The Difference Between a Threat and Concerning Behavior
Recognizing workplace violence warning signs before a situation escalates
An employee makes an angry comment about a supervisor. A coworker becomes increasingly confrontational after a workplace dispute. Someone begins asking unusual questions about building access or another employee's schedule.
Are these threats? Warning signs? Or simply behaviors that have been misunderstood?
For organizations working to strengthen workplace violence prevention, understanding the difference between a threat and concerning behavior is an important part of identifying potential risks and knowing when to intervene.
The challenge is that not every concerning behavior indicates violent intent, and not every individual who poses a risk of violence will communicate a direct threat.
At Incident Management Team (IMT), we help organizations understand these distinctions through behavioral threat assessment and management (BTAM), workplace violence prevention training, and structured threat management programs.
The goal is not to label individuals as dangerous. It is to recognize behaviors that deserve attention, evaluate them in context, and take appropriate steps before situations escalate.
What Is Considered a Threat?
A threat is a communication or expression that conveys an intention to cause harm, injury, or damage to another person or property.
Threats may be communicated directly or indirectly, and they are not limited to face-to-face statements.
Examples include:
Direct threats: An individual explicitly communicates an intention to harm another person.
Indirect or implied threats: A statement suggests potential harm without clearly describing what will happen.
Written or electronic threats: Threatening messages delivered through emails, text messages, social media, or other communications.
Threatening gestures or actions: Conduct intended to communicate potential violence or intimidate another person.
The FBI emphasizes that threats must be evaluated based on their content, context, and surrounding circumstances.
A threatening statement made during an emotional confrontation may involve different circumstances than a detailed communication identifying a target, location, or intended action. Both deserve attention, but they may require different responses.
A threat should be taken seriously, but the fact that someone makes a threat does not automatically establish that they intend or are prepared to carry it out.
That distinction is fundamental to effective threat assessment.
What Is Concerning Behavior?
Concerning behavior refers to observable actions, communications, or patterns that raise questions about an individual's well-being, intentions, or potential for harmful behavior, even when no direct threat has been made.
These behaviors are not necessarily violent. In many situations, they reflect frustration, emotional distress, interpersonal conflict, or difficulty coping with circumstances.
However, when behaviors become persistent, escalate, or appear connected to a specific grievance or potential target, additional evaluation may be appropriate.
Examples of concerning behavior may include:
Escalating hostility: Increasingly aggressive, intimidating, or confrontational interactions with others.
Fixation on a grievance: Persistent resentment toward a person or organization, particularly when accompanied by hostility or discussions of retaliation.
Boundary violations: Repeated harassment, stalking, unwanted contact, or disregard for established restrictions.
Violence-related communications: Repeated references to harming others, violent fantasies, or presenting violence as a solution to personal problems.
Unusual interest in security measures: Attempting to obtain sensitive information about building access, security procedures, or another individual's routine without a legitimate reason.
Behavior suggesting preparation: Actions that, in context, indicate potential planning, surveillance, or preparation for violence.
The FBI's Prevent Mass Violence guidance identifies a range of behaviors that may warrant attention, while emphasizing that no single behavior establishes that a person will commit violence.
This is why context matters.
An employee experiencing stress, withdrawing socially, or struggling with job performance should not automatically be viewed as a potential threat. Such changes may simply indicate a need for support.
Concern increases when multiple behaviors, communications, or circumstances suggest movement toward violence.
The purpose of recognizing concerning behavior is to identify opportunities for appropriate intervention, not to assume dangerous intent.
Making a Threat Is Not the Same as Posing a Threat
One of the most important distinctions in behavioral threat assessment is the difference between what someone communicates and the actual risk their behavior may present.
The FBI specifically addresses this issue in its publication Making Prevention a Reality: Identifying, Assessing, and Managing the Threat of Targeted Attacks.
Its guidance establishes three important principles:
Some individuals who make threats may ultimately pose a genuine risk of violence.
Many individuals who make threats do not actually pose a threat of targeted violence.
Some individuals who pose a serious risk of violence never communicate a direct threat.
In other words, making a threat is an observable communication; posing a threat is a determination that requires evaluating the broader circumstances.
An individual might make an impulsive threatening statement without having any actual intention or preparation to act.
Conversely, someone planning a violent act may avoid making threats altogether, knowing that doing so could attract attention.
For employers and organizational leaders, this means that waiting for someone to make a direct threat before taking action can leave important warning signs unaddressed.
