Active Threat Assessment: A Methodology to Identify Immediate, Imminent, and Potential Threats

Threat assessment means different things to different people. Security professionals, military personnel, psychologists, and school counselors all conduct threat assessment. As a law enforcement professional, the type of threat assessment you need may vary based on the type of problem you are trying to solve.

Which one is right for your organization and your officers?

I. Threat Assessment: Same Term. 3 Different Tasks.

To people who work in the security or protection industry threat assessment is often used to describe a process where an individual or team visits and assesses the security risks associated with a particular location. This threat assessment considers all threats against a location (i.e., natural, criminal, terrorist, accidental, etc.). The outcome of this security threat risk assessment is often a document describing risks and vulnerabilities at the location and recommendations on how to improve safety and security. (Refroe and Smith, 2016)

To psychologists, counselors, and therapists a threat assessment is used to describe a process or a tool that allows an evaluation of a subject’s predilection or likelihood of harming themselves or others. These threat assessments may be performed by schools (primary/secondary/university), court, and healthcare systems. This violence threat risk assessment can then be used to develop treatment plans for helping this individual. (NASP, 2014)

Identifying the Active Threat

In the law enforcement, security, and military community threat assessment is also used to describe a process through which an officer observes and identifies potential threats and immediate threats (e.g. active shooters, terrorists, criminals). These potential threats then become a focus for further observation or interdiction.

This threat assessment approach can also involve watching a specific subject to determine if they are carrying a weapon or likely to cause harm. Your officers likely perform this type of threat assessment routinely; during traffic stops, while on foot patrol, or responding to calls for service.

At Second Sight, we use the term active threat assessment to describe the identification of immediate, imminent, or active threats by a law enforcement officer. These threats could be against the public or the officer themselves. The security threat risk threat assessment, the violence threat risk assessment, and the identification of potential threats by law enforcement, military, and security personnel are all important tasks. There are also other types of threat assessments too. They require training and a systematic approach to ensure they are performed correctly.

If you would like to read more about threat assessment approaches, please take a look at our Guide to Threat Assessment Approaches for Law Enforcement.



II. Defining Active Threat Assessment: A Threat Assessment Methodology.

Active threat assessment is a methodology that involves identifying potential, immediate, or imminent threats. It requires a focused observation of behaviors & actions. As part of this threat assessment methodology, officers systematically observe their environment, identify potentially suspicious individuals (or a person of interest), and assess the extent that person of interest (POI) is a threat. A POI as an individual whom by their suspicious activity, lack of an explainable objective or display of threatening behavior becomes a target for further investigation through observation or physical interdiction. Further observation of the POI involves an assessment of threat indicators. Threat indicators are verbal or visual behaviors that imply an individual is being deceptive, threatening, trying to hide in plain sight, or carrying contraband or weapons. These assessments, in combination, allow the identification of active threats.



III. Difficulties in Assessing Active Threats

Active threat assessment is simple by description but difficult to execute. There are four problems that make it difficult for your officers to observe and assess active threats.

Problem #1: Context

First, think about all the places where your officers work – airports, train stations, parks, concerts, sporting events, schools, open-air market places. Think about patterns of behavior at a train station in comparison to a classroom. Do people all act the same way in these locations? Definitely not.

Different Patters of Life

The pattern of life, or context, of a location involves consistently occurring behavior, patterns of movement, roles, and objectives of those present. People in different locations have different goals and are completing different tasks. The behavior of people within a given location is also likely to vary by the time of day, weather, holidays, and countless other factors.

Environmental context must be accounted for when conducting behavioral observation .

Problem #2: Filtering


Your officers spend their time working with and around people. Sometimes they may have to observe a smaller number of people in a park, other times they may be observing hundreds or thousands at a sporting event. In any given location, the vast majority of people with whom they interact are law-abiding members of the public who do not wish or intend to cause harm to any person or property. But, there may be a few present at a location for less than law-abiding reasons. It is not feasible to expect your officers to watch everyone. They need to be able to filter that threat from that crowd of people.

Problem #3: Clusters


Do you think any one single behavior will show that person is a terrorist, an active shooter, or a criminal? No. Other than some very obvious things such as being seen with a bomb, a weapon, or in the commission of a criminal act it generally doesn’t work that way. There is no magic bullet behavior to behavioral observation.  

