Insights / Threat Readiness

The Complete Guide to Threat Readiness: Protecting Schools, Workplaces, Leaders and Travelers

By Warren Pulley · November 11, 2026

Last updated: November 2026

Threat readiness means three things: you notice concerning behavior early, you know exactly who decides what happens next, and you have practiced the response before you need it. Most organizations do not fall short because they don’t care about safety. They fall short because the pieces live in different offices. HR owns one part, facilities another, the travel desk a third, and nobody owns the whole picture.

This guide puts the pieces in one place. It covers ten areas where schools, workplaces, leaders and travelers are most often caught unprepared. Each section explains the problem, gives you first steps you can take this month, and points to the book of mine that goes deeper when you are ready. I have spent nearly four decades in security, law enforcement and protective operations, and the lesson that runs through all of it is simple: serious violence is rarely random, and it is rarely without warning. Readiness is about catching the warning and acting on it.

Self-check: where are you weakest?

Answer each question with a name, a document, or a date. Any question you can’t answer that way is a gap. Start with the first one you miss, and use the link to jump to that section.

1. If someone reported a worrying coworker, student or customer today, do you know who would receive the report? Warning signs
2. Do you have a named threat assessment team, with an alternate for every seat? Threat assessment team
3. If you employ people in California, could you hand an inspector your written workplace violence prevention plan and violent incident log today? SB 553
4. When did someone last test whether your doors, badges and visitor procedures actually stop an unauthorized person? Site security
5. Does your emergency operations plan name who leads in the first hour, and when was it last exercised? Emergency plans
6. Has anyone assessed the risk to your most visible leaders, at home and online, as well as at work? Executive protection
7. If a traveler misses a check-in tonight, does the person at home know what to do at 30 minutes, 60 minutes and 3 hours? Travel
8. If you or your staff carry a firearm, do you know the rules for every state and airport on the route? Lawful carry
9. Do your security plans account for cyber, AI-enabled and global threats, not just local ones? The bigger picture
10. Are your officers properly licensed, trained, and given a path to grow? People and careers

Count your gaps. One or two is normal. Five or more means the pieces are not connected yet, and the order of this guide is a reasonable order to fix them in.

1. Spot the warning signs early

The problem: people assume attackers “just snap.” The research says otherwise. When the U.S. Secret Service National Threat Assessment Center (NTAC) studied attacks against K-12 schools, it found that all of the attackers had shown concerning behavior beforehand, most had worried someone around them, and most had communicated their intent to attack. In two-thirds of the cases, at least one prohibited behavior was seen by classmates or adults and never reported.¹ NTAC’s October 2026 study of 50 mass attacks at workplaces found the same pattern: over three-quarters of the attackers had shown behavior that worried others.²

Targeted violence usually follows a path. It starts with a grievance, real or imagined, moves to the idea that violence is the answer, and then to research, planning and preparation. Every step along that path is behavior, and behavior can be seen. Among the workplace attackers NTAC studied who were current or former employees, all but one were motivated at least in part by a grievance, and more than three-quarters had shared concerning communications.²

First steps:

• Teach people what to notice: fixation on a person or a grievance, statements about violence or “making them pay,” interest in past attacks, unusual interest in weapons, research into a target’s schedule or location, and talk of being out of options.
• Tell people that a threat does not have to be spoken to matter. Someone can pose a threat without ever making one, and someone who makes a threat may pose none. The behavior around the words is what counts.
• Make reporting easy and safe. Give people one place to report, accept anonymous reports, and close the loop so the next person bothers to speak up.
• Write down the difference between an emergency (call 911 now) and a concern (send it to the team).

My book Targeted: Threat Assessment and Executive Protection in the Age of Grievance-Driven Violence is built around this pathway. It covers why behavior matters more than threats, how to set up one front door for every concern, lawful investigation of a person of concern, and least-intrusive case management. Every chapter ends with what the protector does on Monday morning. For a short introduction, read making a threat vs. posing a threat and how protectors read pre-attack behavior.