Effective workplace violence threat assessment looks beyond isolated statements to evaluate behaviors, circumstances, patterns, and available information.
Three Workplace Scenarios That Demonstrate the Difference
Consider the following hypothetical situations.
Scenario 1: The Angry Statement
Following a disciplinary meeting, an employee tells a coworker, "They're going to regret what they did to me."
The statement may suggest resentment or retaliation, but its meaning is unclear.
Is the employee referring to filing a complaint? Resigning? Pursuing legal action? Or contemplating harm?
The appropriate response is not to immediately assume violence, nor is it to dismiss the statement without consideration.
The comment should be reported through established procedures so the circumstances, intended meaning, and any additional concerning behaviors can be evaluated.
Scenario 2: Concerning Behavior Without a Direct Threat
An employee becomes increasingly fixated on a dispute with management. Over several weeks, coworkers observe repeated attempts to obtain a supervisor's schedule, unexplained visits to restricted areas, and increasingly hostile communications.
The employee has never directly threatened anyone.
Nevertheless, the combination of behaviors raises questions that warrant prompt review by a trained threat assessment team.
The concern is not any single action, but the developing pattern and its potential connection to a specific individual or grievance.
Scenario 3: A Behavioral Change That May Require Support
A previously outgoing employee becomes withdrawn, misses several deadlines, and appears distracted during meetings.
Although the change is noticeable, there is no indication of threats, hostility, violent intent, or preparation.
The appropriate initial response may be a supportive conversation, referral to available employee resources, or assistance through normal supervisory and human resources processes.
This situation illustrates why concerning behavior should not automatically be treated as evidence of potential violence.
The response should reflect the facts available, rather than assumptions about the individual.
How Do Organizations Determine When Behavior Becomes a Safety Concern?
This is where a structured behavioral threat assessment and management (BTAM) process becomes essential.
Threat assessment is not about predicting the future or determining whether someone fits a particular profile.
It is a systematic, fact-based process that considers the individual's behavior, circumstances, available information, and potential for harm.
The U.S. Secret Service National Threat Assessment Center (NTAC) promotes a multidisciplinary approach to recognizing, assessing, and managing concerning or threatening behavior.
At IMT, our threat assessment services follow three central steps:
1. Identify
Recognize and document communications, behaviors, or circumstances that may indicate a potential safety concern.
This includes ensuring employees understand what to report and know how to communicate concerns through established channels.
2. Assess
Gather relevant information to understand the nature and context of the concern.
Assessment may consider:
Whether a specific grievance or potential target exists.
Whether the behavior is isolated, repeated, or escalating.
Whether there is evidence of planning, preparation, or surveillance.
Whether the individual has demonstrated prior threatening or violent behavior.
Whether the individual has the apparent means or opportunity to cause harm.
Whether protective factors, available support, or interventions could reduce risk.
These considerations are not a simple checklist that can determine whether someone is dangerous.
They are part of a broader professional assessment that helps trained teams understand the situation.
3. Manage
Develop an appropriate response based on the information collected and the potential level of concern.
Depending on the circumstances, management strategies may involve supportive intervention, de-escalation, behavioral expectations, workplace security measures, coordination with human resources, or consultation with law enforcement.
The situation should continue to be monitored and reassessed as new information becomes available.
The goal is to reduce risk through appropriate, coordinated action.
What Should Employees Report?
One of the greatest challenges in workplace violence prevention is that employees may hesitate to report concerning behavior because they are unsure whether it is serious enough.
Some worry about overreacting. Others assume someone else has already reported the situation.
Employees should not be expected to independently determine whether a coworker, customer, visitor, or other individual poses a danger.
Instead, organizations should teach employees to report observable facts through designated channels.
A useful report should communicate:
What the individual said or did, using exact wording whenever possible.
When and where the incident occurred.
Whether anyone else witnessed the behavior.
Whether similar incidents have occurred previously.
Whether an identifiable person, location, or grievance was involved.
Whether there are relevant messages, emails, or other supporting records.
Whether the behavior appears to be escalating or changing.
The difference between reporting an observation and drawing a conclusion is important.
For example, rather than reporting, "I think this person is dangerous," an employee should describe the specific words, actions, or circumstances that caused concern.
That information gives a trained team a stronger foundation for determining what should happen next.
If there is immediate danger or an act of violence is occurring, employees should move to safety, call 911, and follow established emergency procedures. Non-imminent concerns should be promptly reported through the organization's designated reporting channels.
