A door can be secured while a concerning situation remains poorly understood. A threat assessment team can understand a concern while the practical safeguards needed to manage it remain incomplete. Both capabilities matter, but their presence does not tell us whether they work together.
When I first wrote about the convergence of deterrence and prevention, that was the gap I wanted organizations to examine. We invest in protecting buildings and we develop processes for assessing behavior. The harder work is connecting those efforts so that relevant information changes decisions, and decisions produce actions people can carry out.
After 30 years in the security industry, I would rather hear how an organization makes that connection than how many systems it owns. The answer reveals whether protection and prevention are functioning as a coordinated practice or simply sharing space on an organizational chart.
Physical security does more than deter
Deterrence is one function of a security program. Visible measures may discourage an attempt, but cameras can also support detection and verification. Door hardware and access controls can restrict entry or create delay. Alarms can bring a condition to someone’s attention. The value depends on the purpose of the measure, its reliability, and the response behind it.
CISA’s Security Planning Workbook describes layered security across a facility’s outer, middle, and inner perimeters as an approach to slowing or discouraging unauthorized access.1 That is a broader role than hoping someone will be discouraged by the presence of a camera.
Calling all physical security “deterrence” understates what it can do. Treating it as a complete violence prevention program overstates what it can do. A system may show that a door was tested. It usually cannot tell the organization, by itself, why the person tested it or what that behavior means in context.
That is where behavioral assessment contributes. It gives qualified people a process for examining reported conduct, evaluating context, identifying uncertainty, and considering intervention. It does not guarantee that an organization will discover every developing concern, and it cannot substitute for protective measures when those are needed.
Follow one event through both systems
Consider a fictional workplace. A former employee returns after a contentious separation. Their disabled badge is rejected at a restricted door. Security records the event and confirms that the access control worked. Elsewhere, HR has documented an unresolved grievance, and a coworker has reported increasingly personal statements about the manager involved.
The rejected badge does not establish violent intent. The person may have misunderstood the arrangements for returning. The grievance does not establish intent either. A useful review would examine the relevant information through the organization’s established process rather than assume that one department’s record answers the whole question.
Here, physical security has provided an observation that may matter to the assessment. The team needs to clarify the circumstances, consider the reports together, and decide what further inquiry or action is proportionate. FBI guidance explicitly cautions that no single behavior establishes that a person is moving toward targeted violence.2
The connection also has to work in the other direction. If the team determines that a safety plan is warranted, someone must translate that decision into practical arrangements. That might include confirming access status, clarifying how future visits are handled, briefing designated personnel, or coordinating support and outside assistance when appropriate. Each action needs an owner and a way to confirm completion.
The organization should then be able to distinguish a completed safeguard from an unresolved concern. A badge can be disabled while questions about behavior remain open. A concern can warrant continued review even when the latest access event has a reasonable explanation.
Connect responsibilities without sharing everything
This does not require an identical organizational structure everywhere. A large institution may have dedicated leaders and specialist teams. A smaller organization may rely on people with several responsibilities and qualified external partners. The requirement is clear authority, appropriate expertise, and a reliable handoff, not a particular number of departments.
Leadership should make those responsibilities explicit. Who receives a behavioral concern? Who can request relevant security records? Who approves changes to protective arrangements? Who checks whether those changes happened? When the situation changes, who brings the team back together?
Information sharing also needs boundaries. A person implementing an access change may need an instruction and a contact for questions, without needing the entire personnel history behind the decision. The team should establish appropriate purposes, authorized recipients, limits on use, and documentation practices. Any external arrangements need to reflect the organization’s authority and applicable requirements.
People are more likely to use a reporting process they understand and trust. An organization cannot expect useful participation if employees believe that every concern automatically becomes an accusation or that personal information will circulate without restraint. Careful handling supports both fair treatment and the practical quality of the information the team receives.
Make the connection testable
A shared mission statement is a useful start, but it will not reveal a failed handoff. A short tabletop exercise can. Give the team a fictional report, introduce a relevant access event, and ask participants to explain what they would do next. Then change one fact and see whether the plan can adapt.
The point is to discover friction before circumstances force the issue. Perhaps security does not know when to notify the assessment team. Perhaps the team assumes an operational change has been completed. Perhaps a manager receives instructions without knowing when to seek further help. Those are specific process problems with identifiable owners.
Threatalytics AI can support the review by helping professionals organize supplied information, distinguish observations from interpretation, identify gaps, and document follow-up considerations. It does not independently verify an alarm, change access permissions, establish reporting channels, or carry out an intervention. Those responsibilities remain with the organization and its qualified partners.
The convergence worth pursuing is practical: protective systems inform the assessment, assessment informs proportionate safeguards and support, and the results return to the team for review. That is how separate capabilities can become a more coherent prevention program. The test is what changes in practice, not whether the organization has bought another platform.
Does this sound familiar?
Are your safeguards and your team working together?
Have you ever discovered that security held information the assessment team needed, or that a team decision never became a completed protective action?
If that gap concerns you, we welcome a conversation about how your organization connects the work and whether Threatalytics AI could support a more structured review.
Talk Through Your ChallengeSources and essay note
1. Cybersecurity and Infrastructure Security Agency, Security Planning Workbook (September 2023), p. 12, on layered security.
2. Federal Bureau of Investigation, Behavioral Analysis: Identifying and reporting concerning behavior.
Adapted and substantially updated from Jason Destein’s earlier March 8 essay, “The coming convergence of deterrence and prevention.” This version was published on October 29, 2026. The workplace example is fictional. The operating practices discussed reflect the author’s professional perspective; the sources support the specific principles identified above.