“We need to connect the dots” is one of the most familiar phrases in violence prevention. I have used it myself. It captures a real problem: people often hold different pieces of information, and a team cannot assess what never reaches its attention. But the phrase leaves out the harder part of the work.
Once those observations are in the same room, how do we decide whether they belong together? What makes one connection reasonable and another speculative? And how do we keep a convincing story from becoming more persuasive than the evidence supporting it?
Those questions matter because threat assessment does not come with a completed picture hidden on the next page. The task is to develop a working understanding that can guide proportionate action, while remaining open to information that changes it.
A report is a starting point, not a conclusion
Before connecting anything, I want to know what the observation actually is. Was a statement heard directly, repeated by someone else, or summarized after the fact? When did the behavior occur? What happened immediately before and after it? Which details are recorded, and which have been inferred?
A description such as “increasingly hostile” may express a legitimate concern, but it is not yet a clear account of conduct. The team needs to understand what was said or done, who observed it, and what changed. That detail allows others to examine the concern rather than simply inherit the reporter’s interpretation.
The distinction also protects people from being reduced to a collection of difficulties. Financial pressure, a relationship breakdown, absenteeism, or a poor review may be relevant context. None should become an automatic explanation for dangerousness. Their significance depends on the behavior and circumstances being assessed.
A useful reporting process therefore encourages people to describe what they observed without requiring them to diagnose someone or decide whether violence will occur. The receiving team takes responsibility for the interpretation and for identifying what else it needs to know.
Three reports may still be one source
Consider a fictional organization. Three employees report a screenshot of an angry post following a workplace dispute. Because the reports arrive separately, the case summary describes multiple sources expressing concern. During review, the team discovers that all three employees received the same cropped image from one colleague. None saw the original post.
The reports are still worth examining. Their number, however, does not independently establish the wording, context, authorship, or meaning of the original message. Repetition has increased visibility without necessarily increasing verification.
A separate firsthand account might add something important. It might also contradict part of the summary. The team needs to preserve that distinction rather than merge everything into a single narrative that makes each fragment appear equally established.
This is one practical reason source tracking matters. A timeline should distinguish when an event occurred from when it was reported. A case view should distinguish a direct observation from a forwarded account. If an asserted connection remains unverified, that uncertainty should remain visible wherever the information is used.
Test the picture you are beginning to see
The danger is not limited to missing a pattern. A team can also become attached to a pattern too early. Once someone is described as a likely threat, ordinary events may begin to look like supporting evidence, while information that challenges the interpretation receives less attention.
The FBI’s Making Prevention a Reality addresses both confirmation bias, which favors an existing view, and hindsight bias, which can make an outcome seem more predictable after it occurs. Its guidance favors structured, evidence-based assessment over quick impressions.1
In practice, I would ask a team to explain the strongest evidence for its current understanding and the strongest evidence against it. What alternative explanation remains plausible? What information would materially change the response? Are we treating an interpretation as a fact because it has appeared in several summaries?
That discipline does not require treating every explanation as equally credible. Nor should it delay urgent protective action when the circumstances warrant it. The team can take reasonable steps to address an immediate concern while continuing to verify details and revise its assessment.
Looking backward requires similar care. Information recovered after an incident may not have been available, recognizable, or shareable in the same way beforehand. A review should examine what could reasonably have reached the team and what the team could have done with it, rather than assume that the outcome supplied an obvious outline all along.
Build a process that can change its mind
The framework around this work has to do more than collect reports. It needs to support initial review, further inquiry, decisions, assigned actions, and reassessment. Different organizations may use different systems to accomplish those tasks. The practical question is whether their arrangements preserve source information, context, responsibility, and a record of what changed.
That includes information that reduces concern. A corrected quotation, a verified explanation, a supportive relationship, or an effective intervention should be able to change the working assessment. A process that only accumulates reasons for alarm is not adequately testing its own conclusions.
Responsible collection matters as well. An organization needs relevant, authorized information for a defined purpose, not an unrestricted search through someone’s life. Clear reporting routes and appropriate sharing arrangements help people bring forward useful observations while placing limits on how the organization handles them.
Threatalytics AI can support this work by organizing supplied information, separating reported observations from interpretation, and helping teams identify unresolved questions. A polished narrative still needs to be checked against its inputs. The team remains responsible for verifying sources, testing proposed connections, and deciding what the circumstances justify.
That is the version of connecting the dots I want organizations to pursue. Bring relevant information together, examine the links, and document why a connection matters. Leave room for what does not fit. The aim is an understanding the team can explain and revise, with enough clarity to support timely action.
Does this sound familiar?
Can your team explain why the dots belong together?
Have you ever reviewed a persuasive case summary and struggled to tell which details were verified, which came from the same source, and which were assumptions?
If that uncertainty is getting in your team’s way, we welcome a conversation about your review process and whether Threatalytics AI could help make the information and its limits clearer.
Talk Through Your ChallengeSource and essay note
1. Federal Bureau of Investigation, Making Prevention a Reality: Identifying, Assessing, and Managing the Threat of Targeted Attacks (2017), pp. 21–23, on assessment, bias, and structured review.
Adapted and substantially updated from Jason Destein’s earlier February 9 essay, “Connecting the dots!” This version was published on October 29, 2026. The screenshot example is fictional. The operating practices discussed reflect the author’s professional perspective; the cited guidance supports the discussion of assessment and bias.