Why Overreacting Can Be as Problematic as Ignoring Warning Signs
An effective workplace violence prevention program must balance safety with fairness, consistency, and appropriate intervention.
Not every employee who becomes angry, experiences personal difficulties, or demonstrates unusual behavior presents a violence risk.
An overly aggressive response can discourage future reporting, damage employee trust, and complicate an already tense situation.
At the same time, dismissing repeated threatening behavior as harmless frustration can prevent an organization from recognizing an escalating concern.
The solution is a consistent, evidence-based assessment process.
Organizations should evaluate observable conduct rather than make judgments based on stereotypes, disability, mental health assumptions, race, religion, or other personal characteristics.
Proper threat management focuses on relevant behavior and circumstances while identifying the most appropriate response.
The objective is not to punish every concerning behavior. It is to understand and manage the concern before it becomes a safety issue.
Building a Workplace Culture That Recognizes and Reports Concerns
Recognizing the difference between a threat and concerning behavior is only one part of a comprehensive workplace violence prevention program.
Organizations must also establish the systems needed to receive, evaluate, and act on information.
The Occupational Safety and Health Administration (OSHA) emphasizes the importance of workplace violence prevention programs that include employee training, reporting procedures, hazard assessment, and management commitment.
A strong program should establish clear expectations for employees, supervisors, and leadership.
It should also include a multidisciplinary threat assessment team with appropriate representation from areas such as human resources, security, operations, legal counsel, and other relevant specialties.
When necessary, outside threat assessment professionals or law enforcement may also be involved.
This coordinated approach helps ensure that information is not isolated within individual departments and that responses are based on the full circumstances.
For organizations seeking to strengthen their programs, IMT's workplace violence prevention and threat assessment services provide practical support in developing reporting systems, training personnel, assessing concerns, and establishing threat management procedures.
Prevention Begins Before a Direct Threat Is Made
Workplace violence prevention is not simply about reacting to threatening statements or preparing for an active assailant situation.
It is about recognizing when behavior warrants attention, creating an environment where employees feel comfortable reporting concerns, and ensuring trained professionals have the systems and resources to respond.
The absence of a direct threat does not automatically mean the absence of risk.
Likewise, the presence of concerning behavior does not automatically mean someone intends to become violent.
Understanding both principles allows organizations to make more informed decisions, support employees appropriately, and address potential risks before they escalate.
Recognize the behavior. Report the facts. Assess the circumstances. Manage the risk.
That is the foundation of a proactive workplace violence prevention program.
How IMT Can Help
Incident Management Team (IMT) works with organizations to strengthen workplace safety, security, and preparedness through comprehensive workplace violence prevention consulting, behavioral threat assessment and management, employee awareness training, and threat assessment team development.
Our multidisciplinary specialists help organizations establish practical procedures for recognizing and reporting concerns, evaluating threatening communications, managing behavioral risks, and responding to potential workplace violence situations.
Whether an organization is developing a new prevention program, improving existing reporting procedures, or addressing a specific threatening or concerning situation, IMT provides guidance tailored to its operations, workforce, and level of risk.
A more prepared organization is better positioned to recognize concerns early, make informed decisions, and protect its people.
Government Resources and References
The following government publications provide research and guidance supporting the principles discussed in this article.
Federal Bureau of Investigation (FBI). Making Prevention a Reality: Identifying, Assessing, and Managing the Threat of Targeted Attacks. Includes guidance on distinguishing between making a threat and posing a threat, behavioral assessment, and threat management.
Federal Bureau of Investigation (FBI). Prevent Mass Violence. Identifies concerning behaviors and emphasizes recognizing and reporting warning signs.
https://www.fbi.gov/how-we-investigate/prevent-mass-violence
U.S. Secret Service, National Threat Assessment Center (NTAC). Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence (2024). Provides guidance for structured assessment and management of concerning and threatening behavior.
Occupational Safety and Health Administration (OSHA). Workplace Violence. Explains workplace violence prevention programs, employee training, hazard assessment, and organizational responsibilities.
Cybersecurity and Infrastructure Security Agency (CISA). De-escalation Series: Recognize — How You Can Notice the Warning Signs of Violence (2025). Provides guidance on recognizing concerning behavior, understanding context, and reporting potential violence.
https://www.cisa.gov/sites/default/files/2025-09/De-escalation_Series_1-Recognize_508_202509.pdf
This article is provided for general educational and workplace safety awareness purposes. It is not a substitute for an individualized behavioral threat assessment conducted by qualified professionals.