Complete guide to school threat assessment: School Behavioral Threat Assessment: The Complete Guide

Behavioral threat assessment is how schools turn a teacher's uneasy feeling, a worried student's message, or a disturbing post into a structured, caring response, before a situation becomes a crisis. This guide explains what it is, why it works, and how K-12 teams run it day to day, using the model published by the U.S. Secret Service National Threat Assessment Center (NTAC).

If someone is in immediate danger, call 911. Threat assessment is a prevention process. It never replaces an emergency response.

Why threat assessment matters

NTAC's 2019 study, Protecting America's Schools, examined 41 targeted attacks on K-12 schools in the United States from 2008 to 2017. Its findings explain why prevention has to start long before an attack:

• Every attacker showed concerning behavior first. All of the attackers in the study's background analysis exhibited concerning behaviors before their attack, most of them at school.
• Most of that behavior worried someone. In 80% of cases, the attacker's behavior caused others to be concerned about the attacker's safety or the safety of those around them.
• Most attackers communicated their intent. Two-thirds communicated their intent to attack, or threatened the target, within two weeks of the attack.
• Attacks end quickly. 83% were over within five minutes, which is why physical security and emergency response alone can't be the plan.

In short, the warning signs are usually there, and people usually notice them. What's often missing is a reliable way for that concern to reach the right people, and a process for those people to act on it.

What behavioral threat assessment is (and isn't)

A threat assessment process identifies students whose behavior has raised concern, gathers information about their thinking, behavior, and circumstances, assesses whether they may be on a path toward harming themselves or others, and puts supports and safety measures in place.

It is not:

• Profiling. NTAC found that "there is no profile of a student attacker." Attackers varied in age, gender, race, grade level, academic performance, and social characteristics. Assessment focuses on behavior and circumstances, never on traits.
• Prediction. NTAC's guide says the team "is not attempting to predict with certainty if violence will happen." It evaluates the factors that suggest violence might be a possibility, and works to change them.
• Discipline. A student can face consequences for breaking a rule, but discipline isn't the goal of an assessment. NTAC notes that "punitive measures are not preventative," and that removing a student from school does not remove the risk. See Threat Assessment vs. Discipline.

Most students who come to a team's attention are struggling, not dangerous. Often the right outcome is counseling, academic help, help with a conflict or bullying, or simply an adult who checks in regularly.

The NTAC model: eight steps

NTAC's operational guide, Enhancing School Safety Using a Threat Assessment Model (2018), describes a comprehensive targeted violence prevention plan in eight steps:

1. Establish a multidisciplinary threat assessment team.
2. Define prohibited and concerning behaviors, with a low threshold for intervention.
3. Create a central reporting mechanism, including an anonymous option.
4. Determine the threshold for law enforcement intervention.
5. Establish assessment procedures, organized around key investigative themes.
6. Develop risk management options: an individualized plan for each student.
7. Create and promote safe school climates.
8. Conduct training for all stakeholders.

Each step is covered in detail in The NTAC 8-Step Model, Explained.

How a case moves through the process

Here's what a typical case looks like in practice.

1. A concern is reported

A teacher overhears a student say something alarming, a student shows a counselor a post, or a parent calls the front office. NTAC's guidance is that the threshold for reporting should be low: the goal is to notice students in distress, not only students who have made explicit threats. Reports should flow to one central place that a team member monitors, with an anonymous option, because students are more likely to report when they don't fear retribution.

2. Immediate safety comes first

If there's any indication of imminent danger, such as a weapon on campus or a specific threat for today, the response is emergency procedures and law enforcement, right away. NTAC states that any safety concerns "should be immediately addressed before" assessment procedures begin.

3. The team gathers information

The team builds a picture of the student's situation from multiple sources: interviews with the student, the reporting party, classmates, teachers, and parents; class assignments; social media; and school, disciplinary, and other records. NTAC calls this a community systems approach. Students exist in more than one system, and people outside the classroom often know things teachers don't.

4. The team assesses using the investigative themes

NTAC identifies themes to explore, including the student's motives, communications, interest in weapons or violence, access to weapons, stressors, emotional and developmental issues, desperation or despair, whether the student views violence as an option, concerned others, capacity, planning, consistency between statements and actions, and protective factors. See The 13 Investigative Themes for questions to explore under each one.

The team doesn't need to finish every interview before acting. As NTAC puts it, "as soon as an area for intervention is identified, suitable management strategies should be enacted."

5. The team decides and plans

The team evaluates whether the student may be at risk of harming themselves or others, and develops an individualized management plan. That might include supports (counseling, mentoring, tutoring, mental health care), steps to address a motive or stressor (such as stopping bullying), safety measures for potential targets, and working with the family or law enforcement to restrict access to weapons when needed.

6. The team follows through

Plans stay in place until the team is no longer concerned. Someone owns each action, the team checks progress, and everything is documented: when the report came in, what was gathered and from whom, what the team decided and why, and what was done.

Documentation matters

NTAC recommends maintaining documentation of when reports come in; the information gathered; when, where, and how it was obtained; who was interviewed; the student's behaviors and circumstances; and the interventions taken. Good documentation:

• lets the team see patterns across multiple reports about the same student
• shows what was tried before and whether it worked
• keeps the process consistent from case to case and school to school
• gives the district a defensible record of its decisions

Standard forms help. See our free Threat Assessment Worksheet, Concern Reporting Form, and Management Plan templates.

Common pitfalls

• Waiting for an explicit threat. Earlier NTAC research found that in most incidents someone knew what the student was thinking or planning, even when the student didn't threaten the target directly. A student who hasn't made a threat may still need help.
• Treating it as discipline. Suspension can cut a student off from the adults and peers best placed to help, and NTAC notes that several school attacks have been carried out by former students who had been removed from the school.
• Relying on a checklist or profile. There isn't one. Assess behavior and circumstances.
• No central intake. If concerns go to whoever the reporter happens to know, they get lost.
• Poor follow-through. A plan without owners and dates is a hope, not a plan.
• Untrained staff. People can only report what they recognize. NTAC's eighth step is training for everyone.

Where to start

If your school or district is building a program, start with the team: who's on it, who leads it, and how it will receive reports. Our guide on how to set up a school threat assessment team walks through the first 90 days.

Sources

• U.S. Secret Service National Threat Assessment Center, Enhancing School Safety Using a Threat Assessment Model: An Operational Guide for Preventing Targeted School Violence (2018).
• U.S. Secret Service National Threat Assessment Center, Protecting America's Schools: A U.S. Secret Service Analysis of Targeted School Violence (2019).

Both are free at secretservice.gov/protection/ntac.