The U.S. Secret Service National Threat Assessment Center’s 2026 guide, Preventing Targeted Workplace Violence, offers an eight-step framework for building Behavioral Threat Assessment and Management programs. It gives organizations a practical structure for identifying, assessing, and managing concerns as part of a broader prevention effort.1
What stands out to me is the work required to make that framework operate between meetings. A policy can establish expectations. A multidisciplinary team can bring the right expertise together. The program still needs a dependable way to move from someone noticing a concern to the organization understanding it and taking appropriate action.
Steps 4, 5, and 6 deserve particular attention because they describe those transitions. They depend on the other steps, including leadership support, procedures, a capable team, organizational climate, and training. They are not a shortened substitute for the full program. They are a useful place to examine whether the program works in practice.
Step 4: Identify and Process Reports of Concerning Behavior
A reporting channel matters when people know it exists, trust the process enough to use it, and can reach someone prepared to respond. The guide emphasizes employee recognition and reporting, accessible reporting options, and a trained response to incoming concerns. Its initial screening addresses whether a report describes an emergency, whether it is credible, and whether it is actionable.2
For an organization, that creates concrete operational questions. Who checks the channel? What happens outside normal hours? Who takes responsibility when the usual recipient is unavailable? Can the receiving person distinguish an immediate safety issue from information that needs further inquiry?
Consider a fictional workplace. An employee tells a supervisor that a coworker has repeatedly made angry comments about a manager following corrective action. The supervisor documents the conversation in a local file but does not know whether HR or the BTAM team should receive it. A separate concern reaches security. Neither recipient knows that another account exists.
The failure point is the handoff. Before an organization asks a tool to structure concern narratives, it needs an established route through which those narratives reach authorized reviewers. An immediate emergency also needs an immediate response through the appropriate security or emergency authorities. It should not wait for the next team meeting or an AI-generated summary.
Step 5: Gather Information to Assess for Risk
Receiving a report begins the inquiry. It does not establish the meaning of the behavior. Step 5 describes a fact-based process using multiple sources and the individual’s circumstances. It distinguishes a limited preliminary inquiry from a fuller assessment when the concern or unresolved information warrants one.3
The guide’s Systems Approach is particularly relevant to the problem of fragmented information. Different people and organizational or community systems may hold different observations. A team needs to determine which information is relevant, available through appropriate channels, and sufficiently reliable to inform its assessment.
In the fictional workplace, the team might clarify the exact comments, their timing, and whether the accounts describe independent observations or the same conversation repeated. It may discover a routine explanation for the security concern, additional context that increases concern, or important questions that remain unanswered. Each possibility should be allowed to change the working picture.
Bringing accounts together should improve understanding without turning every fragment into supporting evidence for the first interpretation. A professional review needs to preserve the source, distinguish observed behavior from inference, consider alternative explanations, and examine supportive or stabilizing circumstances as well as concerns.
Information sharing also needs boundaries. A multidisciplinary team’s interest in a complete picture does not make every personnel file, clinical record, or employee-assistance conversation available for unrestricted use. The organization must establish authorized access, appropriate information-sharing arrangements, and privacy practices suited to its setting.
Step 6: Develop Risk Management Strategies
An assessment needs a connection to what happens next. Step 6 describes management tailored to the individual and environment, with planning, implementation, evaluation, and case closure. These phases can overlap or be revisited as circumstances change.4
That means the team’s work continues after it agrees on an interpretation. A management plan needs an accountable owner for each action, a reasonable timeframe, and a way to determine whether the action occurred and had its intended effect. The plan should also make clear what new information would prompt earlier review.
In our fictional workplace, the appropriate response would depend on what the inquiry established. It might include clarifying boundaries, offering relevant support, resolving an organizational issue, reviewing protective arrangements, or involving additional partners. Those choices belong to qualified people acting within their authority, with the response proportionate to the circumstances.
A recommendation to offer support is not confirmation that support was offered. A decision to review an access concern is not evidence that someone completed the review. A management process becomes credible when the team can explain what was done, what changed, and why continued monitoring, a revised response, or closure is appropriate.
Where assistive intelligence can support the team
These transitions are where Threatalytics AI is intended to help. Working with information supplied by authorized users, it can help organize concern narratives, separate facts from assumptions, structure a chronology, surface unresolved questions, and prepare material for multidisciplinary review.
That assistance can support the work around triage and assessment without taking ownership of either. The team must verify the output, determine urgency and significance, and decide what action is justified. The platform does not replace a reporting channel, automatically gain access to disconnected systems, or independently establish whether an intervention happened.
The same boundary applies to time and context. Structuring reported changes over time can help a team examine escalation or stabilization. It does not turn incomplete information into a prediction of violence. Threatalytics AI is not a diagnostic tool, an autonomous decision-maker, or a guarantee of prevention.
Any claimed benefit should be evaluated in the actual workflow, including the time needed to verify and correct outputs. Users are instructed to avoid personally identifiable information. Privacy arrangements and required agreements need to be resolved for the intended use before sensitive information is submitted.
Test the handoffs before the next concern
A practical way to examine readiness is to walk a fictional report through the organization. Identify who receives it, who checks urgency, how relevant information is gathered, and how the team reaches and documents a decision. Continue until there is a named person responsible for the next action and a defined review point.
The value of that exercise is in finding the uncertainty within the process. A team may discover that people know how to report but nobody owns after-hours intake. It may find that information reaches the meeting but decisions do not become tracked actions. Those are specific weaknesses an organization can address.
The Secret Service guide offers a structure for building the capability. The continuing work belongs to the organization: making each transition dependable enough that a reported concern can receive careful assessment, proportionate action, and sustained follow-through.
Does this sound familiar?
Where does your prevention process lose momentum?
Does information stop with the first recipient? Does your team spend too much time reconstructing the chronology? Do clear recommendations lose their owner after the meeting?
Contact us to discuss those handoffs and whether Threatalytics AI could help your qualified team structure the information and prepare for better-informed decisions. Please keep initial inquiries free of names or sensitive case details.
Talk Through Your ChallengeSource and perspective note
National Threat Assessment Center. (2026). Preventing Targeted Workplace Violence: A U.S. Secret Service Guide to Behavioral Threat Assessment and Management. U.S. Secret Service, Department of Homeland Security.
1. The eight-step framework, p. 32.
2. Step 4, pp. 50–57, including reporting channels and initial screening.
3. Step 5, pp. 59 and 62–63, including preliminary inquiry, full assessment, and the Systems Approach.
4. Step 6, pp. 75–76, including planning, implementation, evaluation, and case closure. References use the guide’s printed page numbers.
The workplace example is fictional. Applications to organizational practice and the discussion of Threatalytics AI reflect Jason Destein’s professional perspective. The guide does not recommend or validate Threatalytics AI; this article does not imply U.S. Secret Service endorsement or affiliation. Steps 4–6 are discussed within the broader eight-step framework, not as a complete standalone program.