Behavioral Threat Assessment Program

The prevention layer that turns the P.R.O. Model™ from doctrine into a program you can actually run.

At the Active Shooter Prevention Project, LLC (ASPP™), we talk about prevention every day, and we mean something specific when we say it. Prevention is not a slogan and not a poster. Prevention is a program with a team, a process, a measurement discipline, and a decision authority. The name of that program, when it is doing its work, is a Behavioral Threat Assessment program. This piece is our field-tested view of what one looks like when it is built to the standard the U.S. Department of Justice selected for the P.R.O. Model™, A national standard for active shooter prevention, first for 2022 to 2025 and again for 2026 to 2030.

We write this from the perspective of what we have watched work across schools, houses of worship, corporate campuses, hospitals, distribution centers, stadiums, and federal facilities. The founding principal of ASPP™ is a former U.S. Marine and retired police detective corporal with more than three and a half decades of operational experience, and the Community of Experts around him carries 800+ years of combined experience across 140 partnerships, 28 strategic partners, and 21 states plus four countries. When we say a Behavioral Threat Assessment program is measurable now, we mean we have been in the buildings where the measurement changed the outcome.

What a Behavioral Threat Assessment Program Actually Is

A Behavioral Threat Assessment program is the operational discipline that takes a signal from a supervisor, a coworker, a teacher, a parent, a receptionist, or an anonymous reporter and moves it through a repeatable process that ends in one of three outcomes: no threat, threat managed, or threat referred out. The FBI has documented for years that active shooters generally exhibit four to five observable pre-attack behaviors in the weeks and months before an event. Those signals are not rare, and they are not the province of clinical specialists alone. They are ordinary human observations by ordinary people at work or school. What has been missing is the receiving system.

A functioning program has a team, a written policy, a training cadence, a reporting mechanism, an investigation and triage protocol, an intervention playbook, a monitoring and closure process, and a documentation trail. None of those pieces is difficult in isolation. The difficulty is standing them up together, keeping them running through leadership turnover, and measuring them in a way that survives audit and litigation. That is what this piece is about.

We are careful to say program, not team, because a team can dissolve, and a program cannot. A program lives in the policy, the calendar, the intake channel, the training schedule, and the audit trail. When people move, the program persists.

Where Behavioral Threat Assessment Fits Inside the P.R.O. Model™

The P.R.O. Model™ stands for Prevention, Response, and Options in that order because it reflects how outcomes are actually decided. Response is where the world spends most of its money and most of its attention, and while response is necessary, it starts after the threat is in motion. The outcome of a prevention program is measured by incidents that never happen, and until this decade, the industry could not measure such incidents with any rigor. That is what has changed.

Behavioral Threat Assessment sits squarely inside the Prevention layer of the P.R.O. Model™. It is not the whole of Prevention, nor a substitute for Response. It is the operational discipline that enables an organization to receive, evaluate, and act on the pre-attack behavioral signals the FBI has documented before those signals compound into a decision to act. Options, the third layer, holds the physical hardening, sensor grids, indoor mapping, and technology stack that buy time when Prevention has already done what it can, and Response has to catch up.

The reason we insist on this ordering is that a poorly ordered program spends response dollars first, leaves prevention as an aspiration, and treats the physical layer as a substitute for the doctrine. A well-ordered program treats prevention as the operating system, response as the safety net, and options as the time-buying assets in the middle. Behavioral Threat Assessment is where the operating system lives.

The Team You Need, and Why It Is Cross-Functional

A Behavioral Threat Assessment team is, by design, cross-functional. It cannot live inside HR alone, and it cannot live inside Security alone. Each discipline sees a different face of the same signal, and the assessment lives at the intersection.

The core roles we recommend a program stand up before its first case:

1. Program lead. A named individual with authority to convene the team, order an assessment, and escalate to leadership. In many organizations, this is a Director of Security or a Chief Human Resources Officer. Whoever holds it, the role has to have a title on the org chart and a budget line.
2. Human resources. HR carries the employment relationship, the performance record, the accommodation history, and the operational levers that most interventions actually use: schedule change, coaching, EAP referral, leave, or separation with dignity.
3. Security. Security carries the physical environment, the access-control history, the incident record, and the coordination with local law enforcement when a threat crosses the referral threshold.
4. Mental health. A clinical partner, typically through an Employee Assistance Program or a contracted clinician, provides the interview capability and the treatment referral when the assessment surfaces mental-health drivers. The mental-health role is not there to diagnose from a distance; it is there to interview and refer.
5. Legal counsel. General counsel or an outside employment lawyer keeps the program inside the guardrails that protect the subject’s rights, the organization’s obligations, and the documentation trail. Legal is not a brake on the program. Legal is the reason the program can act quickly when it needs to.
6. Operations liaison. Whoever runs the site, the facility, or the school. They know the physical layout, the workflow, and the day-to-day pattern the subject moves through. They see what the team cannot.
7. Leadership sponsor. A C-suite or superintendent-level sponsor whose visible endorsement keeps the program funded through turnover. The single most common failure mode we see is a program that outlives its founding executive and starves under the successor. A named sponsor is the antidote.