2. Build a threat assessment team

The problem: noticing warning signs is useless if the report lands on a desk where nobody owns it. Behavioral threat assessment and management (BTAM) is the structured process that turns a worried report into a decision and a plan. The Secret Service developed the approach to protect national leaders and has since adapted it for schools and workplaces. Its October 2026 workplace guide lays out a scalable eight-step framework: commit to employee safety and support; set BTAM policy and procedures; assemble a multidisciplinary team; identify and process reports of concerning behavior; gather information to assess risk; develop risk-management strategies; promote a safe and supportive climate; and train all employees.²

First steps:

• Name the team: a leader with authority, a mental health professional, a law enforcement or security liaison, HR or student services, and access to legal counsel. Name an alternate for every seat. See who belongs on a threat assessment team.
• Agree on the intake questions every report must answer. I cover them in the three questions every intake must answer.
• Gather information from more than one source before deciding. A single account is rarely the whole picture.
• Build a management plan aimed at moving the person off the path, not just removing them. Support, supervision, and changes to the situation often do more than discipline alone.
• Document every decision and the reason for it, and review open cases on a schedule.
• Practice. A team that has never met before a crisis is a list of names.

If you are new to the subject, start with What Is a Behavioral Threat Assessment? For schools, see the steps in a school threat assessment.

Integrated BTAM: Mastering Multi-Threat Safety in a Volatile World gives you the framework: one approach for behavioral, physical, digital and systemic risks, eight core principles, applications for schools, health care and corporate campuses, a 90-day rollout plan, and a toolkit of matrices, templates and checklists.

The BTAM Case Workbook is the hands-on companion: 22 write-in forms from concern intake to case closure, 10 fictional practice cases with debrief keys, and a four-session facilitator guide for team training and tabletop exercises. You can try it before you buy. Download three forms free: the Concern Report and Intake form, the Triage and Screening Worksheet, and the Case Management Plan.

3. Meet your legal duties (California SB 553)

The problem: in California, workplace violence prevention is no longer optional. Senate Bill 553 added Labor Code section 6401.9, which took effect on July 1, 2024. Employers within its scope must establish, implement and maintain an effective written Workplace Violence Prevention Plan.³ Cal/OSHA’s guidance lists what the plan must include, among other elements: the people responsible for it, employee involvement, how reports are accepted and answered without retaliation, emergency response, training, hazard identification and correction, and post-incident response and investigation.³

The law also has record-keeping teeth. Cal/OSHA says employers must keep hazard identification, evaluation and correction records, violent incident logs, and incident investigation records for at least five years, and training records for at least one year. Employees can ask to see most of these records, and the employer must provide them within 15 calendar days at no cost.³ Cal/OSHA is also developing a formal workplace violence prevention standard, so watch for changes.³

First steps:

• Name the people responsible for the plan, by name and title.
• Walk each work area and write down its real hazards: working alone, handling cash, late hours, contact with the public, known conflicts.
• Start a violent incident log today, even if the first entry is blank.
• Test the plan with one question: if an employee reports a threat at 2:00 a.m. on a Saturday, what happens next? If the plan can’t answer that, it is not finished.
• Connect the plan to your threat assessment process. A plan that logs incidents but never assesses the person behind them misses the point.

Outside California, a written plan built the same way is still good practice, and several states have their own rules for specific sectors such as health care. For more, read what SB 553 requires, and what it doesn’t and the termination meeting that prevents workplace violence.

The SB 553 Workplace Violence Prevention Plan Workbook explains each requirement of Labor Code 6401.9 in plain English and gives you fill-in templates for the written plan, hazard assessment, violent incident log, report intake, post-incident investigation, training record and annual review. It also includes a fully worked example plan and a 30-day implementation plan. It is not legal advice, and it is written for the HR leaders, safety managers and small-business owners who have to make the plan work.

4. Harden the site

The problem: organizations buy badges, cameras and locks and assume they are protected. Equipment helps, but only when people enforce it. A propped door, a tailgater waved through out of politeness, a visitor who is never escorted, or a former employee whose badge still works will defeat the best hardware. Campuses face an extra challenge: they are designed to be open.

The Cybersecurity and Infrastructure Security Agency (CISA) publishes a free K-12 School Security Guide that uses a systems-based method for vulnerability assessment and layered physical security, along with a web-based School Security Assessment Tool.⁴ Many of the same principles apply to offices, clinics and houses of worship.

First steps:

• Walk your site the way an outsider would. Note every door that can be opened from outside, every place someone can wait unseen, and every point where nobody checks who comes in.
• Test your visitor process. Can someone walk in behind a delivery? Does anyone ask who they are there to see?
• Tie access control to HR. Badges and codes should be turned off the same day someone leaves, and immediately when a separation is contentious.
• Make sure people can lock down, get out, and call for help from every occupied space, and that a mass notification system reaches everyone.
• Give someone the job of checking that the controls are actually being used, not just installed.

