The FBI studied 63 active shooters who attacked in the United States between 2000 and 2013 and found that every single one displayed concerning behavior that somebody noticed. On average, each attacker showed 4.7 observable concerning behaviors, with people from about three different groups spotting them. Seventy-seven percent spent a week or longer planning. Seventy-three percent had a known connection to the attack site.
The same study found no usable profile of who becomes violent. Demographics, employment history, and personality traits failed to separate attackers from the general population. What did separate them was behavior over time, which is why threat assessment practice focuses on what a person is doing rather than who they appear to be.
NIOSH sorts workplace violence into four categories, and each one calls for different detection and response.
Bureau of Labor Statistics data from the 2024 Census of Fatal Occupational Injuries, published in February 2026, recorded 733 fatalities from violent acts, of which 470 were homicides, up from 458 in 2023.
The FBI study ranked concerning behaviors by how often others observed them. Behaviors tied to mental health appeared in 62 percent of cases, problematic interpersonal interactions in 57 percent, leakage of violent intent in 56 percent, and concerning quality of thinking or communication in 54 percent.
Leakage deserves particular attention. It means communicating intent to harm to a third party, through a comment, a message, a post, or a journal entry. In the FBI sample, leakage reached someone in 56 percent of cases, and not one instance of observed leakage was reported to law enforcement. People heard it and did nothing with it.
The behaviors that most often warrant a closer look include:
Seventy-nine percent of the shooters in the FBI sample had an identifiable grievance, and nearly half of those experienced a triggering event connected to it shortly before the attack. Terminations, disciplinary action, a denied promotion, a legal ruling, and a relationship ending all show up in the research as precipitating events.
Some signals get dismissed because they look like ordinary workplace friction or ordinary personal difficulty.
Legacy tokens are one. Thirty percent of the shooters in the FBI study created videos, manifestos, or written materials intended to be found afterward. Material of that kind posted publicly is often read as attention seeking rather than preparation.
Pathway behaviors are another. The model widely used in threat assessment traces a progression from grievance to ideation, research and planning, preparation, breach, and attack. Research and planning show up as questions about schedules, photographs of entrances, or unusual interest in who will be present at an event. Those steps look administrative in isolation.
Domestic violence spillover gets overlooked repeatedly. Requests to change shifts, a partner appearing at reception, screened calls, and a protective order naming a work address are indicators of Type IV risk, and they usually reach HR rather than security.
Withdrawal gets weighted incorrectly in both directions. Depression and isolation appeared frequently in the FBI sample, and the research cautions against treating either as predictive on its own, since most people who withdraw never become violent. The signal strengthens when withdrawal sits alongside grievance, leakage, or escalating conflict.
Online presence is where the gap has widened since the FBI data was collected. In that sample, drawn from attacks ending in 2013, concerning behavior appeared online in a minority of cases, because the platforms that now host most expression of grievance were smaller or did not exist. Behavior that previously surfaced in a hallway conversation now surfaces in a forum thread, a reply, or an account that nobody at the organization is watching.
Open source intelligence covers publicly available information: social platforms, forums, comment sections, alternative and fringe networks, paste sites, court filings, and deep and dark web spaces. For workplace violence, that material fills in what internal reporting misses.
Internal systems capture what happens at work. HR files hold complaints, discipline, and performance history. Access logs record entries. Those records stop at the perimeter, and grievance rarely does. A terminated employee posting about the company by name, a customer escalating from complaint to threat across several platforms, and an estranged partner publicly naming an employee's workplace all sit outside internal systems.
Collection for this purpose works best when anchored to specific terms: facility addresses, executive and manager names, brand terms, and the names of subjects already under assessment. Threat monitoring and alerting against that set produces reviewable volume, and deep and dark web search extends coverage into spaces where threatening content migrates after removal from mainstream platforms.
Open source findings become useful once they connect to an identity, a timeline, and a decision.