Some organizations add a communications lead, an academic partner, or a union representative depending on their setting. Those roles are appropriate. The seven above are the minimum we teach.

The Process, in Five Working Steps

A program is only as good as the process it runs. We teach five steps, in this order, with named owners and named timelines:

1. Report. A signal enters the system through a defined channel: a see-something-say-something intake, an anonymous reporting platform, a supervisor referral, a school-counselor referral, an EAP self-referral, or a law-enforcement notice. Every organization needs at least two channels because different populations use different doors. The reporting channel is measured by how many signals it captures, not by how few. A low report count is a sign the channel is not trusted, not a sign the workplace is safe.
2. Triage. Within a defined service level (we recommend twenty-four hours for a first-pass triage, faster if the signal contains explicit risk language), the program lead and one other team member classify the signal on a documented scale. Not all signals become assessments. The purpose of triage is to route.
3. Investigate. An assessment gathers information from the workplace record, the digital environment, the physical environment, and interviews with the subject and knowledgeable observers, in that order. The purpose of the investigation is to answer three questions: is there a pathway to violence being walked, is there an intent, and is there a capability. The answer to all three at once is not required for concern.
4. Intervene. The intervention playbook is written before the first case. Common tools include leadership check-in, coaching, performance management, medical or EAP referral, schedule change, temporary access reduction, mandatory training, separation with dignity, or, when the threshold is crossed, referral to law enforcement. Every tool has a documented owner and a documented paper trail.
5. Monitor and close. A case is not closed when the intervention completes. It is closed when a monitoring period confirms that the pathway has been redirected. We recommend a documented monitoring window of thirty, sixty, and ninety days depending on severity, with a formal close decision at the end.

Every step is documented. Every timestamp lives in the record. When an audit or a subpoena arrives, the program’s documentation is what stands between the organization and the second-guessing.

Measurement — the Part That Was Always Missing, Until Now

For most of our founding principal’s career, the honest answer to “how do you know the program is working” was that we count the incidents that never happened. The problem with counting things that never happened is that they leave no receipts. That is what has changed. The 2026 technology stack, sensor grids, indoor mapping, digital twins, edge nodes, computer vision, and behavioral analytics, has finally caught up with the doctrine, and prevention is now measurable.

What we measure inside a Behavioral Threat Assessment program:

• Mean time to first triage from the moment a signal enters the system.
• Percentage of the facility footprint covered by the sensor and camera grid, mapped against a floor-plan digital twin so blind seams are visible before an attacker finds them.
• Mean time from a computer-vision or behavioral-analytics alert to a human eye on it.
• Percentage of signals that produce a documented intervention within a defined service level.
• Post-intervention coverage delta, meaning the measurable change in visibility or access-control posture after a case closes.
• False-positive rate on the intake channel is tracked so the channel gets calibrated over time rather than abandoned.
• Training frequency, coverage, and pass rates across the workforce.

The point of measurement is not to build a dashboard for its own sake. The point is that when a leader asks, “If I invest here, what am I actually buying?” we can answer with minutes, not with a promise. Every metric on the list above buys minutes. Every minute buys the space between a signal and an outcome. That space is where prevention lives.

