustained in the exchange.
When police arrived, the attacker engaged in a shootout with them, injuring five officers before dying from gunshot wounds sustained during the exchange.
A 51-year-old man armed with two handguns shot and killed five colleagues at his workplace before fatally shooting himself.
A 51-year-old man armed with two handguns shot and killed five colleagues at his workplace before fatally shooting himself.
The organization where the attacker worked had a history of racial discrimination, bullying, and harassment of employees.
The organization where the attacker worked had a history of racial discrimination, bullying, and harassment of employees.
In the years before the attack, a noose and racist notes were left on the attacker's locker, and coworkers harassed him and called him racial epithets.
In the years leading up to the attack, a noose and racist notes were left on the attacker's locker, and he was harassed and called racial epithets by coworkers.
After the attack, other employees reported that the work environment was racially segregated and that management ignored incidents of discrimination.
After the attack, other employees reported that the work environment was racially segregated and that management ignored incidents of discrimination.
One attacker was transferred after complaining of coworker harassment, but the harassment continued and he was terminated for missing work.
the harassment continued even after his transfer, prompting him to miss work, eventually leading to his termination from employment
A man with a semiautomatic handgun killed one and injured three others at a manufacturing facility before dying by suicide. He had been fired after missing three days of work and had complained of coworker harassment that continued after his transfer.
The gunman had previously been terminated by the facility after missing three days of work
One employee attacker was transferred to a different department after complaining about being harassed by a colleague.
For instance, one attacker was transferred to a different department after complaining about being harassed by a colleague.
A 53-year-old man opened fire with a semiautomatic handgun at a manufacturing facility, killing one and injuring three others before dying by suicide.
A 53-year-old man opened fire with a semiautomatic handgun at a manufacturing facility, killing one and injuring three others before dying by suicide.
According to neighbors and police, he was an excellent employee who had never missed work before these absences, but he complained of being harassed by at least one coworker.
According to neighbors and police, the subject was an excellent employee who had never missed work prior to these absences, but he complained that he was being harassed by at least one coworker.
Although he had been transferred to a new department, the harassment continued, and he stopped showing up for work shifts and was terminated.
Although the attacker had been transferred to a new department, the harassment continued, and he stopped showing up for work shifts and was terminated.
One attacker opened fire at a video game tournament shortly after losing a match, and another targeted a healthcare facility that had expelled him from a treatment program.
one attacker opened fire at a venue hosting a video game tournament shortly after he lost a match
Other grievances included frustration over being denied services, being expelled from a business, and similar perceived slights.
Other grievances included frustration due to being denied services, being expelled from a business
A gunman previously treated for PTSD at a residential treatment center took five hostages, released two, and fatally shot the remaining three employees after an eight-hour standoff. One victim had expelled him from the program two weeks earlier because he had knives and threatened to kill staff.
locked himself in a room with the remaining three victims for eight hours
An attacker who opened fire in a newsroom office had harassed the newspaper's staff for years before the attack.
an attacker who opened fire in a newsroom office had been harassing the staff of the newspaper for years leading up to his attack
A 36-year-old gunman armed with a rifle, a shotgun, and a bulletproof vest took five hostages at a residential treatment center where he had previously been treated for PTSD.
A 36-year-old gunman armed with a rifle, a shotgun, and a bulletproof vest took five hostages at a residential treatment center where he had previously received treatment for post-traumatic stress disorder (PTSD).
The attacker fatally shot the three remaining hostages before dying by suicide.
The three hostages were fatally shot by the attacker before he died by suicide.
A man killed five people with a shotgun at a newsroom after an unflattering article about him. He had sued the paper years earlier, stalked and threatened employees, and mailed a dossier on the intended victims and their families before the attack.
The attacker had a personal grievance with the newsroom after an unflattering article was written about him
Before the attack, the attacker downloaded blueprints, recorded video of the building and access points, read textbooks on mass shootings, and studied police reaction times.
downloaded blueprints and recorded video of the newsroom building and its access points, read textbooks on mass shootings, studied police reaction times to previous attacks
Before the attack, the attacker created and mailed a dossier containing information about the intended victims and their families.
created and mailed a dossier with information about the intended victims and their families
In preparation for incarceration after the attack, the attacker sold his car and spent a significant portion of his income on a lifetime chess organization membership.
In preparation for his incarceration after the attack, the attacker also sold his car and spent a significant portion of his income on the purchase of a lifetime membership for a chess organization.
In a case example, a 38-year-old man entered a newsroom and opened fire with a 12-gauge pump-action shotgun, killing five people.
A 38-year-old man entered a newsroom and opened fire with a 12-gauge pump-action shotgun, killing five people.
The newsroom attacker had filed a defamation lawsuit against the paper six years earlier and had stalked and threatened its employees, who contacted law enforcement and developed personal safety plans.
The attacker had filed a defamation lawsuit against the paper six years earlier and had stalked and threatened employees of the paper, prompting them to contact law enforcement and develop personal safety plans.
Two of the six also attacked other locations, one targeting his wife's divorce attorney at the attorney's law office. A separate domestic-grievance attacker targeted divorce attorneys and mental health professionals who had evaluated his child during a custody dispute.
another attacker who targeted his wife's divorce attorney at the attorney's law office
A gunman took hostages outside a healthcare center where his ex-girlfriend worked, shot and killed a police chief, then fatally shot his ex-girlfriend and her coworker before dying by suicide. He had assaulted and threatened her multiple times, and one protection order was still in place at the time of the attack.
In the months prior to the incident, he had assaulted and threatened to kill his ex-girlfriend multiple times
The attacker had a lengthy history of violence and had abused at least one other woman in the past.
The attacker had a lengthy history of violence and had abused at least one other woman in the past.
One attacker motivated by a domestic grievance did not target a romantic partner's current workplace, but instead targeted the attorneys handling his divorce and the mental health professionals who had evaluated his child during a custody dispute.
One attacker motivated by a domestic grievance did not target a romantic partner's current place of employment, but instead targeted attorneys handling his divorce and mental health professionals who had conducted evaluations of the attacker's child during a custody dispute.
In a case example, a 43-year-old gunman armed with a shotgun and a pistol took two hostages in the woods outside the healthcare center where his ex-girlfriend worked.
A 43-year-old gunman, armed with a shotgun and a pistol, took two hostages in the woods outside of a healthcare center where his ex-girlfriend worked.
After law enforcement responded, the gunman shot and killed a police chief as the chief exited his vehicle.
After law enforcement responded to the scene, the gunman shot and killed a police chief as the chief exited his vehicle.
The gunman then entered the healthcare facility and fatally shot his ex-girlfriend and her coworker before dying by suicide.
The gunman then entered the healthcare facility and fatally shot his ex-girlfriend and her coworker before dying by suicide.
