Updated October 2026

By Chris Grollnek, Active Shooter Expert

Short answer. The new Secret Service workplace violence guide, released on 21 October 2026 as Preventing Targeted Workplace Violence, is the most useful free document an employer will be handed this year. It goes past describing the problem and hands over the program, step by step, with twenty-five years of federal research behind every step. I read all 100 pages the day it came out. Here is the good news, the bad news, and what I would do with it on Monday morning.

One line on why I read it the way I did. The U.S. Department of Justice selected the P.R.O. Model™ as “A” national standard for the Assistant United States Attorneys and across the Department, and it is in use at some installations and commands across the Department of Defense. The P in that model is prevention. Prevention has always been the hard sell in this industry, because response is easier to bill. So when the Secret Service writes on page 92 that it “has long held that prevention is the best form of protection,” I read it as the agency that invented behavioral threat assessment putting its name on the argument I have made for sixteen years.

What is the Secret Service workplace violence guide?

It is a two-part publication from the Secret Service’s National Threat Assessment Center, the NTAC, and it is in the public domain. You can copy it, quote it and hand it to your general counsel. Part 1 studies 50 mass attacks at workplaces between 2016 and 2020, a subset of the 173 attacks in the Center’s larger five-year study. They were chosen because in every case the attacker was known or knowable to the workplace: an employee, a former employee, a regular customer or patient, or someone’s estranged partner. Those 50 attacks killed 119 people and injured 128. Part 2 is an eight-step framework for standing up a behavioral threat assessment and management program, which the report calls BTAM, inside an organization of any size.

The audience is written on the cover: managers and supervisors, security, human resources, information technology, cybersecurity and insider threat, law enforcement, mental health professionals and community safety partners. That list is the first lesson. Prevention is not a security department function, and the report says so in plain words: “Preventing targeted workplace violence is everyone’s responsibility.”

What is the good news in the report?

The good news is that the window to intervene is wide and it is visible. Of the 51 attackers, 40, or 78 percent, had already behaved in a way that worried somebody before the attack. Thirty-one of them, 61 percent, had made someone fear for their own safety or someone else’s. Three quarters had made concerning communications. Only 8 percent had signaled that an attack was imminent. The warning almost never arrives as a countdown; it arrives months earlier as a grievance, a change in behavior, or a remark that made a coworker uncomfortable.

Ninety-two percent carried a notable stressor in the five years before the attack, most often money, a relationship or the job, and 43 percent had a specific triggering event. Among the attackers who came in as customers, patients or visitors, 65 percent had already caused concern at that same location. The Center’s wider study found that the workplace was the most common formal setting in which concerning behavior was ever observed. In other words, the place most likely to see the signal first is the place with the most power to act on it.

The other half of the good news is that the Secret Service gives the whole program away. There is sample policy language on page 42 and sample team-meeting language on page 43. There are three team structures for small, regional and national organizations, a case-management flow from intake to closure, and the twenty assessment themes drawn from the Service’s own protective work. There is a safe separation procedure for terminations, and there are free recurring virtual trainings taught by NTAC staff. I have watched organizations pay consultants for less.

What is the bad news?

The bad news is that a workplace attack is deadlier at the end and quieter at the start than most plans assume. Firearms were used in 86 percent of the attacks. Forty-six percent ended with the attacker’s suicide, against 16 percent in the Center’s non-workplace attacks, and in 60 percent of the attacks the attacker died during or shortly after. An attacker who has decided to die is not deterred by arrest, termination or a trespass notice. The only intervention that works is the one that happens before he decides.

Then there is who the attackers were. Twenty-two of the 51 were current or former employees, and 16 of those were on the payroll the day they attacked, with tenures from 13 days to 22 years. Most of them struck during or right after a shift. Four carried the weapon in on their person, five kept it in a car on the lot, and two went home to get it. The badge got them through the door. I wrote last week about the glass beside the locked door, and I stand by every word for the 57 percent who come in from outside. The report is blunt that no door stops the person you already let in.

What else did the Secret Service find about the people?

Among employee attackers, 95 percent had a grievance and 77 percent had one about the job itself: discipline, workload, a review, a termination. Thirty-six percent had been bullied or harassed at work. Nearly half of the organizations involved had climate problems that other employees described after the fact. Fifty-three percent of all attackers had a history of domestic violence, and only a third of those were ever charged, so a background check would have come back clean on most of them.

Law enforcement stopped 18 percent of the attacks and bystanders stopped 4 percent. The other three quarters ended when the attacker chose to stop or die. That is the eight-minute problem I have written about for years, now measured by the Secret Service on workplaces.

Who are the workplace attackers, and why does that change the program?

They come in three kinds, and each kind is caught by a different part of the organization. That is the single most practical finding in the report.

