Preventing Targeted Workplace Violence: The Eight Steps

Updated October 2026

By Chris Grollnek, Active Shooter Expert

Short answer. Preventing targeted workplace violence is now a federal how-to. On 21 October 2026 the U.S. Secret Service’s National Threat Assessment Center published Preventing Targeted Workplace Violence: A U.S. Secret Service Guide to Behavioral Threat Assessment and Management, a 100-page, public-domain guide that studies 50 mass attacks at American workplaces and then lays out the eight steps an employer takes to prevent the next one. We read every page. This is what the Secret Service asks of an employer, the number behind each ask, and what each one looks like when we build it with a client.

A word on where we stand to read it. The U.S. Department of Justice selected our P.R.O. Model™ as “A” national standard for the Assistant United States Attorneys and across the Department, and it is in use at some installations and commands across the Department of Defense. The model’s first letter is prevention, and the Secret Service guide is the federal build sheet for that letter. We have not found a page of it that argues with how we work, and we found several that explain it better than we have.

What does the Secret Service mean by targeted workplace violence?

A premeditated act of violence at a workplace, aimed at a specific person, group or location, generally unrelated to other crime, and carried out by someone the workplace already knew or could reasonably have identified. The 50 attacks in the study were chosen on that last condition. Every attacker was a current or former employee, a regular customer, client, patient or visitor, or a romantic partner or relative of someone connected to the site. Those attacks killed 119 people and injured 128, an average of nearly five casualties each.

The places were ordinary: retail and service businesses took 28 percent of the attacks, restaurants and bars 20 percent, manufacturing and distribution 20 percent, and healthcare 14 percent. Open spaces, residential communities, non-profits, government, a school and a military installation took the rest. Firearms were used in 86 percent. Every attack with a bladed weapon came from a customer, patient or visitor. That is a map of where your people already work, not a list of exotic targets.

Why does the report say prevention is possible?

Because the attackers were visible long before they were dangerous. Of the 51 attackers, 78 percent had already behaved in a way that concerned someone, and 61 percent had made someone fear for safety. Seventy-five percent had made concerning communications, and 92 percent had a notable stressor in the five years before the attack. Among the customers, patients and visitors who attacked, 65 percent had already caused concern at that same location, and 60 percent had a triggering event in the month before. The Center’s wider five-year study found that the workplace was the most common formal setting where concerning behavior was ever observed. In this research the employer is the first place the signal shows up, long before anyone would call it a security problem.

The report’s own words on page 9: “Those who pose a risk of violence do not always make direct threats prior to an attack, but they often communicate their intentions to those around them.” The whole program is built to catch that communication and do something useful with it.

Why is a workplace attack different from other mass attacks?

It ends worse and it starts closer than other attacks, and the numbers say both. Forty-six percent of the workplace attacks ended with the attacker’s suicide, against 16 percent of the non-workplace attacks the Center studied. In 60 percent of the attacks the attacker died during or shortly after. Law enforcement stopped 18 percent and bystanders 4 percent; in three quarters the attacker stopped when he chose to. Attacks by current or former employees averaged 5.68 casualties, the highest of the three attacker types. Seventy-three percent of those attackers were still employed the day they attacked. Most struck during or right after a shift, and five had kept the weapon in a vehicle on the premises, so the person was inside before anything anyone would call an incident began.

What are the eight steps, and what do we build for each one?

The second half of the guide is a scalable framework, and the table is the plain version of it. The middle column is the Secret Service’s ask in its own terms. The right column is what that step looks like when we build it, from a behavioral threat assessment program inside a workplace violence prevention program.

Step	What the Secret Service asks	What we build with you
1. Commit to employee safety and support	Leadership buy-in, a resource inventory, partnerships with police and mental health before they are needed	The executive briefing and the resource inventory, with the memorandum of understanding drafted for the local agency
2. Establish policy and procedures	A BTAM policy with goals, scope, authority, thresholds and privacy; standard operating procedures	Policy and SOPs written on the guide’s sample language and your counsel’s redlines
3. Assemble a multidisciplinary team	Management, HR, security, IT, legal and the employee assistance program at the core; police, mental health and labor relations ad hoc	Team charter, roles, a meeting rhythm, and the team’s own training
4. Identify and process reports	Train everyone on behaviors of concern, open several reporting channels including an anonymous one, triage for emergency, credibility and action	The reporting program and the intake screen, with the low threshold of concern written in
5. Gather information to assess risk	Preliminary inquiry or full assessment using the Systems Approach and the twenty assessment themes	The inquiry and assessment forms, and the practice cases the team runs before it has a live one
6. Develop risk management strategies	Address the factors, redirect the motive, create a situation less prone to violence, use the systems; safe separation for terminations	The case-management plan template and the safe separation protocol, which is the heart of our P.R.O. Model™ Workforce Care program
7. Promote a safe and supportive climate	Safe hiring, fair discipline, bullying and harassment handled, employee resources, a culture of safety	The climate assessment, because nearly half of the attacked organizations had a climate problem their own people could describe
8. Train all employees	Orientation plus refreshers, accessible formats, continuous messaging between cycles	Training for the whole workforce, in person and in short modules, with the posters and reminders that keep it alive

Does the building still matter?