A warehouse employee used a forklift to block an exit before shooting coworkers with a revolver. On a call to police he described hearing voices since his teens, past treatment for psychosis, and a belief that a manager was attacking his mind.
used a forklift to block an exit before shooting coworkers with a revolver
The attacker claimed a manager was a powerful psychic attacking his mind and cited this as a contributing factor to his motive.
which he cited as a contributing factor to his motive
After the shooting, the gunman left the scene and contacted police.
The gunman then departed the scene and contacted police.
On the call, the attacker said he had heard voices since he was a teenager and had been treated for psychosis and schizophrenia.
On this call, the attacker told dispatchers that he had been hearing voices in his head since he was a teenager and that he had been previously treated for psychosis and schizophrenia.
The warehouse attacker who shot coworkers died by suicide later that evening.
The attacker died by suicide later that evening.
After a security professional described a past spree of killings by a terminated employee, leadership provided resources, funding, and formal authority to set up the BTAM program. The program was built with security, HR, and EAP partners.
After this conversation, leadership provided the security professional with resources, funding, and the formal authority to establish the company's BTAM program.
A threat manager lacked leadership support, and after layoffs an employee threatened to return with a gun. Staff did not report the threat because they lacked threat-handling training, and no additional resources were provided.
Due to their lack of training in handling threats, employees did not inform the threat manager about the employee's threat of violence or his termination.
During a chance encounter with a senior leader, the security professional described a past spree of killings by a terminated employee. Some of those impacted were employees whom the attacker felt had wronged him.
described an incident in the company's past when a terminated employee engaged in a spree of killings
The executive conceded that the company's investment in workplace violence prevention was not enough.
The executive conceded that the amount was not enough.
Despite the organization having thousands of employees, the threat manager was the sole person managing several important functions across numerous facilities.
Despite the organization having thousands of employees, the threat manager was the sole person managing several important functions
Recent structural changes, including a corporate merger and replacement of organizational leadership, added challenges to getting support.
Recent structural changes, including a corporate merger and the replacement of organizational leadership, had resulted in additional challenges.
During a round of mass layoffs, a violent incident was narrowly avoided when a laid-off employee with significant personal stressors threatened to return with a gun.
During a recent round of mass layoffs, a violent incident was narrowly avoided when an employee with significant personal stressors was laid off and threatened to return to the workplace with a gun.
Despite little initial support, the security professional developed pitches for specific executives that summarized the importance of a robust violence prevention program.
developed pitches for specific executives that quickly summarized the importance of a robust violence prevention program
In the first In Practice example, a security professional at Organization 1 received little support for workplace violence prevention efforts.
ORGANIZATION 1: A security professional received little support for workplace violence prevention efforts.
In the past incident the security professional described, some of those impacted were employees of the organization whom the terminated attacker felt had wronged him.
Some of those impacted were employees of the organization whom the attacker felt had wronged him.
After sharing the story of the past attack, the security professional asked the executive how much the company had invested in workplace violence prevention.
After sharing this story, the security professional asked the executive how much the company had invested in workplace violence prevention.
Partnering with personnel from security, HR, and the company's Employee Assistance Program (EAP), the security professional established an infrastructure to assess and manage concerns throughout the company.
Partnering with personnel from security, HR, and the company’s Employee Assistance Program (EAP), the security professional established an infrastructure to assess and manage concerns throughout the company.
In the second In Practice example, a threat manager at Organization 2 experienced significant challenges getting support for workplace violence prevention from organizational leadership.
ORGANIZATION 2: A threat manager experienced significant challenges getting support for workplace violence prevention from their organizational leadership.
The laid-off employee who had threatened to return to the workplace with a gun was ultimately arrested for trespassing on the premises.
The employee was ultimately arrested for trespassing on the premises.
The threat manager attempted to convince organizational leaders of the importance of proactive violence prevention efforts to avoid similar incidents.
The threat manager attempted to convince organizational leaders of the importance of proactive violence prevention efforts to avoid similar incidents.
Despite the threat manager's efforts, additional resources were not provided.
However, additional resources were not provided.
A university police executive advises organizations to personalize violence prevention and create an energy about prevention that inspires people.
You can personalize violence prevention. You can make it close to home.
A university police executive observes that in bigger organizations, someone knows someone who knows someone who has been impacted by a tragedy.
In bigger organizations, someone knows someone who knows someone who has been impacted by a tragedy.
A university police executive says practitioners can create an energy about prevention that can inspire people and fuel their care.
You can create an energy about prevention that can inspire people and fuel their care.
The university police executive adds that enthusiasm for violence prevention is contagious.
The enthusiasm is contagious.
Figure 5 is a sample resource inventory with three examples: an Ombudsman (use low, quality good), an Employee Assistance Program (use moderate, quality excellent), and a Third-Party Vendor for Employee Services (use high, quality excellent). For each it records what needs the resource meets, use, quality, gaps or barriers, and an action plan.
This sample provides three examples of the types of resources that organizations may leverage during the BTAM process.
In the sample inventory, the ombudsman provides alternative dispute resolution, mediation, and peer support; use is low (seldom used, highly available) and quality good (employees report it helped resolve some disputes). Gaps are low awareness and most concerns going solely to management; the action plan is to promote awareness and education about the resource and process.
**Ombudsman** Provides alternative dispute resolution, mediation, and peer support. | **Low** Seldom used; highly available. | **Good** Employees who received services report they helped to resolve some disputes. | • Awareness is low. • Most concerns are solely brought to management. | • Promote awareness and education about this resource and process.
In the sample inventory, the EAP provides counseling for relationship, substance, and mostly personal difficulties; use is moderate (less than expected, limited free sessions) and quality excellent. Gaps are confidentiality concerns and perceived stigma; actions are to identify additional counseling resources, enhance education on availability and confidentiality, and promote a non-retaliation policy.
**Employee Assistance Program (EAP)** Provides counseling for difficulties with relationships, substances, and mostly personal matters. | **Moderate** Not used as frequently as expected; limited number of free sessions available. | **Excellent** Employees who used services report they helped tremendously. | • Some employees report concerns about confidentiality. • Perception of negative stigma (e.g., being treated differently or poorly due to treatment). | • Identify additional resources for counseling. • Enhance education regarding availability and confidentiality. • Promote policy addressing non-retaliation.
In the sample inventory, a third-party vendor assists domestic violence victims with mental health, finances, moving, lodging, and more; use is high with a finite number of contracted referrals, and quality excellent. Gaps are referral-only access via the BTAM team, limited referrals, and possible growth in need; actions are to audit budget and costs to consider renewing and expanding the contract and to evaluate supplementary community resources.
**Third-Party Vendor for Employee Services** Offers assistance to victims of domestic violence, including help with mental health, finances, moving, lodging, and more. | **High** Frequently used; contract allows a finite number of referrals. | **Excellent** Employees who have received services report they were highly beneficial. | • Only available via referral from BTAM team. • Limited number of referrals available. • Needs for services may increase due to growing workforce. | • Audit budget and costs to consider renewing and expanding contract with vendor. • Evaluate similar community resources that can supplement services.
