Slide 1 of 16
0%
👁

Threat Awareness

See It. Assess It. Report It.

⏱ 20 minutes
📚 Security & Threat Response Path
✓ OSHA/DHS Aligned
Katie
Katie, Your Safety Guide
Welcome to Threat Awareness! This module is about being observant and proactive, not paranoid. The Department of Homeland Security's "See Something, Say Something" principle teaches us that everyday awareness is our most powerful security tool. When you learn to read your environment and recognize what doesn't belong, you become the first line of defense for yourself and everyone around you. Let's sharpen those instincts together!
Slide 2 of 16

Why Threat Awareness Matters

Threat awareness is the ability to identify, assess, and respond to potential dangers before they escalate into incidents. It is a core competency for anyone responsible for safety and security.

🚨 The Reality of Threats
According to DHS and FBI research:
  • Pre-attack behaviors are observable in the vast majority of targeted violence incidents
  • Bystanders often notice warning signs but don't report them
  • Early reporting is the #1 factor in preventing planned attacks
  • Social engineering attacks exploit human trust to bypass physical security
  • Most security breaches begin with someone who didn't look like they belonged

Learning Objectives:

  • Identify the major types of threats (verbal, written, behavioral, environmental)
  • Recognize behavioral indicators associated with pre-attack planning
  • Apply situational awareness models, including the Cooper Color Code
  • Assess and report threats properly using established protocols
Slide 3 of 16

Types of Threats

Recognizing how threats manifest

Threats come in many forms. Understanding the categories helps you spot them faster and respond appropriately.

🗣 Verbal Threats
Spoken statements indicating intent to harm.

Direct: "I'm going to hurt you."
Indirect: "Someone should teach this place a lesson."
Conditional: "If they fire me, they'll regret it."

All verbal threats must be taken seriously, even those framed as jokes. Context, tone, and pattern matter. Report every instance.
📝 Written Threats
Threats communicated through text.

Notes or letters: Left on desks, in mailboxes, or posted publicly.
Emails and texts: Threatening language sent digitally.
Social media: Public posts, comments, or direct messages containing threats.

Written threats provide documentation. Preserve the original, do not alter or delete it, and report immediately.
🚶 Behavioral Threats
Actions that indicate planning or intent.

Surveillance: Watching, photographing, or mapping a location.
Rehearsal: Practicing or dry-running an attack plan.
Acquisition: Obtaining weapons, materials, or access credentials.

Behavioral indicators are often the most reliable warning signs because they show commitment beyond words.
🏢 Environmental Threats
Physical vulnerabilities that enable threats.

Unsecured areas: Unlocked doors, open perimeter gaps.
Poor lighting: Dark zones that conceal movement.
Access control gaps: Broken badges, tailgating, unmonitored entrances.

Environmental threats don't come from people directly but create the conditions that allow other threats to succeed.
⚠ Threats Often Combine
A single individual may display verbal, written, and behavioral threat indicators simultaneously. When you observe one type, look for the others. Convergence of multiple threat types dramatically increases the risk level and urgency of your report.
Slide 4 of 16

Behavioral Indicators

Pre-attack behaviors based on FBI/DHS research

Research into targeted violence consistently shows that attackers exhibit observable warning behaviors before acting. Recognizing these patterns is critical to prevention.

🔍 Unusual Interest in Security
Asking detailed questions about security procedures, camera locations, guard schedules, or alarm systems beyond what is normal for their role.
📷 Surveillance of the Site
Photographing or sketching building layouts, entrances, exits, and security features. Repeatedly observing the site from unusual vantage points.
🧪 Testing Security Responses
Probing how quickly guards respond, whether alarms work, or how easy it is to access restricted areas. Small boundary violations that test the limits.
🔫 Acquiring Weapons or Materials
Purchasing weapons, ammunition, or materials that could be used in an attack. Researching how to build devices or cause mass harm.
🗣 Making Concerning Statements
Expressing intent or desire to harm others. Glorifying past attacks. Statements like "people will remember my name" or "this place deserves what's coming."
🔄 Dramatic Behavioral Changes
Sudden withdrawal, aggression, paranoia, or erratic behavior. Giving away possessions. Saying final goodbyes. Changes inconsistent with their normal personality.
📋 Grievance Collection
Fixating on perceived injustices. Cataloging wrongs done to them. Blaming specific people or groups. An escalating sense of victimhood and desire for retribution.
⚠ Last Resort Thinking
Expressing hopelessness and a belief that violence is the only remaining option. "Nothing else will work." "There's no other way." This is a critical escalation point.
💡 The "Pathway to Violence" Model
The FBI's pathway to violence model describes a progression:

Grievance → Ideation → Research & Planning → Preparation → Breach → Attack

At every stage, the individual makes observable decisions and takes observable actions. The earlier we identify someone on this pathway, the more opportunities exist for intervention. Most people who start down this path never reach the end if they receive help or are disrupted in time.
Slide 5 of 16

Situational Awareness: The Cooper Color Code

A mental readiness framework for security professionals

Developed by Lt. Col. Jeff Cooper, this color code system describes four levels of mental alertness. It helps you calibrate your awareness to match your environment.

