How to Conduct a Threat Assessment: Steps and Checklist

A threatening message gives your team a reason to investigate. A useful assessment explains who is at risk, what the evidence shows, what remains unknown, and what you will do next.

To conduct a threat assessment, define the concern, check for immediate danger, gather and verify information, assess the behavior in context, and put a plan in place to reduce risk. Keep reviewing the case as facts change.

This guide focuses on behavioral threat assessment for targeted violence, including workplace threats, stalking, and threats to executives. The workflow below is Intrace's practical synthesis of public federal guidance. It is not an official FBI or Secret Service procedure.

What is a threat assessment?

A behavioral threat assessment examines a person's conduct and circumstances to assess whether they are moving toward violence and to guide prevention.

The FBI distinguishes making a threat from posing a threat. A person can pose a risk without sending a direct threat. A threatening statement also needs investigation before the team can judge what it means. Assess the full situation rather than the wording alone. 1fbi.govFBI: Making Prevention a Reality: Identifying, Assessing, and Managing the Threat of Targeted Attacks

Threat assessment also differs from related security tasks:

This article addresses the first question. Findings from the other assessments help your team choose protective measures.

1. Define the concern and the people at risk

Start with a short case statement.

Record what brought the case to your attention, who reported it, who or what appears to be targeted, and which decisions the assessment must support.

For example:

A public account has repeatedly named our CEO and posted a photo of the office entrance. We need to verify the account, establish when and where the photo was taken, and decide whether the CEO's next public appearance needs added protection.

That statement gives investigators specific questions to answer. It also avoids treating an unverified account as a known person.

Open a case record with an owner, an intake time, and a place to record decisions. Define the scope of collection so the investigation stays tied to the safety concern.

2. Check for immediate danger

Decide whether someone needs protection now.

The FBI separates rapid triage from a fuller assessment. Triage uses the information available to set urgency and immediate actions while further investigation continues. 1fbi.govFBI: Making Prevention a Reality: Identifying, Assessing, and Managing the Threat of Targeted Attacks

Ask:

1. Is an attack underway, or is someone approaching a potential victim?
2. Does the report describe a near term plan, a location, or access to a weapon?
3. Where are the person of concern and the potential victim, if known?
4. What information do emergency responders need?
5. Which protective actions can start at once?

If danger is immediate, contact emergency services and activate your emergency plan. Do not wait for a complete report.

Record unknowns as unknowns. "No information about weapon access" is different from "verified lack of access."

3. Assign a team and clear decisions

The Secret Service's 2024 guidance describes a six part framework covering team policy, procedures, reporting, assessment, management, and improvement. It stresses clear responsibilities and case administration. 2secretservice.govU.S. Secret Service NTAC: Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence

For a company, a practical team can include security, HR, legal counsel, and staff responsible for the affected site or executive. Bring in trained threat assessment specialists, clinicians, and law enforcement when the case calls for their expertise.

Agree on:

1. Who leads the case.
2. Who can approve protective measures.
3. Who handles contact with the person of concern.
4. Who briefs the potential victim.
5. Who receives reports outside normal hours.

Keep the decision log separate from raw evidence. A reader should be able to see what the team knew when it acted.

4. Investigate and verify the evidence

Build an account of events that another investigator can check.

The Secret Service and National Institute of Justice's protective intelligence guide emphasizes corroborated facts and multiple sources. Its approach combines records, communications, and interviews to understand the person, the target, and the circumstances. 3secretservice.govFein and Vossekuil, NIJ and U.S. Secret Service: Protective Intelligence and Threat Assessment Investigations: A Guide for State and Local Law Enforcement Officials

Preserve the original report

Save the original message or file where available. For online content, capture the source URL, account identifier, collection time, visible posting time, and surrounding context.

Keep the difference between these times clear. An image uploaded today does not prove the image was taken today.

For each item, record:

Confirm identity before linking records

A matching name, photo, or username is a lead. Check other identifiers before combining accounts or records.

Use an OSINT investigation platform, such as Intrace's Investigation Suite, to search from leads such as names, handles, and email addresses. Tools such as Intrace's Search, Social Vault, and Graph help investigators review records, collect social evidence, and map links between entities. Analysts must verify the matches. 6intrace.aiIntrace: Investigation Suite

A practical sequence is:

1. Start with the identifier in the original report.
2. Search for related accounts and relevant records.
3. Record the evidence for each proposed identity link.
4. Mark unresolved matches.
5. Keep unrelated people out of the case.

Review conduct over time

Use a social media evidence preservation and analysis tool, such as Intrace's Social Vault, to collect available posts, media, and metadata for review. A link analysis tool, such as Intrace's Graph, can help organize relevant relationships between accounts, people, and places. 6intrace.aiIntrace: Investigation Suite

Then build a timeline that combines online findings with authorized internal records and witness reports. Look for changes that answer the case questions.

For example, repeated criticism of an executive and a recent photograph of their office raise different questions. Establish whether the image is original, whether it shows a recent visit, and whether other evidence supports an attempt to approach the executive.

A graph link shows a connection in the evidence. It does not establish shared intent.

Gather information beyond the public web

Interview the reporting party and relevant witnesses through trained staff. Ask what they directly saw or heard, when it happened, and what records support their account.

Plan any contact with the person of concern with the assessment team. An interview is an investigative decision, not an automatic step for an untrained employee.