A BTAM team leader at a major retailer found that conveying concepts, not research vocabulary, helped people without a background in the field understand BTAM.
I realized the importance lies in the concepts, not the lexicon.
A retail BTAM team leader reports using direct, academic language from the research early in their career.
Early in my career, I used direct, academic language from the research.
A BTAM team leader at a major retailer says they started tailoring their language so that people without a background in the area can understand.
I started tailoring my language so that people without a background in this area can understand.
The retail BTAM leader gives an example of plain stakeholder messaging: stating what the stakeholder needs to know and what the leader thinks they should do about a concerning individual.
When talking to a stakeholder, I might say, “I need you to know X, Y, and Z, and here’s what I think you should do about a concerning individual.”
A BTAM team leader at a major retailer says the most important thing is how you communicate with people, and that their early academic language confused people.
The most important thing is how you communicate with people
A healthcare BTAM team said it wished it had started building relationships with team members and outside entities sooner. It found that meetings and shared knowledge helped.
Looking back now, I wish we would have started making relationships with team members and outside entities sooner.
A healthcare BTAM team said that talking with colleagues and community members in meetings and conferences is vital for BTAM practice.
Talking with colleagues and community members in meetings, conferences, and sharing knowledge is vital for the practice of behavioral threat assessment everywhere.
A BTAM team in a healthcare environment said that going to meetings, consulting with others, sharing information, and having a common language has been incredibly helpful.
For us, going to meetings, consulting with others, sharing information, and having a common language has been incredibly helpful.
A workplace safety manager offered police coffee and parking, then shared building plans and a campus map at a meeting. The report says these resources let law enforcement navigate the campus safely during an incident.
He introduced himself to the local police department and made coffee and parking spaces available for officers and their patrol cars
Over time, the organization established a strong relationship with law enforcement.
Over time, the organization established a strong relationship with law enforcement.
A newly hired workplace safety manager at a major corporation recognized the value of partnerships with local law enforcement.
A newly hired workplace safety manager at a major corporation recognized the value of partnerships with local law enforcement.
The workplace safety manager convened a meeting with officers, described the organization's mission and needs, and shared the building plans and a campus map with police.
The workplace safety manager convened a meeting with the officers, during which he described the organization’s mission and needs and shared the building plans and a campus map with police.
The shared building plans and campus map ensure law enforcement can safely and efficiently navigate the campus if an incident requiring law enforcement response occurs.
These resources ensure law enforcement will be able to safely and efficiently navigate the organization’s campus if an incident occurs that requires law enforcement response.
Making coffee and parking spaces available to officers encouraged police to visit the organization's campus more frequently.
which encouraged police to visit the organization’s campus more frequently
The sample policy statement begins by stating that the organization is dedicated to establishing and maintaining a safe workplace for all employees.
[Organization Name] is dedicated to establishing and maintaining a safe workplace for all employees.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
The sample policy establishes a named BTAM program dedicated to the proactive prevention of targeted violence in the workplace.
In support of that commitment, this policy establishes [name of the BTAM program], which is dedicated to the proactive prevention of targeted violence in the workplace.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
The sample policy states that the BTAM program will use a multidisciplinary team composed of specified personnel, departments, or units.
[Name of the BTAM program] will utilize a multidisciplinary team composed of [describe relevant personnel, departments, or units].
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
Under the sample policy, the BTAM team will receive, investigate, and assess workplace concerns and provide direction, management, support, and follow-up to address them before potential violence escalates to physical harm.
To achieve this mission, the [name of the BTAM team] will receive, investigate, and assess reports of concerns within the workplace, and provide direction, management, support, and follow-up to address concerns before the risk of potential violence escalates to physical harm.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
Sample language says the team convenes twice per month, with the team lead and at least a security manager, HR representative, legal advisor, and mental health professional.
The Behavioral Threat Assessment and Management (BTAM) Team will convene twice per month to review and assess potential concerns.
cite page 43 Step 2: Establish BTAM Program Policy and Procedures
Sample language requires that all meeting proceedings, attendance, decisions, and assigned actions be documented in a secure, access-controlled record.
All meeting proceedings, including attendance, topics discussed, decisions made, and assigned actions, will be documented in a secure, access-controlled record for accountability and future reference.
cite page 43 Step 2: Establish BTAM Program Policy and Procedures
The sample language requires the team lead and at least one security manager, human resources representative, legal advisor, and mental health professional to attend each meeting.
Required attendees will include the team lead, and at least one security manager, human resources representative, legal advisor, and mental health professional.
cite page 43 Step 2: Establish BTAM Program Policy and Procedures
Under the sample language, each meeting covers recent reports of concerning behaviors, ongoing case updates, risk management strategies, and recommendations for intervention or support.
During each meeting, the team will discuss recent reports of concerning behaviors, ongoing case updates, risk management strategies, and recommendations for intervention or support.
cite page 43 Step 2: Establish BTAM Program Policy and Procedures
Under the sample language, meeting actions may include assigning follow-up tasks, coordinating with external agencies, and updating case management plans.
Actions taken may include assigning follow-up tasks, coordinating with external agencies, and updating case management plans.
cite page 43 Step 2: Establish BTAM Program Policy and Procedures
A healthcare BTAM team moved from assigning members to selecting people interested in joining, and added onboarding to explain the process.
It's important to get the right people.
A healthcare BTAM team reported that members were previously identified because they were told to join.
Previously, team members were identified because they were told to join.
A BTAM team at a major healthcare organization says that once executives understood the program's vision and saw the team's good work, a new hiring process was developed to select people really interested in joining the threat assessment team.
Once the executives knew and understood the vision of the program and saw the good work the team was doing, a new hiring process was developed to select people really interested in joining the threat assessment team.
The healthcare BTAM team developed onboarding processes to get new members up to speed and teach them what the process entails.
We developed onboarding processes to get them up to speed and teach them what the process entails.
The healthcare BTAM team reports that the new selection and onboarding approach has been very helpful.
That has been very helpful.
An HR professional says HR is among the first to see concerns and that inviting HR onto the team can be more helpful than just asking them for information.
Inviting HR on the team can be more helpful than just asking them for information.
A cybersecurity professional says cyber is typically the last group contacted during a behavioral threat assessment and wants earlier involvement.
Cyber is typically the last group that is contacted during a behavioral threat assessment
A cybersecurity professional said that much cybersecurity work lends itself well to a prevention-based approach.
A lot of cybersecurity work lends itself well to a prevention-based approach.
A human resources professional urges organizations to put someone from HR on the behavioral threat assessment team.
Put someone from HR on the behavioral threat assessment team!
The HR professional says HR staff are among the first to see concerns or threats in the workplace.
