Attackers Do Not Snap: What Behavioral Science Sees Before an Attack
Attackers do not snap. They decide, and then they prepare. Everything in that preparation leaves behavioral warning signs, and those signs are observable, which is the entire reason prevention is possible at all.
The single most common thing I hear after an incident is that it came out of nowhere. It almost never does. What is true is that the signals were distributed, one person saw one thing, another saw something else, and no one ever put them in the same room.
Why the FBI Studies Attackers Before They Attack
On DESTINATION #NEVERHERE™™ I spoke with Dr. Gregory M. Vecchi, former Chief of the FBI’s Behavioral Science Unit, about behavioral analysis and what it identifies before an attack occurs. Watch the conversation →
I also spoke with Brig Barker, former FBI Special Agent, about twenty-one years of counterterrorism work and the planning behind targeted attacks. Watch that one →
Two different careers, one shared conclusion: the preparation phase is where this is winnable.
The Distributed Signal Problem
| Who sees something | What they typically see | Why it goes nowhere |
|---|---|---|
| A co-worker or classmate | A change in tone, withdrawal, fixation | Assumes someone more senior already knows |
| A supervisor | Performance decline, a grievance that escalates | Treats it as an HR matter, not a safety matter |
| IT or facilities | Searches, access attempts, unusual presence after hours | No route that connects a technical flag to a human concern |
| A family member | The most alarming information of all | No idea who to call, and fear of overreacting |
None of these people are failing. The system is failing, because it was never designed to aggregate behavioral warning signs. That is a design problem, and design problems are fixable.
What Behavioral Analysis Is Not
This is conduct analysis, not appearance profiling, and it flags no one for who they are. Behavioral analysis looks at conduct along a pathway, grievance, ideation, planning, preparation, breach. That is a sequence of choices, and choices leave evidence.
This distinction matters enormously, and I want to be plain about it: evil does not discriminate, and neither do I. The work is about behaviour, never about identity.
The Three Questions That Aggregate Signal
- Where does a concern go? One named destination, known to everyone, that does not require the reporter to be certain.
- Who is required to look at it? Not “someone”, a role, with a name attached.
- What happens if it turns out to be nothing? If the answer involves embarrassment for the reporter, you will not receive reports.
Organizations that can answer all three have a prevention capability. Organizations that cannot have a response plan and a hope.
Understanding how these events unfold is what makes prevention possible. → The P.R.O. Model™
Share This Story, Choose Your Platform!
November 6, 2026
November 6, 2026
November 6, 2026
