The 8 Behavioral Warning Signs Every Organization Must Monitor
- CrisisWire
- Nov 2
- 6 min read
By Warren Pulley, CrisisWire Behavioral Threat Assessment Expert
Most workplace violence is preventable. The Secret Service National Threat Assessment Center proves attackers rarely strike without warning. They leak intentions. They fixate on grievances. They prepare methodically.
Organizations ignore these signals until tragedy forces reaction. CrisisWire Threat Management Solutions stops violence before it starts by identifying the eight behavioral warning signs research has validated across 40 years of threat assessment operations.
Contact CrisisWire: crisiswire@proton.me
The Research Foundation
FBI Behavioral Analysis and Secret Service studies identified eight proximal warning behaviors that precede targeted violence. These aren't personality traits. They're dynamic actions signaling accelerating risk.
My BTAM certification training at University of Hawaii West Oahu emphasized these behaviors. Across Baghdad Embassy security operations, LAPD patrol zones, and campus safety programs serving 40,000+ students, I've observed how these warnings manifest before violence erupts.
The eight behaviors appear in published research on corporate insider threats, school shootings, workplace attacks, and executive protection cases.
Warning Behavior 1: Pathway
Definition: Planning and preparation for attack.
Pathway behavior includes reconnaissance of target locations, acquiring weapons, researching attack methods, and practicing scenarios. During my six years directing Baghdad Embassy security, pathway detection prevented multiple attacks through OSINT monitoring and behavioral surveillance.
DHS guidance emphasizes pathway as the most actionable warning sign because it represents concrete steps toward violence. Organizations implementing behavioral threat assessment programs can interrupt pathway behaviors before they escalate.
What to monitor: Unusual interest in security procedures, facility blueprints, employee schedules, or active shooter response protocols.
Warning Behavior 2: Fixation
Definition: Increasing preoccupation with a person, cause, or grievance that deteriorates social and occupational functioning.
Fixation isn't mere anger. It's obsessive focus that consumes the individual's life. Research published on Academia.edu shows fixated individuals stop engaging in previously enjoyed activities, withdraw from relationships, and demonstrate narrowing attention on their perceived enemy.
My crisis intervention training during 12 years with LAPD taught me fixation appears in repeated contacts with targets, excessive social media monitoring, and persistent grievance expression even after resolution attempts.
Healthcare workplace violence studies show fixation on specific staff members precedes 60% of patient-on-staff attacks. Joint Commission standards now require healthcare organizations to identify and manage fixated individuals through threat assessment teams.
What to monitor: Repeated unwanted contact, surveillance of targets, deteriorating work performance while maintaining fixation intensity.
Warning Behavior 3: Identification
Definition: Adopting a "warrior" or violent identity, often through association with past attackers or extremist ideologies.
Identification manifests when individuals begin modeling themselves after school shooters, terrorists, or violent extremists. They adopt pseudo-commandos personas, collect manifestos, and express admiration for attackers.
FBI research reveals 78% of school shooters demonstrated identification behavior before attacks. During my work as University Campus Safety Director, identification warnings emerged through concerning social media posts, disturbing creative writing, and glorification of violence.
ASIS International guidance on K-12 threat assessment emphasizes identification as a critical warning requiring immediate school threat assessment team intervention.
What to monitor: References to past attackers, consumption of violent extremist content, adoption of military or tactical language and imagery.
Warning Behavior 4: Novel Aggression
Definition: Acts of violence uncharacteristic for the individual, often toward people or animals.
Novel aggression represents a concerning escalation. The previously non-violent individual engages in physical violence, animal cruelty, or property destruction. OSHA workplace violence data shows novel aggression often precedes workplace homicides by 3-6 months.
Through U.S. Air Force OPSEC Program Manager training, I learned threat actors "test" their capacity for violence through escalating aggressive acts. My published research documents this pattern in corporate insider threat cases.
California SB 553 now requires employers to document and respond to all violent incidents, recognizing novel aggression as a predictor of escalation.
What to monitor: First-time physical altercations, property damage, threats to harm, or reports of animal cruelty.
Warning Behavior 5: Energy Burst
Definition: Increased activity and engagement after prolonged depression or isolation, often signaling attack preparation.
Energy burst deceives observers who interpret renewed activity as improvement. The suicidal or depressed employee suddenly seems "better"—but this energy fuels attack preparation.
Secret Service research identifies energy burst in 40% of workplace attack cases. The individual who had withdrawn now engages with targets, settles affairs, and demonstrates purposeful activity.
During my Baghdad Embassy Protection operations, I observed energy burst behavior in individuals who had decided on violence and were completing final preparations. My threat assessment training emphasizes distinguishing genuine improvement from attack preparation energy.
