The 2025 Guide to Threat Assessment Approaches for Law Enforcement

For law enforcement officers, accurately identifying and responding to threats is critical to maintaining public safety. Whether it involves reacting to active threats in real time or strengthening long-term predictive capabilities, threat and risk assessments serve as vital strategies to mitigate risks and prevent violent incidents.

But threat assessment means different things to different people, and the definition of threat assessment varies widely across fields. Security professionals, police, military personnel, psychologists, and school counselors all conduct tasks they describe as threat assessment. While all these tasks are predictive in nature, the methods and objectives differ. 

For example, judges conduct threat risk assessments to assess whether someone poses a general danger to the public, while law enforcement typically concentrate on assessing imminent or immediate threats. 

This guide was first published in 2019. I wrote it because I was having trouble differentiating between all the different types of threat assessment. It turns out that lots of people use the term. Sometimes the term is used interchangeably with “risk assessment.” 

Since its publication, this guide has proven to be one of the most popular posts. In 2024, 2,526 people all over the world had read this post. For a small company like us, this is awesome. We are proud to be helping police everywhere implement strategies that can help them protect their communities. 

I hope you find this resource useful too. Don’t hesitate to reach out if we can help you or your organization.

Threat Assessment Approaches

Before diving into threat assessment, it’s important to clarify the specific problem you aim to address.

Are you looking to:

  1. Plan for and protect facilities, soft targets, and critical infrastructure against terrorist attacks, insider threats, or natural disasters?

  2. Equip your officers to identify behavior-based threats and respond to individuals who pose immediate danger, such as active shooters? 

  3. Safeguard your computer networks, systems, and servers from attacks by malicious actors?

  4. Identify, assess, and intervene with individuals who may commit targeted or instrumental violence, such as a mass shooting?

  5. Evaluate a specific individual’s risk for violent behavior?

You can use this infographic to figure out which section will be most helpful to you:

 

1. The Security Threat and Risk Assessment

In the security and protection industry, threat assessment involves evaluating and analyzing potential risks that could compromise the safety of critical infrastructure and the people associated with a specific site or facility. It can also be a crucial tool for those seeking to protect soft targets from targeted violence. 

This process focuses on identifying existing protective measures and vulnerabilities at facilities and implementing strategies to reduce those vulnerabilities and enhance safety. Assessments evaluate things like physical security, cybersecurity, and staffing protocols. 

There are a broad range of threats that can affect a particular site or location, including:

  • External hazards: Natural disasters, fires, and other environmental risks; 

  • Nonviolent and violent criminal threats: Theft, threats toward staff, active shooter incidents, or terrorist threats; 

  • Potential accidents: Issues stemming from improper building maintenance or unsafe working conditions;

  • Cyber threats: Hacking, data breaches, ransomware, or other malicious activity targeting IT systems;

  • Operational disruptions: Threats that could impact telecommunications, transportation, or the delivery of essential services at the site. 

Security Threat Risk Assessment at a School

For a security risk assessment, let’s take the example of an elementary or high school. Potential threats to a school could include natural disasters, active shooter incidents, or accidents arising from improper safety precautions. Each of these threats requires a different response

This security threat risk assessment includes not only identifying potential threats but also assessing the likelihood of their occurrence. Just because something can happen doesn’t mean it will. 

The Vulnerability Assessment

Following the security risk threat assessment is the vulnerability assessment, which has two parts.

  1. Identifying assets and people at risk: This involves determining the critical assets—such as buildings, equipment, and personnel—that may be impacted. This includes an estimation of financial impacts that would be result if the location were attacked and unable to provide services.  

  2. Evaluating target attractiveness and defenses: For intentional attacks, this step assesses how attractive the target may be to potential attackers. It also examines the current level of defenses in place to mitigate targeted attacks.  

In schools, common security gaps include challenges in securing entry and access points, insufficient security measures due to budget constraints (such as limited surveillance/camera systems or a lack of security personnel), and insufficient training or experience among school staff in handling security-related incidents.

 

2. Active Threat Assessment

In law enforcement, threat assessment refers to the process of observing, identifying, and responding to potential imminent or immediate threats. These threats may target your officers, the public, or both. At Second Sight, we use the term “active threat assessment” to describe our systematic process of identifying, evaluating, and responding to immediate threats in real time. 

The Active Threat Assessment Methodology

Active threat assessment involves focused observation of individuals’ behaviors and actions. In this approach, an observer--such as one of your officers--systematically scans their environment, identifies potentially suspicious individuals (persons of interest), and assesses any potential threats they may pose.