HR are among the first to see concerns or threats in the workplace.
The HR professional says HR is often cautious about sharing information across departments but also has an obligation to protect the organization, which is the goal of a behavioral threat assessment.
While they are often cautious about sharing information across departments, they also have an obligation to protect the organization, which is the goal of a behavioral threat assessment.
A cybersecurity professional would like to see more bridging of the gap between cybersecurity and threat assessment.
I’d like to see more of a bridging of the gap between cybersecurity and threat assessment.
The body text on p.47 says Figure 7 shows one example in which a manager, a security official, an HR professional, and personnel from the legal department and EAP serve directly on the BTAM team; the team has no permanent representatives from IT, cybersecurity and insider threat, or the offices of the chaplain, ombudsman, or labor relations, but should engage them as needed.
In this example, a manager, a security official, an HR professional, and personnel from the legal department and EAP have representatives that serve directly on the
Why inferred The p.47 body text and the Figure 7 graphic disagree. Text: legal serves directly on the team and the ombudsman is not a permanent member. Figure: Ombudsman is a Core Member and Legal is an Ad Hoc Participant. This claim follows the body text.
Figure 7 shows Human Resources, Employee Assistance Program, Security, and Ombudsman as core members seated along the top of the BTAM team table.
Top side (dark blue, Core Member): Human Resources; Employee Assistance Program; Security; Ombudsman
Figure 7 shows Management as a core member at the left end of the BTAM team table.
Left end (dark blue, Core Member): Management
Figure 7 shows Information Technology as an ad hoc participant at the right end of the BTAM team table.
Right end (gray, Ad Hoc Participant): Information Technology
Figure 7 shows Cybersecurity and Insider Threat, Chaplain, Labor Relations, and Legal as ad hoc participants along the bottom of the BTAM team table.
Bottom side (gray, Ad Hoc Participant): Cybersecurity and Insider Threat; Chaplain; Labor Relations; Legal
NTAC offers free recurring virtual trainings delivered by NTAC staff on research findings and BTAM practice.
The U.S. Secret Service NTAC offers free recurring virtual trainings delivered by NTAC personnel.
To learn more about or register for NTAC's virtual training events, readers can visit https://www.secretservice.gov/ntac/virtual.
To learn more or to register for one or more of these training events, visit: https://www.secretservice.gov/ntac/virtual.
A security team at a global technology company says its Chief Compliance Officer holds quarterly meetings in every region to discuss what people are seeing, promote a "see something, say something" culture, and talk about active cases.
The Chief Compliance Officer holds quarterly meetings in every region where we discuss what people are seeing, promote a “see something, say something” culture, and talk about active cases.
The global technology company's security team relies on its personnel globally to report concerning information.
We rely on our personnel globally to report concerning information.
The security team says its 30-minute meetings benefit information sharing and show people that they are a team.
Having these 30-minute meetings really benefits information sharing and showing people that we are a team.
A BTAM professional at a major service chain says that when a team member is unsure which route to take, especially in mitigating risk, team members reach out to one another.
So if an individual team member runs into an issue where we feel like we don’t really know which route to take, especially as far as mitigating risk, then we reach out to one another.
The service chain BTAM team meets regularly as a team to brainstorm and collaborate.
We meet regularly as a team to brainstorm and collaborate.
A security team at a global technology company says information sharing is what keeps the company safe.
Information sharing is what keeps the company safe.
Figure 8 gives examples of concerning behaviors on a continuum from contextually concerning to objectively concerning.
from contextually concerning to objectively concerning (see Figure 8)
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Contextually Concerning, changes in behavior, including decreased productivity, increased absenteeism, decreased attention to personal hygiene and appearance, or withdrawal from social circles.
Changes in behavior, including decreased productivity, increased absenteeism, decreased attention to personal hygiene and appearance, or withdrawal from social circles
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Contextually Concerning, challenges with mental health, such as depressed mood, paranoia, or anxiety.
Challenges with mental health, such as depressed mood, paranoia, or anxiety
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Contextually Concerning, intense or abnormal emotional outbursts.
Intense or abnormal emotional outbursts
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Contextually Concerning, a pattern of strained or conflicted relationships with colleagues.
Pattern of strained or conflicted relationships with colleagues
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Contextually Concerning, questionable activity on work-issued devices, such as attempting to access prohibited sites or searching for inappropriate content.
Questionable activity on work-issued devices, such as attempting to access prohibited sites or searching for inappropriate content
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Objectively Concerning, bullying or harassing others.
Bullying or harassing others
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Objectively Concerning, preoccupation with violent themes, such as terroristic acts or mass shootings.
Preoccupation with violent themes, such as terroristic acts or mass shootings
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Objectively Concerning, intimidating, belligerent, or other aggressive behavior.
Intimidating, belligerent, or other aggressive behavior
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Objectively Concerning, direct or veiled threats.
Direct or veiled threats
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Objectively Concerning, expressions of homicidal or suicidal thoughts.
Expressions of homicidal or suicidal thoughts
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Objectively Concerning, physical violence toward people, animals, or property.
Physical violence toward people, animals, or property
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Objectively Concerning, sexual assault or harassment.
Sexual assault or harassment
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Objectively Concerning, bringing or brandishing a weapon in the workplace.
Bringing or brandishing a weapon in the workplace
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Figure 8 lists, under Contextually Concerning, fixations on perceived grievances.
Fixations on perceived grievances
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
In Mass Attacks in Public Spaces: 2016-2020 (2023), NTAC found that 41% of individuals who engaged in mass attacks in public or semi-public spaces, including workplaces, had a prior history of domestic violence, including intimate partner violence.
Sample (n = undeterminable of undeterminable) · NTAC Mass Attacks in Public Spaces: 2016-2020 (2023), a different study
41% of individuals who engaged in mass attacks in public or semi-public spaces, including workplaces, had a prior history of domestic violence
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
The 41% and 29% figures come from NTAC's 2023 study Mass Attacks in Public Spaces: 2016-2020.
Sample (n = undeterminable of undeterminable) · NTAC Mass Attacks in Public Spaces: 2016-2020 (2023), a different study
In Mass Attacks in Public Spaces: 2016 – 2020 (2023), NTAC found
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
In the same 2023 NTAC study, mass attackers in 29% of incidents were motivated at least in part by a domestic grievance.
Sample (n = undeterminable of undeterminable) · NTAC Mass Attacks in Public Spaces: 2016-2020 (2023), a different study
In 29% of the incidents, mass attackers were motivated to carry out their attack, at least in part, by a domestic grievance.
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
According to the CDC, victims of IPV lose nearly 8 million days of paid work each year in the United States. (endnote 9)
victims of IPV lose nearly 8 million days of paid work each year in the United States
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
According to the CDC, the estimated total cost of IPV, including medical care, mental health services, and lost productivity, exceeds $8.3 billion per year. (endnote 9)
the estimated total cost of IPV—including medical care, mental health services, and lost productivity—exceeds $8.3 billion per year
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
A therapist who supports IPV victims calls IPV one of the leading causes of workplace violence.