😶
Condition White
Unaware & Unprepared
Oblivious to surroundings. Distracted by phone, headphones, or daydreaming. No awareness of potential threats.

AVOID THIS STATE on duty. In Condition White, you can be surprised and overwhelmed before you can react.
🟡
Condition Yellow
Relaxed Alert — Your Default
Calm but scanning your environment. Aware of people, sounds, and activity around you. No specific threat identified but ready to notice one.

This is your baseline on duty. Example: Walking through the facility, making eye contact, noticing who belongs and who doesn't.
🟠
Condition Orange
Specific Alert
Something has caught your attention. A person, vehicle, package, or situation seems out of place. You focus on the potential threat and begin formulating a response plan.

Example: An unfamiliar person loitering near a restricted entrance, watching employee badge-in patterns.
🔴
Condition Red
Action Required
Threat confirmed. You are executing your response plan: reporting, evacuating, confronting, or engaging emergency protocols.

Example: The loiterer from Condition Orange is now trying to force open the restricted door. You activate your radio and initiate lockdown.
✓ Practical Application
Train yourself to live in Condition Yellow:
• When you enter a room, identify exits and scan for anything unusual
• In a parking lot, look up from your phone and observe who is around you
• On patrol, note vehicles, people, and objects that don't fit the pattern
• Shift to Orange the moment something triggers your attention
• Have a mental "what if" plan so you can move to Red without freezing

Awareness is not anxiety. Condition Yellow is relaxed and sustainable. It simply means your eyes are open and your mind is engaged.
Slide 6 of 16

Site Security Assessment

Evaluating your environment for vulnerabilities

A security-aware professional knows their environment inside and out. Use this checklist-based approach to assess any site, informed by Crime Prevention Through Environmental Design (CPTED) principles.

💡 What is CPTED?
Crime Prevention Through Environmental Design is a framework that uses building and landscape design to reduce opportunities for crime. Its core principles are natural surveillance, natural access control, territorial reinforcement, and maintenance. Understanding CPTED helps you see your site through an attacker's eyes.

Site Assessment Checklist

✓ Entry & Exit Points
  • Are all entry points monitored (cameras, guards, or electronic access)?
  • Can doors be locked down quickly in an emergency?
  • Are emergency exits clearly marked and unobstructed?
  • Are loading docks and service entrances secured when not in active use?
✓ Lighting & Visibility
  • Are parking lots, walkways, and building perimeters well-lit?
  • Are there dark zones or blind spots where someone could hide?
  • Do interior spaces have clear sight lines (no hidden alcoves or blind corners)?
  • Are burned-out lights reported and replaced promptly?
✓ Camera Coverage & Access Control
  • Do cameras cover all critical areas (entrances, stairwells, parking, perimeter)?
  • Are there known blind spots in camera coverage?
  • Is the badge/key card system functioning properly? Are lost badges deactivated?
  • Are visitor sign-in procedures followed consistently?
✓ Natural Surveillance & Design
  • Can employees see approaching visitors from their workstations?
  • Are hedges, walls, and fences designed to prevent concealment?
  • Are high-value areas (server rooms, cash handling) in interior, controlled locations?
  • Is landscaping maintained to preserve sight lines?
⚠ Report Vulnerabilities
If you identify gaps during your assessment, document them and report them to your security manager. Environmental weaknesses are just as important to fix as behavioral threats are to report. A strong environment deters threats before they begin.
Slide 7 of 16

Identifying Suspicious Activity

Knowing what to look for

Suspicious activity is any observed behavior that could indicate a person is planning or committing a crime or attack. It is based on what someone is doing, not on how they look.

👤 People Who Don't Belong
Individuals in restricted areas without authorization. People who avoid eye contact or change direction when approached. Someone who can't explain their reason for being there.
🚗 Unusual Vehicles or Packages
Vehicles parked in odd locations for extended periods. Unattended bags, boxes, or packages in public areas. Vehicles circling the property repeatedly.
📸 Photography of Security Features
Photographing or recording cameras, access points, guard posts, fences, or alarm panels. Taking detailed notes about security infrastructure.
❓ Probing Questions
Asking about shift changes, guard numbers, alarm response times, or employee routines. Seeking information about security procedures beyond their need to know.
🎭 Dry Runs or Rehearsals
Walking through a building or area methodically without a clear purpose. Testing entry methods. Timing security patrols or camera rotations.
📦 Abandoned Items
Unattended backpacks, briefcases, or containers left in lobbies, hallways, or near building infrastructure. Items placed in unusual locations near HVAC, electrical, or structural elements.
🚨 Trust Your Instincts
If something feels wrong, it probably is. Your subconscious processes environmental cues faster than your conscious mind. That uneasy feeling is your brain detecting a pattern break before you can articulate what it is.