Attacker	Share of 51	What the Secret Service found	Who sees it first
Current or former employees	43% (22)	95% carried a grievance, 77% about the job; 82% had worried someone, 41% at work; 73% were still employed; 36% had been bullied or harassed	Supervisors, coworkers, HR, the manager who runs the termination meeting
Customers, clients, patients, visitors	39% (20)	79% carried a grievance; 65% had already caused concern at that location; 60% had a trigger in the prior month; every bladed-weapon attack came from this group	Front desk, customer service, nurses and clinic staff, security officers
Romantic partners and relatives	18% (9)	78% had a domestic violence history, three ever charged; six targeted an estranged partner at her workplace; every one used a firearm	The coworker she confides in, HR, the person who sees the protective order

Look at the last column again, because not one of those people works in security. A program that trains only the security team has, by the report’s own numbers, covered none of the people who actually see the warning first.

What are the eight steps, and which ones get skipped?

The framework runs: commit to employee safety and support; establish policy and procedures; assemble a multidisciplinary team; identify and process reports of concerning behavior; gather information to assess risk; develop risk management strategies; promote a safe and supportive climate; and train every employee. Two of the eight get skipped in most organizations I walk, and the report has a vignette for each.

The first is leadership buy-in. On page 34 a threat manager at a company with thousands of employees is the only person covering disaster recovery, cybersecurity and active threats. During a round of mass layoffs a laid-off employee threatens to come back with a gun, and nobody tells the threat manager, because nobody was trained to. Leadership still declines to fund the program afterward. The second is the low threshold of concern. The report’s rule is to act at the first sign of concerning behavior rather than wait for an explicit threat. Most workplaces wait, because “I’m going to shoot someone” is easy to report and “he has been distant, moody and unkempt since the divorce” feels like gossip. The Secret Service says the second one is what you build the program around.

How does the guide fit the P.R.O. Model™?

It is the P, written by the agency that pioneered the method. Prevention in the model has two layers, the people layer and the facilities layer. The guide is the federal build sheet for the people layer: who watches, who reports, who assesses, who manages. The facilities layer still has to be assessed, the glass beside the door, the sightlines, the lot where five of those attackers kept a weapon, because 57 percent of the attackers walked in from outside. Response and options are what happens if both layers fail, and the report’s resolution numbers are the reason I will not let a client start there.

What would I do on Monday if I ran your company?

I would put one name on it: a BTAM lead who reports to the chief operating officer or the general counsel, with the authority on page 41 written into policy, because a program without an owner is a poster. Then, in order, I would adopt the sample policy statement and name the team, with HR, security, legal, IT and the employee assistance program at the core. I would open two reporting channels, one of them anonymous, and tell every employee what happens after they use one. I would write the low threshold into the procedure, so a supervisor’s worry is enough to open a preliminary inquiry.

I would rewrite the termination checklist as the safe separation protocol on pages 80 and 81, because the report says plainly that “terminating an employee does not eliminate the risk an employee poses.” And I would train everyone in the first 90 days, in the 9-to-12-minute micro-learnings one security director describes on page 91, rather than a two-hour video nobody finishes.

I would measure it the way I measure anything I am accountable for: reports received, hours to triage, cases opened and closed, and a climate survey every year, since nearly half the attacked organizations had a climate problem their own people could name. If you are in California, Senate Bill 553 already requires a written plan and an incident log, and the report notes that other states are following. The statute is the floor, and this guide is the standard.

What does the report not say?

Three honest limits. The 100 percent “known or knowable” finding describes how the 50 cases were selected, not every workplace attacker in America; the Center’s wider study found that more than half of mass attackers had no known tie to the place they attacked. It is 50 incidents, so one case moves a percentage by two points. And the sample is public-facing workplaces, retail, restaurants, manufacturing and healthcare, which is where most of the harm happens but not the whole map. None of that weakens the conclusion. It is the reason the authors wrote a program instead of a profile, and they say so: BTAM “is not profiling” and “is not prediction.”

Where I land

The problem is that the person most likely to hurt your people already has a badge, a chart or a key to your parking lot. The impact, by the Bureau of Labor Statistics figures the report carries, was 928 workers killed in intentional homicides in 2023 and 2024, and 77,780 more injured badly enough to miss work. The solution is eight steps the Secret Service has now written down and given away. The consequence of doing it is an ordinary Tuesday nobody writes about, and I have spent my career arguing that an ordinary Tuesday is the whole point. Read the guide, then call whoever you trust to help you build it, whether that is me or not. The people who protect presidents just told you how.

If you want the longer version of how I think about this work, start with what it means to be an active shooter expert. The practical version is on my workplace violence prevention training page.

Sources

• National Threat Assessment Center. (2026). Preventing Targeted Workplace Violence: A U.S. Secret Service Guide to Behavioral Threat Assessment and Management. U.S. Secret Service, Department of Homeland Security. All incident and attacker figures above are from pages 13 to 27 and the appendix tables on pages 94 and 95.
• National Threat Assessment Center. (2023). Mass Attacks in Public Spaces: 2016 to 2020. U.S. Secret Service.
• Bureau of Labor Statistics. (2026). National census of fatal occupational injuries, 2023 to 2024, and nonfatal cases involving days away from work, as cited in the guide, page 33. bls.gov
• California Department of Industrial Relations. Workplace violence prevention in general industry, Senate Bill 553. dir.ca.gov
• NTAC virtual training calendar: secretservice.gov/ntac/virtual