Read more in why badges and cameras fail without people and why universities stay soft targets.

Locked Down: The Access Control Blueprint for Safer Schools, Colleges, and Corporate America explains why badges, biometrics and cameras fail without human enforcement, how visitor-management blind spots and insider threats open the door, and the audits, policies and checklists that close the gaps.

For colleges and universities, Campus Under Siege: Why Universities Are Soft Targets, and How to Fix Them covers threat assessment teams, mass notification failures, hazing culture, dorm and campus security audits, and crisis leadership for presidents and deans.

5. Plan for emergencies and lead the response

The problem: many emergency plans are written to satisfy a requirement and then shelved. When something happens, people reach for the binder and find a document that doesn’t say who is in charge, how to reach them, or what to do in the first hour.

FEMA’s Comprehensive Preparedness Guide 101 (Version 3.0, September 2021) sets out a six-step planning process that any organization can borrow: form a collaborative planning team, understand the situation, determine goals and objectives, develop the plan, prepare and review it, and then implement and maintain it.⁵ The last step matters most. A plan that is never trained or exercised is a plan in name only.

First steps:

• List your most likely and most damaging threats and hazards, from a violent incident to a fire, a flood, a power loss, or a cyberattack, and rank them.
• Name who leads in the first hour, and their backup. Write down who can make which decisions without waiting for permission.
• Separate your emergency operations plan (how you respond and protect people) from your continuity plan (how you keep essential work going). See the difference between EOPs and COOPs.
• Run a one-hour tabletop exercise this quarter. Pick one scenario and walk through the first hour. Write down every question nobody could answer, and fix those first.
• After any real incident, hold a short review and update the plan while the lessons are fresh.

The Prepared Leader: Threat Assessment, Emergency Preparedness, and Safety for Colleges, Institutions, and Businesses is written for the people at the top. It shows how leaders identify, score and prioritize threats, recognize warning signs that were missed, build and test an emergency operations plan, and create a culture of resilience, drawing on FEMA, DHS and FBI standards. For a short version, read five things leaders must get right before a crisis.

6. Protect your leaders

The problem: executives, public officials, and other high-profile people face threats that follow them home and online. Many organizations either do nothing until there is a threat, or buy protection without first assessing the risk. Both are mistakes. Protection should be scaled to an assessment of the actual threat, and it should cover the whole person: work, travel, residence and digital footprint.

I spent 2007 to 2013 in protective operations in Baghdad, and later worked in corporate executive protection. The fundamentals are the same in a war zone and a boardroom. Most risk concentrates at predictable moments: arrivals, departures, and routes that never change. Insiders, such as staff, drivers and vendors, can see more than any outside attacker. Good protection is mostly planning that nobody sees.

First steps:

• Run a threat assessment on the leader before deciding what protection they need. Look at public grievances, online attention, and any concerning contacts.
• Search what is publicly available about the leader’s home address, family, schedule and travel. Reduce it where you can.
• Vary routes and times for regular movements, and plan arrivals and departures, which are the most exposed moments.
• Vet the people closest to the principal, including drivers, assistants and household vendors.
• Set a verification rule for urgent requests that appear to come from the executive. AI voice and video impersonation is now a real fraud risk; see AI deepfake CEO impersonation.

More reading: executive protection in the digital age and why executive security is expanding beyond the CEO.

The Protective Detail: From State Department Missions to the Corporate C-Suite is not a war memoir. It is a plain-spoken field guide to how executive protection actually works: advance work and choke points, routes, vehicles, arrivals and departures, recognizing pre-attack behavior, protective intelligence grounded in published Secret Service research, insider threats, and deciding whether an executive needs protection and hiring it well. The appendices include an advance survey, movement plan, emergency action plan, and hotel security checklist.

If you need to connect protection to threat assessment, Targeted brings the two together in one method, including residential hardening, digital footprint, and program governance for boards, family offices and public officials.

7. Protect people who travel

The problem: large companies have a security operations center to watch over travelers. Most small companies, nonprofits, universities, churches and solo consultants don’t. When something goes wrong on a trip, they improvise at the worst possible moment. The most common moment of uncertainty is also the simplest: a traveler misses a check-in, and nobody agreed in advance what that means.