Federal and Research Grounding

A Behavioral Threat Assessment program is not an ASPP™ invention. It is a discipline the federal government has documented for decades, and the doctrine we teach is aligned with the primary sources any general counsel would recognize:

• The U.S. Secret Service National Threat Assessment Center (NTAC) publishes the “Mass Attacks in Public Spaces” reports and the “Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence.” Both are foundational. In October 2026 NTAC added Preventing Targeted Workplace Violence: A U.S. Secret Service Guide to Behavioral Threat Assessment and Management, an eight-step framework for employers, which we walk through step by step here.
• The Federal Bureau of Investigation publishes the annual Active Shooter Incidents reports and the Mass Victimization Prevention Report (June 2025). The FBI’s four-to-five pre-attack behavioral signals sit inside those reports.
• The Department of Homeland Security operates the Nationwide SAR Initiative and the “If You See Something, Say Something” campaign, and DHS CISA publishes the K-12 School Security Guide plus the Insider Threat Mitigation Guide.
• The U.S. Department of Justice, through the COPS Office and the National Institute of Justice, funds and evaluates active shooter prevention curriculum, including the selection of the P.R.O. Model™ as A national standard for the 2022 to 2025 and 2026 to 2030 cycles.
• Academic partners at institutions such as the Association of Threat Assessment Professionals (ATAP) and university-based threat assessment programs contribute to the peer-reviewed foundation the field builds on.

When we teach a program, we teach against those primary sources. A program that cannot cite them in its policy document is a program that has not done the reading.

What a Strong Program Looks Like in an Audit

If we walked into your organization tomorrow and audited your Behavioral Threat Assessment program, here is the checklist we would run through. If your program hits the numbers, we would tell your board it is measurable, defensible, and current. If it misses, we would tell you where and why.

1. Named team with signed charter. Seven roles filled, named backup for each, current within twelve months.
2. Written policy. Reviewed by counsel, signed by the leadership sponsor, referenced in the employee handbook and the student or member code of conduct.
3. At least two reporting channels. One human, one anonymous. Both operational within the last thirty days. Metrics on volume, source, and disposition.
4. Documented triage service level. Twenty-four hours or faster to first-pass classification. Evidence of actual practice.
5. Investigation protocol. The three-question framework in writing, evidence of use in at least two closed cases in the last twelve months.
6. Intervention playbook. Nine to twelve documented options, each with a named owner and a documentation template.
7. Monitoring and closure discipline. 30-, 60-, and 90-day windows in policy. Evidence of closed cases with formal close records.
8. Training cadence. Annual for the team, ongoing awareness training for the workforce, tracked by completion rate.
9. Measurement dashboard. The seven metrics we listed in the section above, tracked at a stated cadence.
10. Sensor grid mapped to a digital twin. Coverage percentage tracked; blind seams identified; remediation timelines documented.
11. Legal review current. Employment law, privacy law, and any sector-specific rules (e.g., FERPA, HIPAA, GDPR, when applicable) reviewed within the last 12 months.
12. Board-level reporting. A quarterly summary for the leadership sponsor to read and sign. Not a compliance formality, an operational review.

This is the checklist we take to corporate campuses, school districts, and houses of worship, and we are not the only ones who use one like it. The checklist is not proprietary. What is proprietary, and what we bring to the engagement, is thirty-five years of pattern recognition on which items fail first and why.

A 30-60-90 Day Plan to Stand Up a Program

For an organization that does not yet have a program, we teach a phased build that gets the program operating in 90 days and measurable in 120. The plan is deliberately conservative because a program that launches in a hurry and stumbles in month four does more damage than a program that launches in month four and holds.

Days 1 to 30, team and policy. Convene the seven-role team. Name backups for each. Draft the policy against counsel. Choose the intake channels. Publish the reporting channel to the workforce so people know it exists. Do not accept cases yet; you are not ready.

Days 31 to 60, training and tooling. Deliver initial training to the team on the doctrine, the process, and the primary-source references. Deliver awareness training to the workforce on what to report and how. Stand up the tooling: the intake platform, the case-record template, the documentation trail, and the measurement dashboard. Run a tabletop exercise on a fictional case. Refine the process based on what you find.

Days 61 to 90, first cycle and measurement baseline. Open the intake channels for live cases. Capture the first ten to twenty signals through the process. Do not expect a case in the first week; the reporting culture takes time to build. Capture the baseline measurements on triage time, intake volume, and coverage. Deliver the first quarterly summary to the leadership sponsor.

Days 91 to 120, audit and iterate. Run the twelve-point audit against your own program. Fix what you find. Report the results to the board with candor. Publish the second version of the policy with lessons learned. You are now operating a program.

Where Houses of Worship, Schools, and Nonprofits Fit

Not every organization has a Fortune 100 budget. That is why our half-rate policy for houses of worship and nonprofits is locked into every engagement we take. Prevention is A national responsibility, and we do not price organizations that serve their communities out of the discipline that keeps their communities safe.