Use only information your organization is authorized to obtain. Public web research does not grant access to private accounts, restricted databases, or confidential records.

5. Assess behavior and circumstances together

The Secret Service's school safety guide organizes inquiry around motives, communications, weapons access, planning, capacity, stressors, consistency, and protective factors. That guide addresses students, so applying its themes in a workplace requires attention to the different setting. 4secretservice.govU.S. Secret Service NTAC: Enhancing School Safety Using a Threat Assessment Model

For an adult workplace or executive protection case, use questions such as these to guide review:

These are inquiry prompts, not a scoring test.

The 2024 NTAC guide identifies 20 assessment themes and cautions that they are not a checklist or individual predictors of violence. Assess them in context. 2secretservice.govU.S. Secret Service NTAC: Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence

Avoid turning a diagnosis, an unpopular view, lawful protest, or weapon ownership alone into a finding of violent intent. Explain the conduct that supports your concern and consider evidence that points in another direction.

6. Write a clear assessment

Give the decision maker a reasoned finding.

The FBI describes threat assessment as the start of management, rather than a final product. A level of concern needs a plan to address it. 1fbi.govFBI: Making Prevention a Reality: Identifying, Assessing, and Managing the Threat of Targeted Attacks

A useful assessment answers:

1. What harm are we concerned about?
2. Which verified facts support that concern?
3. Which facts reduce it or support another explanation?
4. What remains unknown?
5. What actions are justified now?
6. What new information would change those actions?

Separate confidence from urgency. A report can be uncertain and still require a prompt response because of the potential consequences.

If your team uses concern levels, define each level and its required actions. Avoid presenting a numerical score as the probability that a person will attack.

7. Put protective and support measures in place

Link each action to a specific finding.

CISA's security guide for houses of worship connects vulnerability assessment with layered protection, clear responsibilities, and exercised emergency plans. Although written for faith communities, it offers useful physical security considerations for other sites. 5cisa.govCISA: Mitigating Attacks on Houses of Worship Security Guide

For a corporate case, document the action, its purpose, its owner, and when to check whether it worked.

Select responses for the specific case. Consider how a warning, job action, or other intervention will affect the situation before carrying it out.

Protective measures and investigation can proceed together.

8. Monitor, reassess, and close with reasons

Set the next review before ending the current one.

The Secret Service's 2024 guidance links case closure to an explained assessment that the known concerns have been addressed. Silence alone does not establish that a case is resolved. 2secretservice.govU.S. Secret Service NTAC: Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence

Define what your team needs to learn next. Assign someone to review new reports and set clear triggers for urgent reassessment.

Use threat monitoring tools, such as Intrace's Risk Intelligence suite, to track online threats, harassment, doxxing, and physical events near people or facilities. Use relevant alerts to prompt human review and update the case. 7intrace.aiIntrace: Risk Intelligence

Record collection limits. A gap in available online content is not proof that the person has stopped acting.

When closing a case, explain the evidence behind the decision, any remaining safeguards, who approved closure, and what should trigger reopening.

Threat assessment report checklist

Use this structure to make the assessment easy to review:

1. Case details and owner.
2. Initial report and scope.
3. Immediate safety decisions.
4. Identity findings and unresolved matches.
5. Evidence register and timeline.
6. Findings on conduct, context, and protective factors.
7. Alternative explanations and information gaps.
8. Current assessment and reasons.
9. Actions, owners, and deadlines.
10. Review date, escalation triggers, and closure criteria.

This is a suggested report structure, not a validated assessment instrument.

Frequently asked questions

Can you conduct a threat assessment using social media alone?

Social media can reveal relevant statements and conduct, but it provides an incomplete view. Verify attribution and context, then seek other authorized evidence that answers the case questions.

Do you need a direct threat to start an assessment?

No. The FBI's guidance makes clear that concern can arise from behavior even when a person has made no direct threat. 1fbi.govFBI: Making Prevention a Reality: Identifying, Assessing, and Managing the Threat of Targeted Attacks

How often should you update a threat assessment?

Set the review schedule around the case and update it when material facts change. A new approach to the target, a new report, or a major change in circumstances should prompt a fresh review.

Tools to support your threat assessment

An integrated investigation and monitoring platform, such as Intrace, can bring search, social evidence collection, relationship analysis, and threat monitoring into a shared workflow. Your team can use those findings to support a documented assessment and decide what to do next. 6intrace.aiIntrace: Investigation Suite7intrace.aiIntrace: Risk Intelligence

To see an example of this workflow, book an Intrace demo.

Sources

1. 1.FBI: Making Prevention a Reality: Identifying, Assessing, and Managing the Threat of Targeted Attacks , 2017.
2. 2.U.S. Secret Service NTAC: Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence , 2024. See Steps 2 through 5.
3. 3.Fein and Vossekuil, NIJ and U.S. Secret Service: Protective Intelligence and Threat Assessment Investigations: A Guide for State and Local Law Enforcement Officials , 1998. See Chapters 4 and 5.
4. 4.U.S. Secret Service NTAC: Enhancing School Safety Using a Threat Assessment Model , 2018. See Step 5.
5. 5.CISA: Mitigating Attacks on Houses of Worship Security Guide , 2020. See Chapters 2, 3, and 5.
6. 6.Intrace: Investigation Suite .
7. 7.Intrace: Risk Intelligence .

Federal publications inform this guide's assessment principles. They do not endorse Intrace.