Situational Assessment and Threat Recognition
The core idea
Threat recognition is structured observation, not intuition. Candidates should understand baseline and anomaly: establish what normal looks like for a site, then flag deviations. Learn the pre-attack indicators commonly taught in protective work: unusual interest in security measures, repeated reconnaissance, attempts to access restricted areas, unusual questioning, and behavior inconsistent with the setting. None of these is proof; each is a cue to gather more information.
Concepts to master
- Observation cycle: observe, orient, decide, act; loop back as conditions change.
- Behavioral indicators: clustering of cues matters more than any single cue; context is decisive.
- The OODA loop and why slowing an adversary's decision cycle helps defenders.
- Distance, cover and concealment: cover stops projectiles; concealment only hides.
- Time-distance-danger: recognizing that a threat closing distance reduces reaction time.
- Bias traps: confirmation bias, hindsight bias, and profiling based on appearance rather than behavior.
Traps in exam questions
Examiners love absolutes. "A person sweating means they are about to attack" is wrong; sweating has many causes. Answers that rely on a single indicator, or that endorse profiling by ethnicity, religion or dress, are distractors. Another trap is confusing cover with concealment, or treating a report as an accusation rather than an observation.
Worked rule of thumb
Use the three-cue rule: one indicator is noted and monitored; two prompt increased vigilance and a discreet position change; three or more, or any indicator combined with a direct threat or weapon sighting, triggers escalation to the supervisor and, if warranted, emergency services. Record times, locations and behaviors observed, not conclusions about character.
Key points
- Compare behavior to a documented baseline; anomalies matter.
- Cluster cues; a single indicator is not a conclusion.
- Cover defeats projectiles; concealment only hides you.
- Describe observable behavior, never profile by appearance.
- Escalate on multiple cues or any direct threat; document as you go.