Recognizing Threats Before They Escalate

When schools think about threats, the image is often external.

An unknown person tries to enter the building. A weapon is brought onto campus. Someone outside the school sends a threatening message. Security systems are designed around keeping danger from getting in.

Those risks are real. But they are only part of the picture.

Threats can come from students, parents, staff members, visitors, or people in the surrounding community. They may arrive through social media, email, direct conversation, unusual behavior, or even AI-generated content.

The source may change. The responsibility to take the threat seriously does not.

Treat the Threat, Not the Format

Emerging technology can make threats look different.

An AI-generated video featuring a fictional character may initially appear absurd or unserious. But if the content contains a threat against a school, the fact that it was generated by artificial intelligence does not make the threat disappear.

The same principle already applies to drawings, messages, social media posts, and comments written into assignments. Schools do not evaluate a threat based solely on the medium through which it was delivered. They look at the meaning behind it.

Who created it?

Why?

How much effort went into producing it?

Is there an identifiable target?

Does the individual have access to the means to carry it out?

What other concerning behavior exists?

AI may actually introduce additional considerations. Creating a detailed or deceptive video requires planning and effort, and the person behind it may deliberately be trying to obscure their identity.

The technology changes. The assessment process should remain focused on intent, capability, behavior, and context.

Look Beyond the Perimeter

Security naturally focuses heavily on the perimeter. Locked doors, visitor management, weapons detection, cameras, and access control all exist to stop unauthorized people or prohibited items from entering a school.

But the assumption that the greatest threat must come from outside can create a blind spot.

Students and employees already have access. Contractors, volunteers, coaches, and other regular members of the school community may also be familiar with the building and its procedures.

That does not make any of those groups inherently dangerous. It simply means a comprehensive safety strategy cannot stop its thinking at the front door.

A threat from a staff member should be evaluated with the same seriousness as a threat originating elsewhere.

The process may differ depending on who is involved, but the fundamental question remains the same: What does this behavior tell us about risk?

Concerning Behavior Needs Context

One of the hardest parts of threat assessment is that many individual behaviors are not particularly meaningful by themselves.

Someone becomes withdrawn. Their appearance changes. They become angry with colleagues. They begin speaking differently about the organization. None of those things automatically means someone is moving toward violence. That is why context matters.

A behavior becomes more significant when it appears alongside other changes, grievances, threats, fixation, preparation, or escalation.

The challenge is recognizing the pattern before the outcome makes the pattern obvious.

After an incident, people frequently look backward and say, “That makes sense now.” They remember the comments, the disputes, the personality changes, and the unusual behavior. Once the outcome is known, connecting the pieces becomes much easier.

The goal of threat management is to start putting those pieces together beforehand.

Ask Why Something Changed

Schools do not need to treat every unusual behavior as evidence of a serious threat. They do need to become comfortable asking questions.

Why did that behavior change?

Why was that comment made?

Why did someone who normally behaves one way suddenly begin behaving differently?

Sometimes there will be a simple explanation. Perhaps a staff member is struggling with stress at home. Perhaps a student is reacting to bullying. Perhaps a parent is frustrated about an unrelated issue.

Understanding that context may actually reduce concern. But schools cannot gain context if nobody asks.

A strong safety culture encourages people to notice when something falls outside an individual's normal behavior and to follow up appropriately.

The response may be as simple as asking, “Is everything okay?”

In other situations, it may require administrators, human resources, mental health professionals, or law enforcement.

The important point is that someone acts.

Document Escalation

Documentation can feel administrative. In threat management, it is often what allows a pattern to become visible.

Imagine a parent confronts a coach after a sporting event. The exchange becomes aggressive, but eventually everyone leaves. If nobody documents the encounter, the incident may effectively disappear from the organization's memory.

Then another incident occurs. And another.

Each person experiences only one piece of the pattern. Without documentation, nobody necessarily sees the escalation.

A simple record can change that.

What happened?

Who was involved?

What was said?

What action was taken?

Were restrictions or expectations communicated?

What should happen if the behavior occurs again?

Documentation also provides continuity when staff change and gives schools a clearer basis for escalating their response if concerning behavior continues.

When the behavior becomes more serious, previous incidents are no longer vague memories. They become part of the context.

Removal Does Not Remove the Threat

Schools sometimes respond to serious behavior by removing the person creating the concern.

A student is suspended. An employee is fired. A parent is banned from an event.

Those actions may be appropriate. But they do not automatically resolve the underlying threat.

In some circumstances, removal may actually intensify a person's grievance. Someone who already believes they have been wronged may interpret suspension, termination, or exclusion as another injustice.

That does not mean schools should avoid taking disciplinary action. It means the safety process should continue afterward.

If an employee has made a credible threat and is terminated, the school should not simply close the file because that person no longer works there.

If a student making threats is suspended, the threat does not disappear when the student leaves campus.

The intervention and the threat-management process need to remain connected.

Build Relationships Before You Need Them

Schools should not have to answer every difficult threat-management question alone.

Law enforcement handles threatening behavior, domestic disputes, escalating conflict, and other potentially dangerous situations regularly. Mental health providers, emergency managers, and other community partners bring expertise that schools may not have internally.

The time to establish those relationships is before the difficult case appears.

Schools should know who they can call, what information can be shared, what circumstances warrant immediate law-enforcement involvement, and how community partners can support an intervention.

Those conversations can also improve emergency communication.

If law enforcement encounters a suspicious armed person near a school, both sides should already understand who gets notified, how quickly information moves, and when direct protective action may be appropriate.

Speed matters during an emergency.

But speed works best when the decisions behind it were made beforehand.

Intervene Before the Pattern Is Obvious

Threat assessment will never be perfectly predictive.

Many people experience stress, anger, bullying, grievance, or conflict without ever becoming violent. Schools should not treat normal human difficulty as evidence that violence is inevitable.

But that uncertainty does not justify ignoring concerning behavior.

The purpose is not to predict with certainty who will become dangerous.

It is to recognize when several pieces begin forming a concerning picture and create opportunities to intervene before that picture becomes clearer for the worst possible reason.

That requires training.

It requires communication.

It requires documentation.

And it requires relationships with people who can help interpret and respond to the risk.

Because threats do not always arrive from outside the building. Sometimes they are already inside the community.

And the earlier schools recognize what they are seeing, the more options they have to change what happens next.