Even seeing a weapon may not be enough; there have been too many stories of off-duty police officers carrying a gun shot by other officers during an incident. When observing their environment and assessing active threats, officers need to be able to assess clusters of specific threatening behaviors, while dismissing all that is innocuous or non-threatening.

Problem #4: Timing


A person’s behavior will be affected by changes in the environment. Research in psychology has long described the phenomenon by which individuals change their behavior after becoming aware that someone is observing them as the Hawthorne Effect (McCambridge, Witton, & Elbourne, 2014). The observation of any human behavior needs to occur over time and account for changes in behavior based on changes in the environment. Your officers need to be able to not only assess the behaviors that they see, but when they see them.



IV. Components of an Active Threat Assessment Methodology

Let’s think back to the difficulties yours officer’s must overcome when when tying to identify active threats. First, they are deployed to a variety of different places, and each of these contexts has a different pattern of life. Second, we want them to watch a crowd of people in that location and identify potentially threatening individuals. Third, we want them to accurately assess the threat levels of those they are observing and correctly target threats for interdiction. Fourth, your officers need to not only be able to assess the behaviors that they see, but when they see them. Oh yes, we want all of this done in a way that protects our civil liberties.

Complexity in Threat Assesssment

Any active threat assessment methodology must account for these four problems in order to safely and effectively allow officers to identify active threats around them and protect the public. An effective active threat assessment methodology should:

  1. Be Applicable in Any ContexT

The concept of needing to establish context to identify criminal behavior is supported in the research community (Woodhams, Hollin, and Bull, 2007).  The location in which an observer is working has a pattern of life. We cannot assume the pattern of life in one location is the same as the pattern of life in another. Any active threat assessment model must incorporate an assessment of context. In turn, this assessment of context allows the observer to identify the behavior that stands out or “deviates”. Recognizing consistent and deviant behaviors lead to the identification of potential threats.

2. Allow for Filtering to Allow the Identification of Potential Threats


Any active threat assessment methodology should allow the observer to filter potential threats from the larger crowd of people in a given location. The observer should be able to identify specific individuals whose behavior is inconsistent from most others. These individuals are not threats. They are persons of interest who require further observation. As part of this filtering process, the observer must also dismiss those subjects who are not assessed as threats.

3. Facilitate the Identification of Threat Indicators and ClusterS

Your officers know that a single behavior is generally not an indicator of wrongdoing; it is part of the foundation of probable cause and reasonable suspicion. It is a cluster of different behaviors that may cause a subject to flagged as a potential threat. This assertion is also supported in the academic literature (Cloud, 1985).


Behavior which may indicate a threat in one situation may be innocuous in another. Active threat assessment must involve assessing clusters of behavior, dismissal of those that are harmless, and a focus on those that require immediate attention.

Context and filtering will allow your officers to identify persons of interest. They can then watch these persons of interest and looks for clusters of behaviors which might indicate that subject is a threat and then make an informed decision to watch that subject further or interdict.

4. Allow for Observation Over Time


A person will react to the presence of perceived threats. Active threat assessment must account for this Hawthorne Effect. Your officers need to be able to assess what they see within the context of how the person they are observing is interacting with a known threat (such as the officers themselves). It is not just how a subject behaves but also when they display a specific behavior in a reaction to particular stimuli.

Certain behaviors are more meaningful based on when they occur.  An assessment of an active threat must involve observation over time and enable the observe to identify changes in behavior based on the reaction of that subject to environmental changes or in reaction to threats perceived by that subject.



V. A Foundation for Active Threat Assessment

Experienced law enforcement, military, and security personnel have been actively assessing threats for years. Those practitioners who work with and around threatening individuals learn to assess threatening behavior. They learned to differentiate that threat from that crowd. Sometimes that ability was conscious; meaning that they knew the behaviors that caused someone to be assessed as a threat. In other cases, the practitioner knew that something “Just didn’t look right” but couldn’t explain what didn’t look right or why. This subconscious ability to identify things that didn’t look right has been described as Intuitive Policing and supported by the work of researchers and practitioner (Pinnazato, Davis, and Miller, 2004).


Most law enforcement officers learn active threat assessment through on-the-job training (OJT). The various methods, tactics, tools, techniques, and procedures developed by these experienced men and women have not generally been written down, systematized, and formally taught to the next generation. It may have been passed along through narratives or instructions passed from a field training officer to a trainee. But that knowledge was often lost.