Attribution comes first. A threatening post means something different from a former employee with site knowledge than from an anonymous account in another country. Investigations and identity resolution work links personas to real people, which is the step that converts an alarming post into an assessable subject.
Timeline comes second. Threat assessment reads escalation, so the useful question is whether activity is intensifying, specifying a target, or moving toward preparation. Liferaft's work on measuring threat escalation velocity sets out one method for judging that rate of change.
Documentation comes third. Screenshots pasted into email lose timestamps, URLs, and collection context, which weakens them for an HR proceeding, a restraining order application, or a law enforcement referral. Logging findings in case management preserves the record and builds the history that makes a repeat subject recognizable months later.
Analysts handle the judgment throughout, since credibility, capability, and proximity all require human assessment. Guidance on fitting that review into existing tooling appears in our piece on integrating AI into an existing security program.
Intervention gets easier the earlier it happens on the pathway. A grievance raised at the ideation stage can be addressed through mediation, an accommodation, a benefits referral, or a structured separation. The same grievance at the preparation stage leaves only physical measures and law enforcement.
The FBI data supports the timing argument. Most attackers spent a week or more planning, and in the majority of cases the first concerning behavior appeared months before the attack. Detection windows exist, and organizations tend to lose them to unclear reporting routes rather than to the absence of signals.
Reporting mechanics determine whether early detection happens at all. Employees need a route that does not require them to decide whether something is serious enough, protection from retaliation, and visible evidence that reports lead to something other than punishment for the person who raised them.
Programs now operate under specific legal requirements in several jurisdictions. California Labor Code section 6401.9, created by Senate Bill 553, has required nearly all California employers since July 1, 2024 to maintain a written workplace violence prevention plan, train employees annually, and record every incident in a violent incident log retained for five years. New York enacted comparable protections for retail workers. The OSHA general duty clause applies nationwide where an employer knows of a recognized hazard.
The structural components that hold a program together include a multidisciplinary threat management team, which the ASIS and SHRM workplace violence standard identifies as a best practice, drawing on security, HR, legal, and behavioral expertise. A single intake channel routes concerns from employees, managers, and monitoring to the same place. Written thresholds define what triggers assessment, escalation, and law enforcement contact. Case documentation preserves assessments and outcomes, and periodic review across risk trends and analysis shows which sites, roles, and signal types keep recurring.
Teams building or revising a program can book a discovery call to see how open source monitoring supports each stage.
Liferaft, a Securitas company, continuously monitors social media, forums, alternative networks, and deep and dark web sources against terms an organization defines, including facility locations, executive names, and subjects already under assessment. Alerts surface threatening or escalating activity, identity resolution connects accounts to real people, geospatial mapping shows proximity to sites, and case management holds the evidence and assessment history for threat management teams, HR, legal, and law enforcement referrals.
OSINT means intelligence derived from publicly or commercially available information. The sources include social platforms, forums, comment sections, alternative and fringe networks, paste sites and credential dumps, court filings, corporate registries, property records, news reporting, and public geospatial data. Collecting that material produces data. It becomes intelligence after an analyst validates it, assesses it against a stated requirement, and delivers it to someone able to act.
Beyond workplace violence, security teams apply OSINT to executive protection, event and site security, travel risk and duty of care obligations, insider threat, brand and executive impersonation, protest and civil unrest monitoring near facilities, and exposure assessment covering leaked credentials and published employee information. A broader walkthrough of those applications appears in our guide to implementing OSINT in a security stack
.
Prevention is possible in many cases and guaranteed in none. The FBI research shows attackers display observable concerning behaviors over extended periods, and that at least one person noticed in every case studied, which means intervention opportunities existed. Programs that combine clear reporting routes, a trained threat management team, and monitoring of both internal and open sources find cases earlier and resolve most of them without violence. Random criminal violence during a robbery offers far less warning than worker-on-worker escalation, so prevention capability varies by type.