New Secret Service Guidance on Workplace Violence Prevention

The U.S. Secret Service’s new workplace violence prevention guide gives employers a structured way to act on concerning behavior before targeted violence occurs. Its approach to workplace threat assessment brings trained people together to evaluate concerns, decide how to intervene and follow through as circumstances change.

Released October 21, 2026, Preventing Targeted Workplace Violence: A U.S. Secret Service Guide to Behavioral Threat Assessment and Management combines research on past attacks with an eight-step framework for employers. The National Threat Assessment Center (NTAC) designed the guidance for organizations across industries, including healthcare and education.

What the Guide Addresses

The report focuses on targeted workplace violence: premeditated acts of violence at a workplace directed at a specific person, group or location, regardless of motivation and generally unrelated to other criminal activity. It recommends behavioral threat assessment and management, or BTAM, as a process for identifying concerning behavior, assessing potential risk and taking steps to reduce it.

This is new guidance built on the Secret Service’s established threat assessment methodology. It offers recommendations rather than creating a new legal requirement and belongs within an organization’s broader workplace violence prevention efforts.

What the Research Shows

NTAC examined 50 workplace mass attacks from 2016–2020 involving 51 attackers who were known or knowable to the targeted workplace. In that study, 78% of attackers had previously exhibited behavior that concerned others.

The attackers included current and former employees, customers, clients, patients, visitors and people with romantic or family connections to someone associated with the workplace. These cases are part of a broader pattern documented across NTAC’s research: people who commit targeted violence often display concerning behavior beforehand, creating opportunities to recognize concerns and intervene before an attack.

The report emphasizes that there is no demographic profile of an attacker and that someone may pose a risk without making a direct threat. Its prevention approach relies on understanding behavior in context and giving people a clear way to share concerns.

The Secret Service’s Eight-Step Framework

The framework outlines how to establish and support a BTAM program. In brief, its eight steps are:

1. Commit to Employee Safety and Support. Secure leadership support, allocate resources and build internal and community partnerships.
2. Establish BTAM Program Policy and Procedures. Define the program’s scope, responsibilities and day-to-day operations.
3. Assemble a Multidisciplinary BTAM Team. Select and train people with relevant expertise across departments.
4. Identify and Process Reports of Concerning Behavior. Provide reporting options and establish how incoming concerns are reviewed and routed.
5. Gather Information to Assess for Risk. Consider information from multiple sources to understand the behavior and surrounding circumstances.
6. Develop Risk Management Strategies. Implement an individualized plan and evaluate whether interventions are addressing the concerns.
7. Promote a Safe and Supportive Organizational Climate. Address workplace problems fairly and build trust in the prevention process.
8. Provide Training for All Employees. Explain what to report, how to report it and what happens afterward.

What This Means for Day-to-Day Safety

The eight steps describe the structure of a prevention program. For leaders reviewing how that program would work in their own organization, we see three practical priorities: make it easier to raise a concern, bring relevant information together and keep responsibility clear through follow-up.

The following is 911Cellular’s interpretation of those priorities, grounded in the guidance.

Employees Need to Know What to Report Without Having to Assess the Threat

An employee may notice repeated harassment or an escalating dispute without knowing how serious it could become. The guide recommends a low threshold for reporting concerns so trained personnel can evaluate the situation before it escalates.

In practice, training should give staff recognizable examples and explain where to take them. Employees need to understand that reporting an observation begins a review; it does not automatically label someone dangerous or determine the outcome. For healthcare teams, this also means addressing the social and cultural barriers that discourage reporting.

Bring Information Together Under Clear Leadership

Employees, supervisors, HR, security and outside partners may each see a different part of a developing situation. Providing multiple reporting channels gives them ways to share what they know and helps the team build a fuller understanding of the concern.

To turn that information into action, assign clear responsibility for receiving reports, assessing concerns, coordinating interventions and following up. A designated team leader should oversee the process, track completion of assigned steps and help the team adjust its response as patterns emerge, reducing the risk of missed handoffs or incomplete follow-up.

Maintain relevant reports, assessments, decisions and follow-up actions in a secure, shared record for authorized team members, with access and information sharing governed by applicable privacy requirements and organizational policies. Keeping relevant information together makes it easier to recognize recurring concerns and track unfinished actions that might otherwise be overlooked across separate inboxes, departments or disconnected systems.

Check Whether the Intervention Is Working

Taking action is the beginning of managing a concern. A support referral, disciplinary measure or employment decision needs follow-up to determine whether the situation is improving and whether additional steps are necessary.

The guide’s risk management process calls for teams to evaluate interventions and adjust their approach as circumstances change. Assign someone to monitor progress, set review dates and document what has changed. Close a case when the team has a supported, documented reason to do so, with further check-ins where appropriate.

Help Employees Recognize When to Report and When to Request Help

Employees need to understand when to report a concern, when to request immediate assistance and what response each action sets in motion. Use training scenarios to make the distinction clear:

• Report a concern: When behavior raises a safety concern without an immediate danger, use the organization’s designated reporting channels. The report should be reviewed to determine appropriate next steps, which may include gathering more information, conducting an assessment or connecting someone with support.
• Request immediate assistance: When someone is in immediate danger or violence is occurring, follow emergency procedures to contact security, call 911 or use the designated emergency alert method. This should activate an urgent response rather than wait for the routine assessment process.

The Secret Service’s guidance on processing reports makes this distinction explicit. Training should explain who receives each report or alert, what happens next and how employees can provide additional information or request further help.

Put the Guidance Into Everyday Practice

The value of the Secret Service’s guidance comes from making prevention part of everyday work: people know how to raise concerns, designated leaders ensure action is taken and teams follow through as situations change. Connecting those efforts with clear emergency procedures helps employees understand how to get the support a situation requires.

Technology can support that coordination. Alongside a dedicated threat assessment program, the 911Cellular Safety Platform brings staff duress, mass notification, incident management and reporting together to help organizations connect requests for assistance with coordinated response and incident review.

This article summarizes federal guidance and offers general operational considerations, not legal advice. Consult qualified counsel about requirements applicable to your organization.