IPV is one of the leading causes for workplace violence.
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
The therapist says IPV cases tend to be more severe when IPV spills over into the workplace.
IPV cases tend to be more severe when IPV bleeds over into the workplace.
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
The therapist says stalking and monitoring behaviors tend to be the most common red flags when someone is reporting IPV at work.
Stalking and monitoring behaviors tend to be the most common red flags when someone is reporting IPV at work.
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
The therapist says coming forward about abuse requires power and confidence.
Coming forward requires power and confidence.
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
The therapist says it is important to give victims a lot of voice and choice: give them the information, then let them make their own choices.
It's important to give victims a lot of voice and choice.
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
The therapist calls trauma-informed care the most successful strategy for managing IPV, using a nonjudgmental, recovery-oriented stance.
The most successful strategy is trauma-informed care
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
For safety planning, the therapist asks what victims have already done, what has worked, and what has not.
For safety planning, we ask them what they've done already and what has worked, and what hasn't.
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
A therapist who supports IPV victims says that in an abusive relationship, victims have little control.
In an abusive relationship, victims have little control.
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
The therapist says victims have usually tried many approaches already, so making assumptions and listing tips wastes time.
Usually, they've tried a plethora of things already, and you'd be wasting your time by making assumptions and listing off tips.
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
A therapist who supports IPV victims says to give victims the information and then let them make their own choices.
You give them the information, then let them make their own choices.
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
The therapist says letting victims make their own choices gives them the power that their abuser is taking from them.
That's giving them the power that their abuser is taking from them
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
When victims do come forward, the therapist's practice follows the victim's lead with safety in mind.
When they do come forward, we follow the victim's lead with safety in mind.
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
The therapist describes abusive relationships, in which victims have little control, as disempowering by design.
It's disempowering by design.
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
A therapist who supports IPV victims says IPV is always a huge risk factor.
It's always a huge risk factor
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
A therapist who supports IPV victims says that when victims come forward, the practice makes a safety plan with them to achieve their goals.
We make a safety plan with them to achieve their goals.
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
A therapist who supports IPV victims says hearing the person out with a nonjudgmental stance gives them the space to talk about these things and allows for honesty.
It gives them the space to talk about these things and allows for honesty
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
A therapist who supports IPV victims says that, because abusive relationships are disempowering, practitioners must do the opposite in small ways and provide feedback on what victims are doing well.
we must do the opposite, and provide feedback on what they're doing well
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
A BTAM team leader at a global corporation says common cases include suicidal ideation, individual crises, difficulty managing work, and domestic violence.
A lot of what we tend to see are cases involving suicidal ideation, someone going through an individualized crisis
cite page 54 Step 4: Identify and Process Reports of Concerning Behavior
A hypothetical, previously above-average employee misses deadlines, is described by coworkers as distant and moody, denies any performance problems when his supervisor asks, calls in sick more often, and appears increasingly unkempt; the scenario is illustrative, not a real case.
Consider this scenario: An employee has recently demonstrated performance problems at work.
cite page 54 Step 4: Identify and Process Reports of Concerning Behavior
In the hypothetical scenario, an above-average employee has begun to miss deadlines and the quality of his work has declined.
Although he was previously an above-average employee, he has begun to miss deadlines, and the quality of his work has declined.
cite page 54 Step 4: Identify and Process Reports of Concerning Behavior
Coworkers report he has been "distant" and "moody" lately and might be having problems at home.
The employee's work acquaintances report he has been "distant" and "moody" lately and might be having problems at home.
cite page 54 Step 4: Identify and Process Reports of Concerning Behavior
A BTAM team leader at a global corporation says the team also sees issues with domestic violence and intimate partner violence in all of its regions across the globe.
We also see issues with domestic violence and intimate partner violence in all of our regions across the globe.
cite page 54 Step 4: Identify and Process Reports of Concerning Behavior
In the low-threshold scenario, the employee's supervisor asked the employee in a recent meeting what was happening.
In a recent meeting, the employee's supervisor asked the employee what was happening.
cite page 54 Step 4: Identify and Process Reports of Concerning Behavior
The employee said he did not know what the supervisor meant by the question and denied seeing any problems with his recent performance.
The employee remarked that he did not know what the supervisor meant by the question and denied seeing any problems with his recent performance.
cite page 54 Step 4: Identify and Process Reports of Concerning Behavior
In the weeks after the meeting, the employee began calling in sick with increasing frequency, and when he does come to work his appearance has become increasingly unkempt.
In the weeks since that meeting with his supervisor, the employee has begun to call in sick to work with increasing frequency, and when he does show up for work, his appearance has become increasingly unkempt.
cite page 54 Step 4: Identify and Process Reports of Concerning Behavior
In the scenario, the supervisor is worried about the wellness and safety of the employee.
The supervisor is worried about the wellness and safety of the employee.
cite page 54 Step 4: Identify and Process Reports of Concerning Behavior
The report gives a hypothetical example: a reporting option that suits a small food service business may not suit a large multinational corporation.
a reporting option that works for a small food service business may not be an appropriate solution for a large multinational corporation
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
A 2023 joint toolkit from the Secret Service and CISA outlines strategies for establishing and enhancing school bystander reporting programs. (endnote 12)
Improving School Safety Through Bystander Reporting: A Toolkit for Strengthening K-12 Reporting Programs (2023)
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
The report gives requests for reasonable accommodations as an example of a report outside the BTAM team's responsibilities.
requests for reasonable accommodations
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
A 2025 Security Executive Council and Mercyhurst University report that examined 424 incidents found that physical and cyber incidents targeting executives have doubled since 2024, resulting in record numbers (endnote 14).
physical and cyber incidents targeting executives have doubled since 2024, resulting in record numbers
cite page 58 Step 4: Identify and Process Reports of Concerning Behavior
A 2026 security report found that 42% of more than 2,000 surveyed chief security officers reported that the threat of violence toward executives had increased within the previous two years. (endnote 15)
Sample (n = undeterminable of undeterminable) · chief security officers surveyed for a 2026 security report (over 2,000)
a 2026 security report found that 42% of over 2,000 chief security officers who were surveyed reported that the threat of violence toward executives had increased within the previous two years.
cite page 58 Step 4: Identify and Process Reports of Concerning Behavior
In Mass Attacks in Public Spaces: 2016-2020 (2023), NTAC found that the workplace was the most common formal setting in which concerning behavior was observed.
NTAC found that the workplace was the most common formal setting in which concerning behavior was observed
NTAC research has shown that most attackers exhibited behaviors that elicited concern in others prior to their attacks, across a variety of systems.
most attackers exhibited behaviors that elicited concern in others prior to their attacks
Figure 9 illustrates a potential pathway for a report of concern from initial intake through to case closure.
