The severity of a threat against key personnel is assessed by evaluating a combination of factors: the specificity of the threat, the subject’s history with the individual making it, their capability to act, and any observable behavioral changes. Threat severity assessment is not a single judgment call but a structured process that weighs intent, capability, and context together. The sections below unpack the most important questions organizations face when a threat against a key person emerges.
At Takana, we work with organizations to build exactly this kind of structured response capacity, so that when a threat arises, the right people ask the right questions from the very first moment.
What factors determine how serious a threat against a person is?
The seriousness of a threat against a person is determined by four core factors: the specificity of the threat itself, the threatening individual’s demonstrated capability to act, their proximity to the target, and any prior history of threatening behavior. When multiple factors align, the threat level rises significantly and warrants immediate structured assessment.
Specificity is often the most telling indicator. A vague expression of anger, such as “you’ll regret this,” carries a different weight than a threat that names a location, time, or method. The more detail a threat contains, the more seriously it must be treated, because specificity suggests planning rather than impulse.
Capability is the second critical dimension. Even a highly specific threat from someone with no realistic means to carry it out presents a different risk profile than one from a person with relevant skills, resources, or access. Evaluators must ask: does this individual have the physical, logistical, or technical ability to follow through?
Proximity and access matter enormously in executive threat assessment. A threat from someone who has no way to reach the target is categorically different from one made by a former employee with knowledge of routines, office locations, or security gaps. Finally, prior behavior is one of the strongest predictors of future action. A history of escalating contact, previous threats, or restraining orders should immediately elevate the threat level evaluation.
How does threat assessment differ from general risk management?
Threat assessment focuses on a specific, identified individual or group posing a potential danger to a named person or target, whereas general risk management addresses broad categories of organizational vulnerability. Threat assessment is behavioral and person-centered; risk management is systemic and process-centered. Both are necessary, but they operate at different levels of specificity.
In general risk management, an organization might identify “workplace violence” as a risk category and implement policies to reduce it. Threat assessment, by contrast, asks a much sharper question: does this specific person, given what we know about them right now, pose a credible danger to this specific individual?
The behavioral focus of personnel security threat work is what makes it distinctive. Trained assessors look at patterns of communication, social isolation, grievance narratives, and behavioral changes over time rather than abstract probability calculations. This makes threat assessment inherently dynamic. A situation that is low risk today can escalate rapidly if circumstances change, which is why ongoing monitoring is a core component rather than a one-time review.
What are the warning signs that a threat is escalating?
A threat is escalating when the threatening individual moves from expressing grievance to taking preparatory action. Key warning signs include increased frequency of contact, surveillance of the target’s movements, acquiring means relevant to the threat, making final-act statements, or withdrawing from social connections. Any single escalation indicator warrants immediate reassessment.
Behavioral warning signs tend to cluster into recognizable patterns. Watch for:
- Increased contact attempts after being told to stop, including through third parties or indirect channels
- Surveillance behavior such as appearing near the target’s home, workplace, or regular locations
- Leakage, meaning the individual shares their intentions with others, directly or indirectly
- Acquisition of means, whether weapons, access credentials, or information about the target’s schedule
- Final-act statements that suggest the person believes they have nothing left to lose
- Social withdrawal combined with a fixation on the target or the grievance
It is important to understand that most people who make threats do not act on them, and most people who do act on threats did not make explicit ones beforehand. This is precisely why behavioral escalation indicators matter more than the presence or absence of a verbal threat. The path toward violence is almost always observable in hindsight and, with proper monitoring, often in real time.
Who should be involved in assessing a threat against key personnel?
Effective threat assessment of key personnel requires a multidisciplinary team that typically includes a trained threat assessment professional, HR leadership, legal counsel, and, where appropriate, law enforcement. No single function has all the information or authority needed to make sound decisions alone. Cross-functional input reduces both under-reaction and disproportionate response.
Each participant brings a distinct perspective. HR often holds information about the threatening individual’s employment history, grievances, and behavioral patterns in the workplace. Legal counsel assesses what actions the organization can lawfully take, including protective orders or termination procedures. Security professionals evaluate physical exposure and protective measures. In cases involving credible criminal threats, early and transparent engagement with law enforcement is strongly advisable.
The target themselves should be kept informed throughout the process in a way that is honest but does not unnecessarily amplify anxiety. They often hold critical contextual information, such as the nature of their relationship with the threatening individual, prior interactions, or communications that have not been formally reported.
Organizations that lack an internal security function, or that want to supplement their existing capability, benefit from engaging an external partner with specialist expertise in key person security risk. We at Takana support organizations through exactly this kind of structured, multidisciplinary threat assessment process, ensuring that decisions are grounded in evidence and proportionate to the actual risk level rather than reactive to fear alone.
Frequently Asked Questions
How quickly should an organization respond once a threat against a key person is identified?
Initial triage should happen within hours, not days. The first step is to gather available information and convene at least a core subset of the assessment team — typically HR, security, and legal — to determine whether the situation requires immediate protective action or a structured monitoring response. Speed matters because threat situations are dynamic; delays in assessment can allow escalation to go undetected.
What should an organization do if the threatening individual is a current employee?
When the source of the threat is a current employee, the response must balance the duty of care to the target with the legal obligations owed to the threatening individual. HR and legal counsel should be engaged immediately to determine whether suspension, administrative leave, or other separation measures are appropriate while the assessment is conducted. Avoid confronting or disciplining the individual without a clear, coordinated plan, as poorly managed interactions can accelerate escalation rather than contain it.
Can a threat still be credible even if it was made in the heat of the moment?
Yes — context and emotion do not automatically reduce credibility. A threat made during a heated exchange still requires structured assessment against the same core factors: specificity, capability, proximity, and prior history. In some cases, emotionally charged statements reveal genuine grievance and intent that would otherwise remain hidden. The source and circumstances of a threat inform the assessment but should never be used as automatic grounds for dismissal.
What documentation should organizations keep when managing a threat situation?
All communications, reports, assessment decisions, and protective measures taken should be documented in a secure, time-stamped record from the moment a threat is identified. This serves two critical purposes: it creates an evidence trail that supports any future legal action, and it enables the assessment team to track behavioral changes and escalation patterns over time. Documentation should include not only what was reported but also what was observed, by whom, and when.
How do you protect the target without alerting or provoking the threatening individual?
Protective measures should be implemented discreetly, prioritizing changes to routines, access controls, and communication protocols that do not signal to the threatening individual that they are being monitored or that their target is reacting to them. Visible or heavy-handed security responses can sometimes reinforce a threatening individual’s sense of power or urgency. A trained threat assessment professional can help calibrate protective measures to be effective without inadvertently escalating the situation.
At what point should law enforcement be brought in?
Law enforcement should be engaged as soon as there is a credible, specific threat that suggests imminent risk of physical harm, or when criminal conduct — such as stalking, harassment, or weapons acquisition — is suspected. Early engagement is advisable even in ambiguous cases, as law enforcement can provide intelligence resources and legal tools, such as restraining orders, that are not available to organizations acting alone. Engaging law enforcement does not mean ceding control of the internal assessment process; the two efforts should run in parallel.
What is the most common mistake organizations make when responding to threats against key personnel?
The most common mistake is treating the threat as an isolated incident rather than a dynamic situation that requires ongoing monitoring. Organizations often take an initial protective action — such as issuing a no-contact directive or increasing physical security — and then consider the matter resolved. Without continued behavioral monitoring and a clear escalation protocol, early warning signs of renewed or intensifying threat activity can be missed entirely until the situation becomes critical.