Threat_Assessment_Training_V2.png

A person of interest (POI) is someone who displays some type of abnormal behavior, warranting closer observation. At this point, an officer can assess threat indicators, which are visual cues that might suggest threatening behavior or suspicious activity. If threat indicators are present, the POI may become a focus for potential interdiction.

Active Threat Assessment Training

Threat assessment skills will help your officers focus their attention on true threats and equip them to prevent potential tragedies. For example, a POI might display visible signs of carrying a weapon. If your officers can identify these signs, they are better able to intervene and prevent a potential attack.

Second Sight offers active threat assessment training for law enforcement professionals. Law enforcement classes are certified through the IADLEST National Certification Program (NCP) and are regularly updated based on emerging research as well as feedback from our participants.

You can also take our free online course, Introduction to Active Threat Assessment. In this course, you will learn about the active threat assessment methodology and decide if our full-length programs are right for you and your officers.  

 

3. The Cyber-security Threat Risk Assessment

The same threat risk assessment process applies to cybersecurity, a critical component of overall risk management. A cybersecurity threat risk assessment focuses on protecting access to data and personal information, networks, software (e.g., internal communications or data management systems), as well as any hardware (e.g., your officers’ laptops and mobile phones). 

A cyberattack is any deliberate attempt to gain unauthorized access to a network, computer system, or device. Attackers typically aim to steal, modify, expose, or destroy data and other assets using a variety of techniques.

One increasingly common type of cyberattack is ransomware. Ransomware is a form of malware that is installed on a system without the user’s knowledge or permission, often via websites, emails, or file attachments. Once infected, the ransomware locks and encrypts the user’s data, files, and systems, rendering them inaccessible or unusable until a ransom is paid to the attacker.

Ransomware can have dire consequences. Once data is compromised there’s no guarantee the victim will get it back, even if they pay the ransom. Cybercriminals may still withhold or destroy the files.  

In recent years, there has been a significant increase in the number of ransomware attacks, with several high-profile incidents occurring in hospitals, schools, and even government agencies. According to industry surveys conducted by Sophos in 2024, an estimated 67% of healthcare organizations, 80% of schools, and 69% of government agencies have experienced ransomware attacks. These incidents disrupt critical services, endanger lives, and cause devastating financial consequences.

  • To learn more about how to protect your organization against ransomware, check out the following resources: 

The basic steps of a cybersecurity threat risk assessment are:

  1. Identify the potential systems that are at risk.

  2. Identify specific threats for each system (e.g., unauthorized access, misuse of information, data leakage or exposure, service disruptions).

  3. Evaluate inherent risks and determine what potential consequences could result if threats materialize.

  4. Analyze existing controls and measures in place to prevent, detect, mitigate, or compensate for threats.

  5. Determine how well current safeguards successfully reduce risk and mitigate threats.

  6. Evaluate the probability of a threat occurring based on existing controls.

  7. Combine impact and likelihood to determine overall risk level and calculate a “risk rating.”

After the assessment, you will have a clearer understanding of existing cybersecurity controls and remaining vulnerabilities. From there, you can implement additional security measures to mitigate potential risks. 

If you’re new to cybersecurity threat risk assessment and don’t know where to start, check out these tips. If you’re already familiar with cybersecurity threat risk assessment and looking to adopt best practices in your organization, check out these free modules from CISA, which teach you how to do this in bite-sized steps. 

  • For information on how to apply cybersecurity best practices to public safety organzations, check out:

 

 4. Threat Assessment for Instrumental Violence

Instrumental violence refers to acts or threats of targeted violence, such as a mass shooting. In a workplace setting, this could involve an employee who has made threats against colleagues or has been involved in recent altercations.

Threat assessment for instrumental violence is incident- and subject-specific, meaning it evaluates the likelihood that a particular individual will carry out a specific attack. This growing field is often referred to as Behavioral Threat Assessment and Management (BTAM) or Threat Assessment and Threat Management (TATM). For a general overview of this approach, check out the National Threat Evaluation and Reporting Program’s Behavioral Approach to Violence Prevention.

BTAM often occurs in team settings and can involve school administrators, community members, law enforcement, and mental health workers. Learn more about threat assessment teams’ baseline capabilities from recent research published by the National Counterterrorism Innovation, Technology, and Education Center (NCITE). 

If you are looking to implement BTAM at your organzation, the National Threat Evaluation and Reporting (NTER) Program offers courses for both trainers and trainees:

The National Association of School Psychologists (NASP) outlines a broad framework for identifying and intervening with potentially violent individuals who exhibit risk factors for instrumental violence. In some instances, authorized personnel can use databases to access information about specific individuals to assess their risk factors.

