The 8 Pre-Attack Behaviors Most Officers Miss on Patrol
Research on targeted violence reveals consistent behavioral leakage before incidents.
Every major study on targeted violence surfaces the same uncomfortable finding: the warning signs were there. Colleagues noticed something. Family members felt uneasy. Sometimes the subject told people directly. And yet the attack still happened.
This isn't a failure of courage or caring. It's a failure of pattern recognition — specifically, a failure to name and operationalize the behavioral signals that research has consistently identified in the weeks and months before violence occurs.
For patrol officers, this matters more than almost anyone acknowledges. You're often the first point of contact with individuals on a pathway to violence. A traffic stop. A welfare check. A neighbor complaint. These are not interruptions to your work — they can be the work, if you know what to look for.
Here are eight pre-attack behaviors the research keeps surfacing, and how to integrate awareness of them into everyday patrol without crossing into bias or profiling.
1. Leakage
Leakage is the term threat assessment researchers use when someone communicates intent — directly or indirectly — before an attack. It might look like a social media post, a comment to a coworker ("you won't have to deal with me much longer"), or a note left at home. It might be a confession to a friend framed as a hypothetical.
The FBI's A Study of Pre-Attack Behaviors of Active Shooters (2018) found leakage in a significant portion of incidents reviewed — and in many cases, multiple people received these communications and didn't know what to do with them.
What this means on patrol: If someone mentions that a community member "said something weird" or "posted something disturbing," that's not gossip — it's potentially actionable intelligence. Take it seriously. Document it. Know your department's behavioral threat assessment referral process.
2. Fixation
Fixation is an intense, persistent preoccupation — with a grievance, a person, an ideology, or a previous act of violence. It's distinct from interest. Everyone has interests. Fixation crowds everything else out.
The Fixated Threat Assessment Centre in the UK, which has studied this pattern extensively, describes fixation as one of the most reliable indicators of escalating risk when combined with other behaviors on this list. Subjects often research past perpetrators, consume violence-related content obsessively, and begin to build an identity around their grievance.
What this means on patrol: During contacts, you'll occasionally encounter individuals who can't stop talking about a particular injustice, person, or subject. Note the intensity and duration. One conversation doesn't tell you much. A pattern does.
3. Identification
Related to fixation but distinct: identification is when someone begins to model themselves on a violent actor. They study the perpetrator, adopt their language, mimic their dress, or explicitly express admiration for what the person "accomplished."
This is sometimes called "the pathway to hero worship" in targeted violence research. The subject isn't just angry — they've found a template. That's a significant escalation in risk.
What this means on patrol: If during a contact or a community tip you hear that someone has been expressing admiration for a mass casualty perpetrator by name, or consuming that content obsessively — that's a red flag worth documenting and flagging through your threat assessment pipeline.
4. Novel Aggression
Novel aggression refers to a new pattern of aggressive behavior that is out of character for the individual — escalating arguments, physical altercations, threatening communications, or road rage incidents that represent a departure from their baseline.
Researchers often describe this as "practicing" aggression — a loosening of inhibitory controls that may signal the subject is crossing internal thresholds.
What this means on patrol: When you run calls involving a known subject and the behavior feels different — more volatile, more reckless — that shift matters. Baseline change is the signal, not the behavior alone. "He's always been a hothead" and "he's never acted like this before" are two very different threat pictures.
5. Energy Burst
An energy burst refers to a sudden, unusual increase in planning activity — acquiring weapons, researching locations, drafting written communications, giving away possessions, or putting affairs in order. It often signals that the subject has moved from ideation to preparation.
This is a late-stage indicator. By the time you're seeing an energy burst, the timeline to potential action may be short.
What this means on patrol: A tip that someone recently purchased weapons or ammunition after a period of expressed grievance — especially combined with other behaviors on this list — warrants urgent attention. This is not the moment for a wait-and-see approach.