Thankfully, there is also some research that is available which can serve as a basis for active threat assessment.

Behavioral Criminal Profiling

One basis for the utility of active threat assessment is criminal behavioral profiling. Profiling is not and should not involve a sole focus on the age, gender, race, or ethnicity of a subject. Like threat assessment, criminal profiling also has a variety of meanings. Kocsis (2006) describes criminal profiling as activities ranging from:

  1. a collection of leads, a biological sketch of behavioral patterns, trends, and tendencies;

  2. a technique that focuses attention on people with personality traits that parallel traits of perpetrators who have committed similar offenses; or

  3. identifying behavioral tendencies of an offender based on characteristics of a crime.

Empirical research that has investigated the effectiveness of profiling techniques, it is clear that some validation efforts have successfully demonstrated that training in profiling can facilitate the identification of potential criminal offenders (Kocsis, 2006; Kocsis, Middledorp, & Karpin, 2008; Pinizzotto & Finkel, 1990; Ault & Reese, 1980).

The US Defense department-funded JDLR Project

Another basis for active threat assessment is the United State’s Department of Defense funded JDLR Project. The goal of the JDLR Project was to identify and articulate behavioral indicators associated with threat, fear of detection, or the carrying of concealed weapons.


The intent of the project was to transfer this knowledge from more experienced to less experienced military personnel and better prepare them for complex environments around the world. These indicators were derived from law enforcement methods to identify persons carrying guns, being deceptive, or otherwise involved in suspicious or illicit activities. This research was focused on identifying the visual behaviors with specific criminal activities (carrying of concealed handguns, illegal drugs, and carrying of money and illegal drugs through airports) (Meehan and Strange, 2015; Meehan and McClary, 2015; Meehan, et al., 2015).




VI. Active Threat Assessment Training

Your officers need to know how to assess active threats. This skill will them to protect themselves and the public. We can help train your officers to identify active threats. Contact us to learn more about active threat assessment and online and instructor-led training.




Ault, R., & Reese, J. T. (1980). A psychological assessment of crime-profiling. FBI Law Enforcement Bulletin, 49(3), 22-25.

Cloud, M. (1985). Search and Seizure by the Numbers: The Drug Courier Profile and Judicial Review of Investigative Formulas. Boston University Law Review, 65, 843–922.

Kocsis, R. (2006). Criminal Profiling. Humana Press. Available at:

Kocsis, R. N., Middledorp, J., & Karpin, A. (2008). Taking stock of accuracy in criminal profil ing: The theoretical quandary for investigative psychology. Journal of Forensic Psychology Practice, 8, 244-261.

McCambridge, J., Witton, J., & Elbourne, D. R. (2014). Systematic review of the Hawthorne effect: New concepts are needed to study research participation effects. Journal of Clinical Epidemiology67(3), 267–277.

Meehan, N., McClary, M., and C. Strange. (2015). Behavioral Indicators of Drug Couriers in Airports. Memorandum Report - NRL/MN/5508--15-9595. United States Naval Research Laboratory.

Meehan, N. and McClary, M.(2015). Behavioral Indicators of Drug Carriers in Open Spaces. Memorandum Report - NRL/MN/5508--15-9596. United States Naval Research Laboratory.

Meehan, N. and C. Strange. (2015). Behavioral Indicators of Legal and Illegal Gun Carrying. Memorandum Report - NRL/MN/5508--15-9597. United States Naval Research Laboratory.

NASP School Safety and Crisis Response Committee. (2014). Threat Assessment for School Administrators and Crisis Teams. Bethesda, MD: National Association of School Psychologists.

Pinizzotto, A. J., & Finkel, N. J. (1990). Criminal personality profiling: An outcome and process study. Law and Human Behavior, 14, 215–233.

Pinazzatto, A. J., Davis, E., C. Miller (2004). Intuitive Policing: Emotional/Rational Decision Making in Law Enforcement. F.B.I. Law Enforcement Bulletin. 1. Obtained November 26, 2018 from

Refroe, N.A. and Smith, J.L. (2016). Threat / Vulnerability Assessments and Risk Analysis. Applied Research Associates. Obtained November 24, 2018 from

Woodhams, J., Hollin, C. R., & Bull, R. (2007). The psychology of linking crimes: A review of the evidence. Legal and Criminological Psychology12(2), 233-249.