Yes, and the report says why. Fifty-seven percent of the attackers walked in from outside as customers, patients, visitors or partners. That is why the assessment of the building, the lot and the glass beside the locked door sits alongside the people program rather than instead of it. The guide is also scalable on purpose; the Secret Service says a small food-service business and a multinational do not need the same reporting system, and neither do our clients.

What does the report say about layoffs and terminations?

It says, on page 81, that “terminating an employee does not eliminate the risk an employee poses,” and it backs that with the cases. Five of the employee attackers had been terminated by the organization they attacked. One opened fire at the end of his own termination meeting, and another came back seven years later. In a vignette on page 34, a company in the middle of mass layoffs narrowly avoided an attack when a laid-off employee threatened to return with a gun, and nobody told the threat manager, because nobody had been trained to.

The guide’s safe separation strategies include notifying security and IT in advance, a calm setting, a “soft landing” of severance or services, proper offboarding of badges and credentials, and post-separation follow-up. They read like the checklist we built P.R.O. Model™ Workforce Care around. A reduction in force is the single most predictable window of risk an employer ever schedules, and now the Secret Service has said so in print.

What does it say about domestic violence at work?

That it is a workplace matter whether the employer wants it to be or not. Fifty-three percent of the attackers had a history of domestic violence, and only a third of those had ever been charged, so the background check was clean. Among the nine attackers who were romantic partners or relatives, seven had a history of threats and domestic violence, three were ever charged, every one used a firearm, and six targeted an estranged or former partner at her place of work. The guide gives employers a list that costs almost nothing: a parking space near the door, flexibility on leave, anonymized schedules, coordination with local shelters, more security presence where the risk is, and the National Domestic Violence Hotline on the wall. It also notes, from the CDC, that victims of intimate partner violence lose nearly eight million days of paid work a year.

Who is required to have a plan?

More employers every year. The guide points to California’s Senate Bill 553, in force since July 2024, which requires most employers in the state to keep a written workplace violence prevention plan, an incident log and employee training. It notes that other states have been working to establish or expand their own requirements since. We say the same thing to every client who asks whether they are required to do this: the statute is the floor, and the Secret Service has just published the standard. A program built to the eight steps satisfies the law as a side effect.

What is the first step for an employer this quarter?

Name the problem before the program, which is exactly how the guide’s Step 1 begins: with a resource inventory, a plain table of what you already have, how often it is used, how well it works and where the gaps are. That is where we start too, with an assessment rather than a sales call. The first conversation is free and carries no obligation, and we build only what the assessment shows is missing. Most employers already own more of the eight steps than they think: an EAP, an HR process, a security contract, a counsel. What they are missing is the team that connects them and the threshold that tells the team when to act.

Why it is worth doing

The problem is that the person most likely to harm your people already has a badge, a chart or a reason to be in the lot. The impact, by the Bureau of Labor Statistics figures the guide carries, was 928 workers killed in intentional homicides in 2023 and 2024, and 77,780 more injured badly enough to miss work. The solution is eight steps the Secret Service has written down and given away, and a partner who has built them before. The consequence is the one nobody will thank you for, an ordinary day, which is the only outcome prevention ever produces. As the guide puts it on its last page, “The U.S. Secret Service has long held that prevention is the best form of protection,” and so have we.

Our founder’s first-person read of the guide, including what he would do on Monday morning as an executive, is on the active shooter expert‘s own site.

Sources

• National Threat Assessment Center. (2026). Preventing Targeted Workplace Violence: A U.S. Secret Service Guide to Behavioral Threat Assessment and Management. U.S. Secret Service, Department of Homeland Security. Figures above are from pages 13 to 27, 33, 34, 52, 80 to 81 and the appendix tables on pages 94 and 95.
• National Threat Assessment Center. (2023). Mass Attacks in Public Spaces: 2016 to 2020. U.S. Secret Service.
• Bureau of Labor Statistics. (2026). Census of fatal occupational injuries and nonfatal cases involving days away from work, 2023 to 2024, as cited in the guide. bls.gov
• Centers for Disease Control and Prevention. Intimate partner violence, costs and lost work days, as cited in the guide. cdc.gov
• California Department of Industrial Relations. Workplace violence prevention, Senate Bill 553. dir.ca.gov
• National Domestic Violence Hotline: thehotline.org, 1-800-799-7233, or text START to 88788.