6. Directly Communicated Threats
This one sounds obvious, but it gets dismissed constantly. People who make explicit threats are often rationalized away: "He's all talk," "She says that kind of thing all the time," "He was drunk."
Research on targeted violence tells a more complicated story. While many threats are never acted upon, the absence of a threat doesn't indicate safety — and a direct threat should always be taken seriously enough to evaluate, not explain away.
What this means on patrol: When someone reports a direct threat — verbal, written, or electronic — your job is to ensure it reaches a threat assessment process, not to pre-decide its credibility. The evaluation requires more than a single patrol contact.
7. Isolation
Voluntary social withdrawal — severing relationships, quitting jobs, dropping out of school, disengaging from previously meaningful connections — is a behavioral marker that frequently appears in pre-attack timelines.
Isolation matters for two reasons: it removes inhibitory voices (people who might talk a subject down), and it allows grievance narratives to deepen without disruption. The subject begins building a world where violence feels like the only remaining option.
What this means on patrol: Welfare checks on individuals who have withdrawn dramatically from their social world — especially when combined with a known grievance — aren't routine calls. They're opportunities.
8. Pathway Behavior
Derived from the violence pathway model developed by researchers Calhoun and Weston, pathway behavior refers to observable, sequential steps toward violence: grievance formation, ideation, research and planning, preparation, probing, and attack.
Most subjects don't skip steps. Which means that earlier steps are opportunities for intervention. An officer who encounters someone in the research or planning phase — asking pointed questions about a location's security, or conducting surveillance of a target — is not encountering a curiosity. They may be encountering a subject in motion.
What this means on patrol: Suspicious persons calls around institutional locations — schools, houses of worship, government buildings — deserve more than a casual clearing. Ask questions. Document what you observe. Know the behavioral pathway well enough to recognize where the subject might be on it.
A Critical Point: Behavior, Not Profile
None of the above is a checklist for suspicious demographics. Targeted violence does not have a reliable racial, ethnic, or religious profile — and attempting to use one isn't just legally and ethically wrong, it will make you worse at this.
What targeted violence does have is behavioral indicators. Behaviors are observable, documentable, and articulable. They give you something specific to act on and to report. They hold up under scrutiny. Profiles don't.
This is why the threat assessment field has moved decisively toward behavior-based frameworks — not out of political caution, but because the data supports it. The behaviors are what predict. The demographics aren't.
Building It Into Your Patrol Practice
You don't need a behavioral threat assessment certification to start using this framework. What you need is:
A referral pathway. Know how to route a concern at your department. Who receives behavioral threat tips? What's the process? If you don't know, find out before you need it.
Consistent documentation habits. The behaviors above only become actionable when they're documented and shared. A single data point often looks like nothing. Patterns reveal themselves across reports and contacts.
Community as intelligence. The people most likely to notice pre-attack behaviors are not investigators — they're family members, coworkers, neighbors, and teachers. Your relationship with your community is part of your threat detection infrastructure.
Suspension of the "just talk" instinct. The most dangerous dismissal in threat assessment is the reflexive conclusion that someone is venting rather than planning. Evaluation determines that distinction. You are the referral point, not the evaluation endpoint.
The research is consistent across decades, across incident types, across jurisdictions: targeted violence announces itself. The behavioral signals are there. The gaps have been in recognition, documentation, and referral — not in the absence of warning.
That's a solvable problem. And it starts on patrol.
Sources and further reading: FBI's A Study of Pre-Attack Behaviors of Active Shooters (2018); Calhoun & Weston, Threat Assessment and Management Strategies (2003); Fixated Threat Assessment Centre research publications; Secret Service National Threat Assessment Center reports.
FAQs
Isn't this just profiling with extra steps?
No — and this distinction matters. Profiling targets demographic characteristics (race, religion, appearance). Behavioral threat assessment targets observable actions: what someone says, does, posts, acquires, and how their behavior changes over time. The research is explicit on this: targeted violence has no reliable demographic profile, but it does have consistent behavioral signatures. Behavior is what you document, articulate, and act on. Demographics are not.