Never dismiss your gut feeling. Report what you see and let trained professionals determine whether it warrants further investigation. A false alarm costs nothing. A missed warning can cost everything.
Slide 8 of 16

Social Engineering & Manipulation

How threats exploit human trust

Social engineering bypasses physical security by manipulating people. Attackers exploit natural human tendencies like helpfulness, obedience to authority, and the desire to avoid conflict.

1
Pretexting (Fake Stories)

Creating a fabricated scenario to gain trust or access. Examples: "I'm the new IT technician." "I left my badge inside." "I'm here to meet John in accounting." Always verify the story through an independent channel before granting access.

2
Tailgating / Piggybacking

Following an authorized person through a secured door. They may carry large boxes so you hold the door, or simply walk closely behind you. Never hold doors for unauthorized individuals, even if it feels rude. Direct them to the front desk.

3
Authority Impersonation

Wearing fake uniforms, badges, or claiming to be inspectors, executives, or law enforcement. People tend to comply with perceived authority figures without questioning. Always verify credentials through official channels.

4
Distraction Techniques

One person creates a commotion or draws attention while an accomplice slips past security. Staged arguments, medical emergencies, or loud disruptions can all be cover for unauthorized entry. Maintain security posture even during distractions.

5
Phishing for Information

Casually asking employees about schedules, security protocols, building layouts, or personnel details. It may feel like friendly conversation, but the information can be used for reconnaissance. Be mindful of what you share and with whom.

✓ How to Verify and Challenge Respectfully
You can challenge someone politely without being confrontational:

• "Can I help you find who you're looking for?"
• "I'll need to verify that with our office. One moment, please."
• "Let me escort you to the front desk so they can get you set up."
• "Can I see your badge? It's our policy for everyone in this area."

Being politely firm is professional, not rude. Legitimate visitors will understand. Those with bad intentions will often leave rather than face verification.
Slide 9 of 16

Threat Assessment Process

A structured approach to evaluating threats

When you observe something concerning, use this five-step process to organize your thinking before reporting. You are not expected to make the final call on threat level, but clear observations help those who do.

1
Identify: What Exactly Was Said or Done?

Record the specific words, actions, or behaviors you observed. Be factual and precise. "He said he would 'make everyone pay'" is more useful than "He was being weird." Stick to observable facts, not assumptions.

2
Evaluate Credibility: Can They Carry It Out?

Does the person have the physical ability, resources, or access to follow through? A threat from someone with known access to weapons or restricted areas is more credible than a vague statement from a stranger passing by.

3
Assess Intent: Do They Mean It?

Consider context and history. Is this an isolated outburst or part of an escalating pattern? Have they made similar statements before? Are they taking steps that align with their words (acquiring materials, conducting surveillance)?

4
Determine Capability: Do They Have the Means?

Capability includes physical means (weapons, tools), knowledge (training, expertise), and opportunity (access to the target). Someone who has all three represents a significantly higher risk than someone with only one.

5
Report: Always Report, Let Professionals Assess

Even if you are unsure about steps 2-4, report what you observed. Trained threat assessment professionals have tools, databases, and context you don't. Your observation could be the missing piece that completes a larger picture.

⚠ You Don't Need All the Answers
The five-step process helps you think clearly, but you are never expected to complete a full threat assessment yourself. Your role is to observe, note details, and report. Let security professionals, law enforcement, and threat assessment teams make the final determination. A partial report with good observations is infinitely more valuable than no report at all.
Slide 10 of 16

Communication & Reporting

How to report effectively

A well-communicated report can be the difference between a prevented incident and a missed opportunity. Reporting is the most important action you can take.

✓ Who to Report To
Know your reporting chain before you need it:
• Immediate supervisor or shift lead for initial reports
• Security department or operations center for active concerns
• HR department for employee-related behavioral concerns
• Local law enforcement (911) for imminent threats
• DHS tip line (1-866-347-2423) for suspicious activity related to terrorism
• Anonymous reporting systems (if your organization has one)
💡 What to Include in Your Report
Use clear, factual, specific language. Include:

• Who: Physical description, name if known, clothing, distinguishing features
• What: Exactly what was said or done (use direct quotes when possible)
• When: Date and time of the observation
• Where: Specific location (building, floor, room, parking area)
• Direction of travel: Which way did they go? Vehicle description and plate if applicable
• Witnesses: Who else was present?
🚨 When in Doubt, Report
You are NOT expected to investigate. Your job is to observe and report. Do not approach, follow, or confront a suspicious person unless trained and authorized to do so.