For houses of worship, the seven-role team often collapses into a smaller committee that combines Operations and Security under a lay leader, with the mental-health role handled through a partnership with a local clinician or a diocesan or denominational resource. The intake channel can be as simple as a dedicated email address that the congregation trusts. The measurement discipline is the same. Scale down; do not scale out.

For schools, the team overlaps with the existing student support team, with a threat assessment protocol layered on top per the U.S. Secret Service NTAC guidance for K-12 environments. Every state now has some version of a school safety statute; the program aligns to the statute and to the district’s board policy.

For nonprofits, we recommend applying for funding through FEMA’s Nonprofit Security Grant Program (NSGP) and the state administrative agency, using the Behavioral Threat Assessment program as the anchor of the security plan the grant supports. No provider can guarantee an award, but a program built to the standard we describe here is what strong applications look like.

The Team We Bring to the Engagement

When an organization engages ASPP™ to help stand up or audit a Behavioral Threat Assessment program, we bring the Community of Experts as the bench behind the work. That bench is 800+ years of combined experience across 140 partnerships, 28 strategic partners, and 21 states plus four countries. Every member of the bench signed on because they wanted to protect people, not because they wanted a marketing badge.

Our founding principal briefed federal leadership in more than one administration, testified before House Ways and Means, contributed to a joint DHS committee convened by Rep. Peter King, and delivered Senate-side testimony convened by Sen. Kay Bailey Hutchison. He served as a post-9/11 CSIS terrorism analyst under Dr. Bill Taylor, contributed to the Mackenzie Institute in Canada, and briefed the Deputy Assistant Secretary of Defense (Nuclear Matters) at Blue Grass Army Depot. On the venue side, he served as the NFL Active Shooter Prevention Coordinator at Super Bowl LVIII and Super Bowl LIX and led facility assessments at NBA and NHL venues, including Madison Square Garden. The DNFSB Program of Instruction he authored is in service at a nuclear facility, and the P.R.O. Model™ is A national standard the DOJ selected twice, first for 2022 to 2025 and again for 2026 to 2030.

We say this not because we like listing credentials. We say it because a Behavioral Threat Assessment program is a serious undertaking, and the people you bring in to help build one should be able to show their work at the level where the standard is written.

A Word on Politically Neutral Prevention

We are politically neutral on prevention because evil does not discriminate, and neither do we. A Behavioral Threat Assessment program serves the people inside the building, whoever they are, whatever they believe, and whatever they wear to work in the morning. That is the frame we bring to every engagement, and the one we ask every program we help build to adopt.

We also want to say plainly that the language of prevention should never be the language of fear. Dread paralyzes. Measurement acts. A program built on fear alienates the workforce it is trying to protect. A program built on measurement and preparation earns the workforce’s trust and lasts. Prepared, not scared, is the frame that pulls people forward. Destination #NEVERHERE™ is the north star that keeps everyone rowing in the same direction.

The Ask

If you lead an organization of any size, at any tier, in any sector, the ask we make of you is not a check. The ask is attention. Attention becomes a team, a team becomes a program, a program becomes measurement, and measurement becomes minutes. Minutes become lives. That is the compounding curve every leader we work with cares about, whether they say it out loud or not.

You can print money. You cannot print time. A Behavioral Threat Assessment program buys time for the people you are responsible for. We are ready to help you stand one up, audit the one you have, or bring the Community of Experts to bear on the specific corner of the discipline that needs the most work. When you are ready, we are ready.

Next action: If your organization needs a Behavioral Threat Assessment program stood up, audited, or reinforced, contact ASPP™ at aspppro.com/contact-us for a scoping conversation. One session, real numbers, destination: #NEVERHERE™.

Behavioral threat assessment during a workforce reduction

A behavioral threat assessment program proves its value under load, and few conditions load an organization like a reduction in force. Concerning behavior does not wait for a convenient quarter, and the period surrounding a separation compresses stressors that a program would otherwise see spread across months.

Two practical failures show up again and again. First, the assessment team is engaged after the announcement, when the useful window has already been open for weeks. Second, the team’s work runs parallel to the HR separation schedule rather than integrated with it — two plans, two owners, and no single view of who is being separated when, or which managers are delivering that message.

P.R.O. Model™ Workforce Care is the version of this program built for that specific event: pre-announcement threat landscape assessment, behavioral threat management synchronized to the HR timeline, dignified-offboarding training for the leaders delivering the news, and defined escalation pathways for the months after the departure date. P.R.O. Model™ Workforce Care or find it on the Resources page.