Scams make the problem worse. In December 2025 the FBI warned that criminals are altering photos found online to create fake proof-of-life images in virtual kidnapping scams, sometimes sending them with timed-message features so victims can’t study them closely.⁶

First steps:

• Before each trip, name three people: the traveler, a home-office contact with an alternate, and one decision authority who can cancel a trip, order a traveler to shelter or leave, and approve unplanned spending.
• Agree on a check-in schedule and a written escalation ladder with times, so the person at home knows exactly what to do at each step. See the missed check-in ladder.
• Agree on a code word and an independent callback number before departure. Never pay during the first call.
• U.S. citizens traveling abroad should enroll in the State Department’s free Smart Traveler Enrollment Program (STEP), which sends security, demonstration, health and weather alerts from the nearest U.S. embassy or consulate and helps the embassy reach you or your emergency contact in an emergency.⁷
• Keep copies of passports, insurance details and key phone numbers with the home-office contact.

When Travel Turns Critical: A Practical Crisis-Response Workbook for Business Travelers and Small Organizations is a paired traveler and home-office workbook, now available in paperback. It has 20 numbered fill-in forms, from a trip go/no-go sheet to a first-hour incident log, family script and post-trip debrief, plus a missed-check-in escalation ladder, code-word and callback procedures, a shelter-or-relocate worksheet, and nine fictional scenarios with debriefs. It is not legal or medical advice.

8. Carry lawfully and responsibly

This section is general information, not legal advice. Firearm laws change often and vary by state and city; confirm the current law with official sources or an attorney before you carry or travel.

The problem: a carry license or a lawful firearm at home does not travel with you automatically. In 2022, in New York State Rifle & Pistol Association v. Bruen, the Supreme Court held that the Second Amendment protects an individual’s right to carry a handgun for self-defense outside the home.⁸ State laws on permits, reciprocity, and restricted places still differ widely, and many have changed since.

Two federal rules are worth knowing. Under 18 U.S.C. § 926A, a person who is not otherwise prohibited may transport a firearm from one place where they may lawfully possess and carry it to another, if the firearm is unloaded and neither it nor the ammunition is readily accessible from the passenger compartment.⁹ That protection is narrow: it covers transport, not carry. For air travel, the TSA says unloaded firearms may travel only in checked baggage, in a locked hard-sided container, and must be declared to the airline at the ticket counter.¹⁰

First steps:

• Before every trip, check the law at your destination and in every state you pass through, including reciprocity for your permit.
• Know the places where carry is prohibited where you live and where you are going, such as schools, courthouses, airports and some private property.
• Store firearms securely at home, in vehicles and in hotel rooms. Most problems on the road are not dramatic; they are an unsecured firearm or an owner unsure of the local rule.
• Keep training. Lawful carry is a responsibility, not just a right.
• Employers: set a clear written policy on firearms at work and in company vehicles that follows your state law, and make sure your threat assessment team knows it.

The Concealed Carry Legal Map & Handgun, AR-15 + Shotgun Care Guide covers concealed carry laws by state, legal transport by air and vehicle, constitutional carry updates, safe handling and storage, and basic maintenance for responsible gun owners. Read why owners check the law before every trip for a short introduction.

9. See the bigger picture

The problem: local security plans often assume threats are local. They aren’t always. AI-enabled impersonation, cyberattacks on the systems that run buildings, global events that strand travelers, and shifts in the balance of military power all reach down to the level of a single school, company or traveler. Leaders who understand the national security context make better decisions about which risks to plan for.

First steps:

• Add cyber and impersonation scenarios to your threat list and your tabletop exercises, not just physical ones.
• Know which of your critical systems, such as door controls, alarms and communications, depend on networks or outside vendors, and what happens if they go down.
• For any international travel or operations, check official travel advisories and build in a plan for airspace closures and evacuation.
• Read beyond your own field. Strategic changes tend to show up first in defense and policy writing, long before they show up in your incident reports.

Unmatched Arsenal: The Past, Present, and Future of U.S. Military Power traces U.S. military strength from the years after World War II through hypersonics, AI-driven systems, cyber and space, and asks whether that advantage can last against a rising China and Russia. It is the widest lens in my catalog. Read the question behind U.S. military power for a summary.

10. Invest in the people who do the work

The problem: every plan in this guide depends on people: the officer at the front desk, the supervisor on nights, the former police officer or veteran now leading corporate security. Organizations spend on equipment and then under-invest in licensing, training and leadership for the people who use it. People entering the field often don’t know the licensing rules, and experienced officers moving into the private sector often struggle to translate what they know.