A key authority in this area is the U.S. Secret Service National Threat Assessment Center (NTAC). In their 2023 report, Mass Attacks in Public Places, they found that many mass attackers share common characteristics, including personal grievances, history of criminal behavior, history of substance abuse or mental health symptoms, and other stressors such as financial instability. Additionally, many attackers exhibited concerning behaviors or made threatening statements before the attack. Being able  to recognize these situational and behavioral indicators is essential for averting such attacks. For more information, check out the RAND corporation’s guidance on how to recognize potential warning signs of a mass attack and assess for threat severity

For resources specific to law enforcement, check out the following: 

Threat Assessment in Schools

When it comes to preventing instrumental violence in schools, a nuanced approach is best. This process involves assessing students for multiple factors, including motives, communications, access to weapons, stressors, emotional problems, and developmental issues. For a deeper dive into this approach, check out our post on school behavioral threat assessment.

One alarming trend on the rise is the false reporting of attacks at schools and universities. These hoax calls are part of a coordinated “swatting” campaign that exploits the widespread fear of school shootings. Swatting involves making false reports of violent situations--such as a bomb threat or active shooter---to elicit a police response to a particular location, preferably by a SWAT team.

These incidents can be extremely dangerous, as they put the lives of individuals at risk and prompt law enforcement to respond aggressively, unaware that the situation is a hoax. The fear and trauma caused by the sudden, intense police response can have lasting psychological effects on those involved. Additionally, these incidents occupy emergency resources, potentially delaying response times for real emergencies.  To learn more about identifying and responding to a potential swatting incident, see this guide from the state of Washington’s School Safety Center.

 

5. The Violence Threat Risk Assessment

Violence threat risk assessments are used to better understand an individual’s tendency toward violence and estimate their likelihood to engage in violent behavior in the future. These assessments help practitioners and intervention providers make informed decisions about risk mitigation, supervision, and treatment options for potentially dangerous individuals. This is often referred to simply as a “violence risk assessment” or just “risk assessment.” 

The difference between this approach and the instrumental approach in the previous section is that this approach evaluates an individual’s general tendency toward violence, and does not predict a specific attack on a specific target.

Typically, violence risk assessments are conducted by qualified clinical professionals rather than law enforcement. There are different types of violence threat risk assessments designed to predict different types of risks, ranging from domestic violence to terrorism. Some of these rely on the judgment of professionals, while others are actuarial-based. 

A growing recommendation is the shift toward structured professional judgment (SPJ) approaches. The SPJ method involves a systematic evaluation of risk factors by professionals who apply their expertise and judgment to assess an individual's level of risk. 

One benefit of the SPJ approach is that professionals examine a wide range of aggravating and mitigating factors and can offer more personalized assessments. However, some criticize the SPJ approach for being too subjective and inconsistent when making risk evaluations due to variations in professional judgment and individual biases. 

Well-known SPJ approaches include:

In contrast, actuarial-based risk assessment instruments (RAIs) use statistical methods and a scoring system to predict future risk, rather than relying on input from professionals. These tools use predetermined risk indicators that are informed by historical data and criminological theory to generate a numercial score, which reflects an individual’s likelihood of committing a specific act in the future.

One key benefit of RAIs is that they offer consistent predictions by relying on predetermined formulae. However, RAIs don’t adapt well to uncommon or nuanced circumstances, and it’s hard to say whether they outperform human judgment. Another potential drawback of RAIs is that they often include static factors that cannot be changed (such as being a male), and if historical data is biased, the algorithm might perpetuate biases.

Commonly used actuarial-based RAIs include:

Ultimately, selecting the “best” risk assessment tool for a situation depends on the nature of the risk being assessed (e.g., violent extremism, general violence), the characteristics of the population being assessed (e.g., age, gender), and the setting or context of the assessment (e.g., school, correctional facility). 

For a comprehensive approach to risk management for public entities, check out the Public Risk Innovation, Solutions, and Management (PRISM) framework. This framework covers all aspects of risk identification, assessment, and management, and includes various resources to assist organizations in various types of risks. 

 

What’s Next?

All of these approaches to risk assessment are essential for protecting our community and ensuring different aspects of public safety. Depending on your specific needs, any of these approaches to threat and security assessment may be relevant to you or your personnel.

As a next step, consider exploring some of the resources provided in this post, or enroll in our online program, Threat Awareness for Law Enforcement.

Previous
Previous

Strengthening School Security: The Vital Balance Between AI Technologies and the Human Touch

Next
Next

The Benefits of Workplace Violence Prevention Training