Figure 9 on the following pages illustrates a potential pathway for a report of concern from initial intake to case closure.
Figure 9 (the left half of a two-page flowchart) starts at a received report and asks whether it involves an imminent threat to life. If yes, it goes to Emergency Response and loops until the situation is stabilized, then to Move to Full Assessment. If no, it asks whether the report is actionable and credible: if yes, a Preliminary Inquiry (initial interviews and records review, analysis of available information) leads to the question of whether there is a safety concern; if no, Make Referral to Alternative Resources.
Move to Full Assessment
Figure 9 continues: Full Assessment (interviews and records review, Systems Approach, Assessment Themes, analysis) leads to a decision whether the IOC poses a risk of harm to self or others. If yes, Implement Risk Management Strategies, then Evaluate, repeating the decision; if no, a check whether the IOC could benefit from other resources. If no, Close BTAM Case (document all actions, findings, and determinations; follow record retention protocols; share information as appropriate), ending in case closure.
Full Assessment
In Figure 9, when no risk of harm is found, the team asks whether the IOC could benefit from other resources; if yes, the case is referred to alternative resources and then closed.
Could the IOC* benefit from other resources?
In Figure 10, the center of the diagram represents the individual of concern who is the subject of the assessment.
The center of the diagram represents the individual of concern who is the subject of the assessment.
The circles around the individual of concern in Figure 10 represent some of the workplace and community systems that may provide important behavioral and contextual information about the individual to inform the BTAM process.
The circles surrounding the individual of concern represent some of the workplace and community systems that may provide important behavioral and contextual information about the individual to inform the BTAM process.
Figure 10 shows Supervisors & Coworkers as an internal system (orange circle) surrounding the individual of concern.
Supervisors & Coworkers (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Human Resources as an internal system (orange circle) surrounding the individual of concern.
Human Resources (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Physical Security as an internal system (orange circle) surrounding the individual of concern.
Physical Security (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Legal as an internal system (orange circle) surrounding the individual of concern.
Legal (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Information Technology as an internal system (orange circle) surrounding the individual of concern.
Information Technology (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Cybersecurity & Insider Threat as an internal system (orange circle) surrounding the individual of concern.
Cybersecurity & Insider Threat (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Law Enforcement as an external system (blue circle) surrounding the individual of concern.
Law Enforcement (blue)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Mental Health as an external system (blue circle) surrounding the individual of concern.
Mental Health (blue)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Judicial as an external system (blue circle) surrounding the individual of concern.
Judicial (blue)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Online & Social Media as an external system (blue circle) surrounding the individual of concern.
Online & Social Media (blue)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Family & Community as an external system (blue circle) surrounding the individual of concern.
Family & Community (blue)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
In this fictional example, a colleague's escalating statements led to interviews, a family check and coordinated outreach, after which the employee's workload was reduced and he was referred to counseling support.
employees at a software company submit a report of concern to the BTAM team about a colleague who is making increasingly agitated statements
In this fictional example, a retail customer's social media posts prompted employee interviews, an IT review and a consensual law enforcement interview, leading to a no-trespass order from physical stores.
The BTAM team determines that the individual presents a low risk for physical harm but a high risk for causing disruption at the store
Coworkers reported that the employee had claimed he might snap if things did not improve at work, and a supervisor reported a sharp decline in his performance and demeanor.
his coworkers report that he has claimed he might "snap" if things don't improve at work
The BTAM team's interview revealed that the employee was going through a difficult separation from his spouse, and his brother confirmed the struggle in a phone call.
discovers that he is going through a difficult separation from his spouse and has had trouble adjusting to this change, which the employee's brother confirmed during a phone call
In the fictional software-company example, the Systems Approach surfaced a supervisor's report of a sharp decline in performance and demeanor, coworkers' reports that he said he might snap if things did not improve, and HR's report of a coworker's complaints about his rude and combative nature.
During their assessment, the BTAM team uses the Systems Approach to identify several concerns about the employee
Through coordinated outreach by the BTAM team, the supervisor, and HR, the fictional employee's workload was temporarily reduced and he was referred to the company's EAP for counseling and support.
Through coordinated outreach between the BTAM team, his supervisor, and HR, the employee has his workload reduced temporarily and is referred to the company's EAP so that he may receive counseling and support.
In the fictional retail example, a frequent customer with a history of disruptive and concerning behaviors recently posted on social media alluding to something bad happening to the store.
A major retail outlet has a frequent customer with a history of disruptive and concerning behaviors who recently made posts on social media alluding to something bad happening to the store.
In the fictional retail example, the BTAM team gathered information by interviewing store employees, directing company IT to review the customer's publicly available social media posts, and coordinating with law enforcement on a consensual interview about the posts.
The BTAM team uses the Systems Approach to gather information through interviews with employees from the store, direct the company IT department to further review the individual's publicly available social media posts, and coordinate with law enforcement to conduct a consensual interview with the individual regarding the social media posts.
In the fictional retail example, the BTAM team worked with local law enforcement to issue the customer a no trespass order for all physical store locations while offering him discount codes for online shopping on the store's website.
The BTAM team works with local law enforcement to issue the customer a no trespass order from all physical store locations, while offering him discount codes for online shopping through the store's website.
The Assessment Themes are presented in NTAC's 2024 guide for state and local law enforcement, Behavioral Threat Assessment Units.
Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence (2024)
Figure 11 illustrates the contextual, behavioral, and summative themes that may be relevant to an assessment.
Figure 11 illustrates the contextual, behavioral, and summative themes that may be relevant to an assessment
A 37-year-old man called an impromptu meeting at his manufacturing workplace, shot five coworkers (three killed), then drove to two more locations and shot a business owner he knew.
On October 18, 2017, a 37-year-old man gathered coworkers around him by calling an impromptu meeting at the manufacturing facility where he worked
Coworkers reported the attacker's behavior to management and asked for help, but management reportedly refused to intervene because he was a good worker.
management reportedly refused to intervene because the attacker was a good worker, and no action was taken
The case table maps the attacker to contextual themes (stressors, interpersonal difficulties, mental health, criminal history), behavioral themes (intense anger or aggression, history of violence, stalking, harassing, or bullying, concerning or threatening communications), and summative themes (access to weapons, elicited concern in others, motive), each with case details such as financial hardship, felony convictions, and a purchased firearm.
Contextual Themes
The attacker drew a semiautomatic pistol and shot five colleagues in the head, killing three and injuring two.
He then drew a semiautomatic pistol and shot five of his colleagues in the head, killing three and injuring two others.
The attacker was motivated by a grievance against coworkers who frequently played pranks on others at work, of which he felt he was the victim.