First steps for employers:

• Verify that every officer holds the license or registration your state requires, and track renewal dates.
• Train officers on your threat assessment process and reporting path. They often see warning signs first.
• Give good officers a path to supervision and specialist roles, or they will leave.

First steps for people building a security career:

• Learn your state’s licensing process before you apply, and keep every certificate and training record.
• Write your résumé in civilian language. Hiring managers need to see results, not jargon.
• Choose a lane, such as investigations, executive protection, physical security or threat assessment, and build depth in it.

Guard Card Hawaii: The Complete Guide to Getting Licensed, Hired, and Promoted in Island Security is a state-specific guide to guard registration under Hawaii Revised Statutes Chapter 463, covering approved courses, fingerprinting, legal limits, armed posts, report writing, disaster readiness and moving up. See the rules new officers most often miss.

Badge to Business Suit: How Cops and Veterans Land and Lead in Corporate Security shows police officers and veterans how to translate their records for hiring managers, choose a lane, build an ATS-friendly résumé, win behavioral interviews, and lead as civilians. It includes worksheets, a translation glossary and a 40-question interview bank. Read why great cops struggle in corporate jobs.

For the human side of the work, Uniformed Silence: What They Never Told You About Surviving LAPD Probation is my memoir of rookie years in a black-and-white in South Central Los Angeles: graveyard shifts, felony stops, and the quiet brotherhood of new officers. Read what a rookie year teaches about earning trust.

Putting it together: a first 90 days

You don’t need to fix all ten areas at once. A realistic order for most organizations:

• Days 1–30: name the threat assessment team and the reporting path; tell everyone how to report; start an incident log; if you are in California, check your SB 553 plan against the required elements.
• Days 31–60: walk the site and test access control; update your emergency plan so it names first-hour leaders; set a travel check-in and escalation rule.
• Days 61–90: run one tabletop exercise; assess the risk to your most visible leaders; train staff and officers on warning signs and reporting; schedule the next review.

About Warren Pulley

Warren Pulley is a protection specialist, threat management consultant and author with nearly four decades in security, law enforcement and protective operations. He served in protective operations in Baghdad from 2007 to 2013, founded RyPul Threat Assessments in 2013, and is trained in behavioral threat assessment and management (BTAM). As the owner and consultant for RyPul Threat Assessments, he has provided independent ballistic design reviews for a New York architectural-metals manufacturer, including bullet-resistant entrance systems for a New York City public-housing development and a new subway station agent booth.

He works with schools, colleges, employers and organizations on threat assessment, workplace violence prevention, executive protection and emergency planning. See consulting services, speaking and training, or his full background.

Frequently asked questions

Sources

1. U.S. Secret Service National Threat Assessment Center, “Protecting America’s Schools: A U.S. Secret Service Analysis of Targeted School Violence,” November 2019
2. U.S. Secret Service National Threat Assessment Center, “Preventing Targeted Workplace Violence: A U.S. Secret Service Guide to Behavioral Threat Assessment and Management,” October 2026
3. Cal/OSHA, “Workplace Violence Prevention for General Industry (Non-Health Care Settings)” (Labor Code § 6401.9), accessed Nov. 11, 2026
4. Cybersecurity and Infrastructure Security Agency, “K-12 School Security Guide Product Suite,” accessed Nov. 11, 2026
5. FEMA, “Comprehensive Preparedness Guide (CPG) 101: Developing and Maintaining Emergency Operations Plans,” Version 3.0, September 2021
6. FBI Internet Crime Complaint Center, “Criminals Using Altered Proof-of-Life Media to Extort Victims in Virtual Kidnapping for Ransom Scams,” Alert I-120525-PSA, Dec. 5, 2025
7. U.S. Department of State, “Smart Traveler Enrollment Program,” accessed Nov. 11, 2026
8. New York State Rifle & Pistol Association, Inc. v. Bruen, 597 U.S. 1 (2022)
9. 18 U.S.C. § 926A, Interstate transportation of firearms
10. Transportation Security Administration, “Transporting Firearms and Ammunition,” accessed Nov. 11, 2026

This is general information and commentary, not legal, medical or professional advice for your situation. Laws and guidance change; confirm current requirements with official sources or counsel. Facts are as stated in the sources above on the dates shown.