The Myth of the Person Who Just Snapped
After an act of targeted violence, the same sentence surfaces almost every time. He just snapped. No one saw it coming. Having spent two decades working federal criminal investigations & executive protection threat assessment, I can tell you that sentence is almost always wrong. It is comforting, because if violence is random & unforeseeable, then no one could have prevented it. The uncomfortable truth is the opposite.
Targeted violence is not impulsive. It is the end of a process. Investigators who study attackers after the fact describe a recognizable progression, often called the pathway to violence: a grievance forms, then an idea of violence as the answer takes hold, then planning, then preparation, then a final breach. That movement takes days, weeks, sometimes years, & along the way the person leaves a trail.
Federal studies of targeted attackers, across workplace, school, & public-figure cases, have consistently found that in the large majority of incidents, the attacker exhibited observable warning behaviors beforehand, & that other people, coworkers, family, & classmates, noticed something concerning in advance. The signals are usually there. The system to catch them usually is not.
The Warning Behaviors Organizations See but Do Not Connect
The problem is rarely a total absence of information. In my experience, the problem is that the information is scattered, & each fragment on its own looks minor enough to ignore.
Consider a composite picture drawn from patterns, not any single real case. An employee's performance slides after a disciplinary action he believes was unjust. He tells a coworker, offhand, that management will regret it. To that coworker, it is venting. Weeks later, a different colleague notices he has started talking, with unusual intensity, about a past workplace attack in the news, almost with admiration. To her, it is an odd conversation. Meanwhile, facilities logs show he has been in the building after hours on days he was not scheduled. To the security officer reviewing badge data, it is a minor anomaly. Three people. Three fragments. No single one alarming. No place where they meet.
That is the pattern behind most preventable incidents. The warning behaviors tend to cluster:
- A deepening, personalized grievance, often framed as an injustice that must be answered.
- A shift from grievance to fixation on violence as the solution, sometimes expressed as admiration for past attackers.
- Leakage, where the person tells a third party, directly or indirectly, about an intent or a plan.
- Novel aggression or boundary probing, testing what they can get away with.
- Practical steps that suggest preparation, such as researching a target's routine or acquiring capability.
- An energized final push, a sense that time is running out, that things must happen now.
None of these, standing alone, predicts violence. Most people who voice a grievance or make a dark comment never harm anyone, & treating every frustrated employee as a future attacker is both wrong & dangerous. The point is not to diagnose or label a person. The point is that a cluster of these behaviors, seen together & over time, is a signal that a situation deserves a careful, professional look. The failure mode I have watched play out is structural: HR holds the grievance, security holds the badge anomaly, a manager holds the comment, & the three data sets never sit in the same room.
Violence rarely arrives without warning. It arrives without a system to receive the warning. The signals were distributed across people who never spoke to each other.
The Fix Is a Team, Not a Camera
The countermeasure to scattered signals is a structure that gathers them. In protective work, we do not wait for one person to hold the whole picture. We build a process that assembles it. For an organization, that means a multidisciplinary threat management team, built on four things.
One Intake Channel
The single highest value change most organizations can make is to create one clear, well publicized way to report a concern, & to make sure people know using it is encouraged, not disloyal. When the coworker, the colleague, & the security officer all route what they saw to the same place, the fragments finally meet. Reporting is not accusing. It is contributing one data point to people trained to weigh it.
A Team That Crosses the Silos
Bring HR, security, legal, & where appropriate mental health & management to the same table, on a standing basis, not only in a crisis. Each function sees a different slice of the same person's behavior. Together, they can see the trajectory. A grievance in HR's file & an after-hours pattern in security's logs mean something very different side by side than either does alone.
A Documented Assessment Process
The team should work from a structured, written process for evaluating a situation, & should document what it reviewed & why it decided as it did. This is not bureaucracy. It disciplines judgment, guards against both overreaction & complacency, & creates a defensible record that the organization acted reasonably & consistently.
A Bias Toward Early, Low-Key Intervention
The goal is to intervene early, quietly, & at the lowest level that resolves the concern, long before anyone is at a doorway. Often the right move is not dramatic. It is a welfare check, a management conversation, a referral to an assistance program, a temporary adjustment to access, all led by trained professionals. Nothing in this article should be read as guidance to confront, restrain, or personally handle a person you believe is dangerous. That is precisely what an assessment team & trained responders exist to manage. Frontline staff observe & report. The team assesses & decides. Professionals act.
Culture Is the Real Force Multiplier
You can stand up a team, publish an intake channel, & write an assessment protocol, & still miss what matters, if the culture keeps people quiet. Consider a second composite. An organization has every one of those structures on paper. But an employee who overhears a disturbing comment says nothing, because the last person who raised a concern was treated as a troublemaker, & because no one is sure the report goes anywhere. The machinery exists. The trust does not. The signal dies at the source.
The organizations that get this right treat reporting as an act of care, for the person of concern as much as for everyone else, because early intervention is often what keeps a struggling person from a decision that ends their life as they knew it. They close the loop enough that people see reports are taken seriously, & they train managers to recognize the clustering of behaviors without turning them into amateur profilers. Culture is what turns a policy into a nervous system.
None of this requires fear. It requires a shift from reacting to incidents to recognizing pathways, & from scattered observation to shared assessment. The signals are usually already inside your building. The question is only whether you have built something that can hear them.
If you are not certain your organization could connect those three fragments today, a structured program assessment is where we would start: mapping how a concern would travel, who would see it, & where it would stall. That is the work Scopos Strategies does before an incident, not after.
Inside your organization today, if three different people each noticed one concerning behavior, is there a single place all three reports would land, & one trained team that would see the pattern?
Back to InsightsThis article was produced with AI assistance. The perspective and security expertise are the author's own.