The attacker was motivated by a grievance against his coworkers who frequently played pranks on others at work, of which he felt he was the victim.
After the shooting, the attacker drove to two more locations: a former workplace, where he likely targeted his former boss who was not there, and another location, where he shot and injured a business owner he knew.
including a former workplace where he likely targeted his former boss who was not there, and another location where he shot and injured a business owner he knew
Before the attack, the attacker had several stressors, including financial hardship and strained relationships inside and outside the workplace.
Prior to his attack, the attacker experienced several stressors in his life, including financial hardship and strained relationships both inside and outside of the workplace.
After his assault, the attacker was known to be paranoid, believing others were searching for him or out to get him.
In the aftermath of his assault, he was known to be paranoid, believing others were searching for him or out to get him.
To protect himself, the attacker purchased a firearm, which was illegal for him because of felony convictions on his record, and reportedly kept it with him at all times.
To protect himself, the attacker purchased a firearm illegally due to felony convictions on his criminal record and reportedly kept the weapon with him at all times.
The attacker had a history of threatening and concerning behavior at previous jobs and was terminated from those positions because of aggressive behavior.
Additionally, the attacker had a history of threatening and concerning behaviors in his previous jobs and was terminated from these positions due to his aggressive behavior.
He was arrested for assaulting a coworker by placing him in a chokehold, dragging him outside, and throwing him to the ground hard enough to cause unconsciousness.
On one occasion, he was arrested for assaulting a coworker after he put the coworker in a chokehold, dragged him outside, and threw him to the ground so hard that the coworker lost consciousness.
Six months before the attack he was fired from a previous job after a physical altercation with his manager over a raise that had been discussed but not granted.
In a separate incident six months before the attack, the attacker was fired from a previous job after initiating a physical altercation with his manager because he was not granted a raise that was previously discussed.
The attacker began working at the manufacturing facility about four months before the attack.
The attacker began working at the manufacturing facility about four months before the attack.
He was known to act in a paranoid, hostile, and argumentative manner and harassed his coworkers.
He was known to act in a paranoid, hostile, and argumentative manner and harassed his coworkers.
He accused non-English speakers of gossiping, used derogatory language toward them, threatened to kill them, and assaulted coworkers he felt disrespected him.
accusing non-English speakers of gossiping about him, using derogatory language toward them
Three years before the attack, the attacker was a victim of physical assault in a parking lot.
Three years prior to his attack, he was also a victim of physical assault in a parking lot.
Others in the workplace noticed the attacker's behaviors, and coworkers reported their concerns to management and requested help.
These behaviors were noticed by others in the workplace, and coworkers reported their concerns about the attacker's behaviors to management and requested help.
Figure 12 presents the four elements (address factors, redirect motives, create a less prone situation, Systems Approach) with example strategies for each.
FIGURE 12 Elements of Risk Management
If an individual of concern is bullied in the workplace, the employee's supervisor, HR, and/or EAP services may work together to address and intervene with the bullying, create safeguards for reporting bullying behavior, and provide access to counseling and emotional support services.
if an individual of concern is bullied in the workplace
If a customer complains about financial hardship, the organization may liaise with community services to refer the customer for employment or income assistance.
If the individual of concern is a customer who, for example, complains about financial hardship, the organization may liaise with community services to refer the customer for employment or income assistance.
Monitoring can include observing behavior and communications, check-ins, tracking physical movement, and monitoring online activity on a company device or network.
Monitoring can include observing the employee's behavior, interactions, and communications with coworkers and clients; check-ins; tracking physical movement throughout a workplace; and monitoring online activities while on a company device or network.
A retailer's office offers tailored solutions for employees of concern, including relocation, mental health counseling, financial grants, and crisis intervention contracts.
offering tailored solutions to manage risk for employees of concern
The retailer's one-stop office offers worksite relocation for employees facing personal or professional problems, free mental health counseling and mindfulness apps, financial grants, and contracted clinical psychologists for crisis intervention.
This includes worksite relocation services for employees experiencing personal or professional problems (e.g., bullying or harassment at home or at work), free mental health counseling services and mindfulness applications, financial grants, and contracted clinical psychologists for crisis intervention services.
The retailer advertises these resources to employees so they know what is available and how to seek assistance.
These resources are advertised to employees, so they know what is available and how to seek assistance.
An HR professional says that if someone given every opportunity to get it right still shows no improvement, it is time for a formal reprimand, with the employee told the next steps, such as suspension, a PIP, a last chance agreement, or termination.
If someone is given every opportunity to get it right, and there is still no improvement, then it is time for a formal reprimand to prevent things from getting worse.
A BTAM team leader at a healthcare agency says getting people together helps teams learn which community resources are available.
Generally speaking, it's helpful to get people together so that they know what resources are available in the community.
An HR professional says a manager's responsibility is to coach the individual and help them, and if that does not work, to talk to them about what they are not doing right and what they need to fix.
As a manager, your responsibility is to coach the individual and help them … If that doesn’t work, talk to them about what they are not doing right and what they need to fix.
A BTAM team leader at a healthcare agency says providing assistance builds trust and helps the team gather information.
That really helps in building trust and helps us with gathering information
An HR professional says there are steps to take when an employee has gone off track.
There are steps to take if someone has gone off track.
The HR professional advises telling the employee the next steps, such as suspension, a PIP, a last chance agreement, or termination.
Tell the employee what the next steps are, such as suspension, PIP, last chance agreement, or termination.
The HR professional advises informing the employee of what they need to do for the entire time they are employed.
Inform the employee of what they need to do for the entire time they are employed with you.
The HR professional says there should be plenty of communication so that there are no surprises.
There should be plenty of communication so that there are no surprises.
The HR professional says the aim is to ensure people are not surprised that they are in trouble.
You want to ensure people are not surprised that they’re in trouble.
A BTAM team leader at a healthcare agency says their team provides assistance.
We provide assistance.
The healthcare BTAM team leader says many BTAM teams do not know about outside resources because of a lack of information sharing and partnering with others.
A lot of BTAM teams don’t know about outside resources because of a lack of information sharing and partnering with others.
A multinational technology company queries prior contacts after customer-service threats, warns or restricts the customer, notifies the closest facility, and contacts law enforcement if the situation escalates.
When a threat is received, the BTAM team runs queries to identify previous contacts with the customer
At a nationwide healthcare network, when patients engage in problematic or concerning behaviors, a flag placed in the patient's digital record notifies staff.
When patients engage in problematic or concerning behaviors, a flag placed in the patient’s digital record notifies staff.
A multinational technology company frequently receives threats through its customer service sector.
A multinational technology company frequently receives threats via their customer service sector.
The tech company's team manages the customer by sending warnings, restricting access to company services, and identifying and notifying the company facility closest to the customer's location.
From there, the team manages the customer by sending warnings, restricting access to the company’s services, and identifying and notifying the company facility closest to the customer’s location.