How is this different from what officers already do when they assess a scene or a subject?
It builds on the same foundation — pattern recognition, baseline assessment, gut instinct — but gives it a structured vocabulary and a referral pathway. Most experienced officers have already seen these behaviors. The problem isn't observation; it's knowing what to do with it. These frameworks help you name what you're seeing, document it in a way that's useful, and route it to someone equipped to evaluate it.
I'm patrol, not a detective or a threat assessment specialist. Why is this my job?
Because you're often the first — and sometimes only — contact with a subject on a pathway to violence. A welfare check, a neighbor complaint, a traffic stop. You're not expected to conduct a full threat assessment. You are positioned to observe, document, and refer. That referral can be the intervention. Your role is the front door of the process, not the whole building.
What if I flag someone and I'm wrong? Won't that ruin their life?
This concern is worth taking seriously — and it's exactly why behavioral threat assessment teams exist rather than leaving the determination to a single officer. A referral is not an accusation. It initiates an evaluation. Most threat assessment processes are designed to connect individuals with support and intervention, not to criminalize or institutionalize them. Getting someone evaluated when you're uncertain is not an overreaction. Missing someone who needed intervention is.
What if a subject is showing some of these behaviors but there's no specific target or explicit threat?
That's actually the norm. Most pre-attack pathways don't include an explicit threat or a named target early on. The behaviors cluster before the plan solidifies. Waiting for an explicit threat or a specific target to act is waiting too long. The value of this framework is earlier recognition — when intervention options are broader and less coercive.
How do I document this without it looking like I'm writing a psychological evaluation?
Stick to behavioral facts. What was said, verbatim if possible. What was observed — specific actions, not interpretations. Context: who reported it, under what circumstances, what changed from prior contacts. You're writing a behavioral record, not a diagnosis. "Subject stated he had nothing left to lose and had been researching the school's entry points" is documentable. "Subject seemed dangerous" is not.
What's the difference between someone who is mentally ill and someone who is on a pathway to violence?
They're not mutually exclusive — but they're also not the same thing. The majority of people with mental illness are not violent, and the majority of targeted violence is not committed by people with diagnosable serious mental illness. The behavioral threat assessment framework is not a mental health screening tool. Its focus is on behaviors associated with planning and intent, regardless of clinical status. That said, mental health crisis and grievance-based ideation can co-occur, which is why co-responder and CIT-informed approaches complement — rather than replace — threat assessment processes.
What do I do if a community member reports something but doesn't want to be identified?
Take the tip seriously regardless of whether the source will go on record. Document what was reported and how it was received. Many threat assessment processes are designed to receive and evaluate anonymous tips — your job is to make sure the information reaches the right place, not to resolve the sourcing problem yourself. If the reporting person is a family member or close contact of the subject, gently explore whether they're aware of any formal support or intervention options available to them.
How recent is the research behind these frameworks?
The behavioral pathway model has been developing since the 1990s, with the landmark Secret Service Safe School Initiative study published in 2002. The FBI's pre-attack behavior research has been updated as recently as 2018. The Fixated Threat Assessment Centre's work is ongoing. These aren't legacy frameworks — they've been refined across two decades of incident analysis and are now considered foundational in the threat assessment field. The core behavioral indicators have remained remarkably consistent across that research arc.
Where do I go if my department doesn't have a formal threat assessment process?
Start with your supervisor and document that you raised the concern. Many jurisdictions have county or regional behavioral threat assessment teams that local agencies can access even without a dedicated in-house unit. The Association of Threat Assessment Professionals (ATAP) and the FBI's field offices can be starting points for guidance. If your department lacks this infrastructure entirely, that's worth advocating for — and documenting your referral attempts protects you professionally in the meantime.