Common reasons people hesitate to report:
• "I might be wrong." (Better to be wrong than silent.)
• "Someone else probably reported it." (They probably didn't.)
• "I don't want to cause trouble." (You're preventing trouble.)
• "It's probably nothing." (Let the professionals decide that.)

There is no penalty for a good-faith report that turns out to be nothing. There can be devastating consequences for a real threat that goes unreported.
Slide 11 of 16

Personal Safety Planning

Practical steps to keep yourself safe

Awareness without a plan is incomplete. Personal safety planning ensures you can act quickly and decisively when it matters most.

✓ Know Your Environment
Every time you enter a space:
• Identify at least two exits
• Note where you could take cover or concealment
• Observe who is already there and what they're doing
• Locate the nearest phone, alarm, or panic button
• Position yourself where you can see entrances
✓ Plan Your Routes
• Know primary and alternate routes between key locations on your site
• Vary your arrival and departure times and routes when possible
• Park in well-lit areas near building entrances
• Have keys or badge ready before you reach your vehicle or door
• Avoid isolated areas, especially during low-traffic hours
✓ Communication & Check-In
• Keep your phone charged and accessible at all times
• Establish check-in procedures with your team or supervisor
• Know the radio codes or duress signals used by your organization
• Use the buddy system when working in or moving through high-risk areas
• Let someone know where you're going and when to expect you back
⚠ Protective Positioning
Small habits that increase your safety margin:
• Sit or stand where you can see exits and entrances
• Keep a clear path between yourself and the nearest exit
• When interviewing or meeting unfamiliar people, keep a desk or table between you
• Avoid turning your back to doors or open hallways
• Trust your instincts. If a situation feels unsafe, create distance first and assess second
Slide 12 of 16

Key Takeaways

Your quick reference summary

Core principles of threat awareness:

  • Four types of threats: Verbal, written, behavioral, and environmental. Recognize each form and understand that they often overlap.
  • Behavioral indicators are key: Surveillance, security testing, weapons acquisition, concerning statements, grievance collection, and last resort thinking are all observable pre-attack behaviors.
  • Cooper Color Code: Stay in Condition Yellow (relaxed alert) as your default. Shift to Orange when something catches your attention, and Red when action is required.
  • Assess your environment: Use CPTED principles to evaluate entry/exit points, lighting, camera coverage, access control, and natural surveillance.
  • Identify suspicious activity: Look for people who don't belong, unusual vehicles or packages, photography of security features, probing questions, and abandoned items.
  • Defend against social engineering: Verify identities, never hold secured doors for strangers, challenge politely but firmly, and be mindful of what information you share.
  • Use the 5-step threat assessment: Identify, evaluate credibility, assess intent, determine capability, and report.
  • Report early and often: Clear, factual, specific reports save lives. When in doubt, report. You are never expected to investigate on your own.
  • Plan for your safety: Know your exits, vary your routes, use check-in procedures, practice protective positioning, and trust your instincts.
Katie
Katie, Your Safety Guide
Awareness is the first line of defense. You don't need to be a law enforcement officer to make a difference. By staying alert, recognizing what doesn't belong, and reporting what you see, you protect yourself and everyone around you. See it. Assess it. Report it. That's how we keep each other safe!
Quiz Question 1 of 3

Knowledge Check

What is the ideal default awareness level for a security professional on duty according to the Cooper Color Code?
Condition White — relaxed and unaware to avoid burnout
Condition Yellow — relaxed alert, scanning environment, aware of surroundings
Condition Orange — heightened alert focused on specific potential threats
Condition Red — maximum alertness at all times
Quiz Question 2 of 3

Knowledge Check

You notice an unfamiliar person photographing the building's security cameras and access points. What should you do?
Ignore it — people photograph buildings all the time
Confront them aggressively and demand they delete the photos
Observe, note details, and report the activity to your supervisor or security team
Call 911 immediately — this is clearly an imminent threat
Quiz Question 3 of 3

Knowledge Check

Which of the following is a recognized pre-attack behavioral indicator?
An employee who always eats lunch alone
A person conducting surveillance, testing security, and making threatening statements
A visitor who asks for directions to the restroom
A coworker who recently changed their hairstyle
🎯
0 / 3

Quiz Complete

Calculating your results...

"Let's see how you did!"