If the situation escalates, the tech company's team contacts law enforcement.
If the situation escalates, the team contacts law enforcement.
A nationwide healthcare network has a BTAM team that specializes in handling concerns related to its patients.
A nationwide healthcare network has a BTAM team that specializes in handling concerns related to their patients.
Staff at the healthcare network also send letters to the patient's family to notify them of concerns.
Staff also send letters to the patient’s family to notify them of concerns.
The healthcare network has its own law enforcement personnel ready to respond to imminent risk or crisis, or when criminal activity is suspected or identified.
The organization has its own law enforcement personnel ready to respond to situations of imminent risk or crisis or when criminal activity is suspected or identified.
The healthcare network employs mental health professionals, including counselors and social workers, who practice trauma-informed care and serve patients struggling with their mental health.
The organization also employs mental health professionals, including counselors and social workers, who practice trauma-informed care and offer services to patients struggling with their mental health.
The healthcare network's BTAM team can leverage partnerships with other personnel in the organization to assess and manage patients of concern.
The BTAM team can leverage partnerships with other personnel in their organization to assess and manage patients of concern.
After a threat is received and prior contacts are queried, the multinational technology company's BTAM team assesses whether this behavior is a trend and whether it is indicative of violent intent.
assesses whether this behavior is a trend and whether it is indicative of violent intent
A security director at a major healthcare network tells employees not to wait for something to happen before engaging with the resources offered, such as five free counseling sessions.
We tell employees not to wait for something to happen to say something, but to proactively engage in resources.
cite page 86 Step 7: Promote a Safe and Supportive Organizational Climate
A security director at a major healthcare network said that for patients to be first, the organization needs a healthy workforce to care for people.
For patients to be first, we need to have a healthy workforce to care for people.
cite page 86 Step 7: Promote a Safe and Supportive Organizational Climate
The same security director said that employees who are not healthy themselves will not have a vested interest in the mission or the capacity to care for others.
If employees are not healthy themselves, then they won’t have a vested interest in our mission or the capacity to care for others.
cite page 86 Step 7: Promote a Safe and Supportive Organizational Climate
The security director said the network offers resources to employees struggling with finances, stress, or depression, including five free counseling sessions to use as they need.
If someone isn’t feeling well due to finances, stress, depression, we have resources to offer our employees, including five free counseling sessions for them to use as they need.
cite page 86 Step 7: Promote a Safe and Supportive Organizational Climate
The Ban the Box campaign has advocated removing checkboxes that ask applicants to disclose felony convictions so they are evaluated on qualifications first.
have advocated for the removal of these checkboxes to promote fairness in hiring practices so that applicants with criminal histories can first be evaluated on their qualifications
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
An HR professional says that if leaders do not act on survey results, people will stop sharing their thoughts and burn out.
If you don't, people will stop sharing their thoughts, and they will burn out.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
A human resources professional said organizations should make sure they are listening to staff and that staff feel heard.
You want to make sure you’re listening to your staff, and that your staff feel heard.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
The HR professional said employee engagement surveys are good, but that organizations need to take action on things that come up in them.
Employee engagement surveys are good.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
The HR professional advised making people feel integral to the organization.
Make people feel integral to the organization.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
The HR professional advised helping employees understand what their role means for the strategic plan and organizational mission.
Help them understand what their role means for the strategic plan and organizational mission.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
The HR professional said these engagement efforts will take different shapes depending upon the organization.
This will take different shapes, depending upon the organization.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
The HR professional said that if engagement is done right, it is less likely someone will go off the deep end.
But if you do it right, it’s less likely someone will go off the deep end.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
The report notes that prior guidance for other settings, such as K–12 schools, treats training and outreach as a best practice for bystander reporting.
Prior guidance for other settings, such as K–12 schools, emphasizes training and outreach as a best practice for enhancing bystander reporting.
The organization has found these more intentional forms of raising awareness on workplace violence prevention to be more effective than the traditional all-service awareness training approach.
The organization has found these more intentional forms of raising awareness on workplace violence prevention to be more effective than the traditional all-service awareness training approach.
The organization has been intentional with the frequency of electronic communication, steering clear of oversaturating inboxes, and instead uses a combination of electronic communication and other types of messaging at the physical job site.
steering clear of oversaturating inboxes with messaging, and instead using a combination of electronic communication and other types of messaging at the physical job site
A healthcare organization moved from a broad all-service awareness training model to a tailored approach using small group sessions, personalized discussions, and team meetings.
A healthcare organization has shifted from a broad all-service awareness training model to a more tailored approach, utilizing small group sessions, personalized discussions, and team meetings to connect with personnel.
The organization's on-site messaging includes flyers, pamphlets, and posters in bathroom stalls.
This includes flyers, pamphlets, and posters in bathroom stalls.
A healthcare system security director says the overall goal is to reduce fear through education, with situational awareness and response training as critical elements.
The overall goal is to reduce fear through education.
A global organization's BTAM team ran awareness sessions with HR, legal and other teams, teaching staff to act on a cluster of behaviors rather than wait for harm. The team says it still receives requests about these sessions four or five years later.
if you start seeing behaviors, especially a cluster of behaviors, you take action then.
The global BTAM team reports its sessions were especially successful with middle management, who then advocated on the team's behalf.
These were really successful with middle management especially, who would then start to advocate on our behalf.
A security director at a major entertainment company says micro-learnings, short online videos distilled from training content, are among the most helpful tools for educating employees.
We have found micro-learnings to be one of the most helpful tools in educating the masses at our organization.
A security director at a major entertainment company reports that each of the company's micro-learning videos ranges in length from 9 to 12 minutes.
Each video ranges in length from 9-12 minutes.
The entertainment company says micro-learnings help it reach employees across multiple worksites and time zones.
These micro-learnings also help us reach employees across multiple worksites and time zones.
A security director for a healthcare system says enhancing situational awareness and training people on how to respond is critical.
Enhancing situational awareness and training people on how to respond is critical.
A BTAM team at a global organization said it ran successful awareness sessions with specific teams, including human resources and legal, identifying the concerns it looks for.
We did very successful awareness sessions where we got in front of specific teams—human resources, legal, and others—and we identified concerns we're looking for.
The BTAM team said it taught these groups not to wait for someone to physically assault someone else before acting.
We taught them how we don't want to wait for someone to punch someone else.
The BTAM team said it started these trainings four or five years ago and still gets contacted about them.
We started these trainings four or five years ago, and we still get contacted about them.
A security director at a major entertainment company said the company distills training content into short videos made available online.
We have been able to distill content into short videos that we make available online.
The security director said the videos help educate employees on important topics, including workplace violence prevention, in a timeframe compatible with their other tasks.
This is helpful in educating our employees on really important topics, including workplace violence prevention, in a timeframe that is conducive to other tasks they are managing.
Find the Perfect Training Class For You