What to monitor: Sudden mood improvement in previously depressed individuals, increased purposeful activity, "tying up loose ends" behaviors.
Warning Behavior 6: Leakage
Definition: Communicating intent to attack to third parties, either directly or indirectly.
Leakage appears in concerning statements, social media posts, creative writing, drawings, or confiding in peers. FBI analysis found 81% of school attackers leaked intentions before violence.
My experience investigating workplace violence incidents reveals leakage often dismissed as "venting" or "dark humor." Organizations without behavioral threat assessment programs fail to recognize leakage significance.
Research published on Archive.org shows effective school safety programs create reporting mechanisms for students to report leakage behaviors. My published books detail leakage recognition across multiple threat environments.
What to monitor: Concerning statements about violence, suicidal ideation combined with grievance, threats disguised as jokes.
Warning Behavior 7: Direct Communication of Threat
Definition: Explicitly stating intent to harm a target.
Direct threats represent high-risk situations requiring immediate response. However, threat assessment research distinguishes between individuals who make threats versus those who pose threats.
My 12 years as LAPD patrol and vice officer taught me most direct threats don't result in violence—but all require professional evaluation. FEMA training emphasizes organizations need workplace violence prevention programs that assess threat context, not just threat content.
Partner Alliance for Safer Schools (PASS) guidance on K-12 environments emphasizes developmental differences in threat assessment for youth versus adults.
What to monitor: All direct threats require documentation and assessment, regardless of perceived credibility.
Warning Behavior 8: Last Resort
Definition: Belief that violence is the only remaining option to resolve grievance or achieve goals.
Last resort thinking represents the most dangerous warning sign. The individual perceives all non-violent options exhausted. DHS guidance identifies last resort as the final pathway stage before attack execution.
During my work implementing campus behavioral intervention programs, last resort emerged through statements like "I have no choice," "There's no other way," or "They've forced me to do this."
Crisis management research shows organizations can disrupt last resort thinking by providing alternative grievance resolution mechanisms. My emergency management consulting helps organizations create intervention pathways before individuals reach last resort conclusions.
What to monitor: Expressions of hopelessness combined with grievance, statements indicating perceived lack of alternatives.
Why Organizations Miss These Warnings
Most organizations lack behavioral threat assessment frameworks to identify and respond to warning behaviors. Security focuses on physical measures while missing behavioral indicators.
OSHA workplace violence prevention guidelines require systematic approaches to threat identification. My specialized training programs teach organizations to recognize warning behaviors before violence occurs.
Published case studies compare organizations that prevented attacks through early warning recognition versus those that failed to act on behavioral signals. The difference: structured threat assessment teams trained to identify and manage concerning behaviors.
Building an Effective Response System
Recognizing warning behaviors requires multidisciplinary threat assessment teams combining HR, security, legal, and mental health perspectives. FBI guidance emphasizes teams need training in behavioral analysis, not just security protocols.
CrisisWire consulting services develop customized threat assessment programs including:
Healthcare organizations facing Joint Commission compliance requirements need specialized violence prevention programs addressing patient-on-staff violence.
Corporate environments managing insider threat risks require behavioral monitoring integrated with cybersecurity protocols.
Educational institutions need developmentally appropriate threat assessment frameworks distinguishing concerning behavior from typical student development.
Taking Action Now
The eight behavioral warning signs provide actionable indicators organizations can monitor systematically. Research validates early intervention prevents violence more effectively than reactive security measures.
Organizations need threat assessment expertise combining operational experience with behavioral science. My 40 years across U.S. Air Force security operations, LAPD patrol, Baghdad Embassy Protection, and university campus safety provides the practical framework organizations need.
Don't wait for tragedy to force reaction. Implement behavioral threat assessment now.
📧 Contact CrisisWire: crisiswire@proton.me🌐 Services: CrisisWire Threat Management Solutions📚 Resources: The Threat Assessment Handbook | The Prepared Leader📊 Research: Academia.edu/crisiswire | Archive.org | Scribd
About the Author
Warren Pulley, founder of CrisisWire Threat Management Solutions, has 40 years of experience in security operations including U.S. Air Force, LAPD, Baghdad Embassy Protection, and Director of Safety at Chaminade University. He holds 30+ certifications including U.S. State Department Worldwide Protective Specialist and is a Partner Alliance for Safer Schools (PASS) member.
Featured By: ABC7 Los Angeles | NPR/LAist
Certifications: BTAM Certified | ALICE Certified Instructor | 30+ FEMA Certifications
Published Works: 5 books including Threat Assessment Handbook and The Prepared Leader
Comments