- › Pre-attack indicators are real and they are also the behavior of people who are late, unwell, grieving, or in pain.
- › Because genuine attacks are rare, the overwhelming majority of correctly spotted indicators belong to someone who was never a threat.
- › Training teaches recognition and almost never teaches what a false positive costs, so staff learn to escalate and never learn to stand down.
- › The costs are concrete: a customer treated as a suspect, a contractor followed around a building, discrimination exposure, and staff who stop reporting because they were wrong once.
- › The fix is to train the stand-down as explicitly as the escalation, and to measure how often people correctly decide nothing is happening.
A man is standing near the entrance of your building. He has been there about ten minutes. He keeps checking his phone and looking at the doors, he is wearing a jacket that seems heavy for the weather, and twice now he has walked a short distance away and come back. He does not make eye contact with the person at the desk.
Every one of those is on a pre-attack indicator list, including ours. Your training worked, your employee noticed, and the escalation is entirely defensible.
He is also, almost certainly, waiting for a job interview, and that is the outcome nobody trained anybody for. It is also the outcome your program will produce almost every time it works correctly.
The Arithmetic Nobody Puts in the Slide Deck
Here is the part that recognition training tends to leave out, and it is an omission that compounds quietly rather than a flaw in the training. Targeted violence at any given site is extremely rare. Loitering, agitation, avoidant eye contact, repetitive movement, and clothing unsuited to the weather are ordinary. They are simply what people look like when they are early for an appointment, managing chronic pain, in the middle of a difficult phone call, unhoused, neurodivergent, recently bereaved, or simply cold.
That means the base rates do the work regardless of how good your people are. If the indicators are genuinely present in most attackers, and they are, and if they are also present in a small fraction of everyone else, then in any building with real foot traffic the overwhelming majority of correct observations will belong to people who were never a threat. Your staff are experiencing the ordinary mathematics of looking for something uncommon, and no amount of diligence changes it.
The training says what to do when you see it. It rarely says what happens next in the far more likely case, where the observation was correct and nothing was wrong.
What the False Positive Actually Costs
The word “false positive” makes this sound like a statistical inconvenience. In a building it has a shape and a person attached to it.
A customer becomes a suspect. Somebody came in to spend money and left having been watched, followed, or approached. They will not complain, they will simply not return, and nothing in your reporting will connect the two.
A contractor loses an afternoon. The technician nobody recognized gets escorted, questioned, and delayed, and your facilities team quietly stops using that firm because the visits became difficult.
Your exposure changes. When the indicators map, as they reliably do, onto race, housing status, disability, or age, a pattern of escalations becomes a pattern of discrimination, and the fact that each individual decision was made in good faith is not a defense once somebody assembles the log.
Your reporting culture takes the damage. This one is the most expensive and the least visible. An employee who escalated and was wrong, and who was made to feel foolish about it, has learned something durable. The next time, they will wait to be more certain. Waiting to be certain is precisely the behavior that gets people hurt in the rare case that matters.
That last cost is the reason this article exists. Everything else in this cluster teaches people to see more, and seeing more without a safe way to be wrong produces staff who see plenty and say nothing.
Why the Reflex Builds Anyway
I want to be fair to the people running these programs, because the incentive structure is genuinely bad. A missed indicator that precedes an incident is a career-defining failure that gets reconstructed in an inquiry. A false positive is invisible, absorbed by somebody who was inconvenienced and went home. When one error is catastrophic and legible and the other is diffuse and silent, any rational person and any rational organization drifts toward over-calling, and keeps drifting, because nothing pushes back.
Our guide to pre-attack indicators covers what to look for, and the warning window before aggression covers the earlier signals. Both are sound and I would not change either. This piece is the counterweight they need, which is what somebody should do with the observation once they have it.
Training the Stand-Down
The fix is to give the second half of the decision the same treatment as the first, and it has nothing to do with teaching people to notice less.
Make the stand-down an explicit, named step
Most procedures end at escalate. Write the other branch down with the same care: what observing for another two minutes looks like, what resolves the concern, who has authority to say this is fine, and what happens to the record afterward.
An employee who has never been taught how to stand down has only one move available, and they will use it every time, because it is the only one that exists.
Practice the ambiguous case, not the obvious one
Scenario training almost always uses a scenario that resolves into a real threat, because that is the version that feels worth the hour. Run the other one. Somebody presents four indicators and is waiting for a ride, and the exercise is deciding to do nothing and being right about it.
That is the harder skill, and it is the one people will use every week instead of once a career. Give them the reps.
Separate the observation from the conclusion
Teach staff to report what they saw rather than what they think it means. “A man has been by the north door for fifteen minutes and keeps walking away and coming back” is useful. “There is a suspicious man outside” has already made the decision and hands the next person a conclusion instead of a fact.
This one change does more for accuracy than any additional indicator you could add to the list, because it keeps the judgement with the person best placed to make it.
Say out loud that being wrong is the expected outcome
If your people do not know that most correct observations resolve to nothing, they will read their own false positives as personal failure. Tell them the base rate. Tell them the program is working as designed when a report resolves into a man waiting for an interview.
Our work on blameless security covers why punishment kills reporting on the digital side, and the mechanism here is identical: people stop telling you things when telling you cost them something once.
Look at who gets escalated
Once a quarter, read the escalations as a set rather than individually. If the people being reported are disproportionately of one description, you have found something the individual reports could never show you, and you have found it before somebody else does.
The Measure Worth Adding
Most programs count reports and a few count incidents, and almost none count the thing that matters here, which is how often somebody correctly decided that nothing was happening.
You will not get that number from a form, because nobody files a report about the man who turned out to be waiting for an interview. You get it by asking, in the ordinary course of a shift handover, whether anything came up that resolved on its own. Ask it as a normal question with no consequence attached, and you will start to see the far larger half of the picture your program currently generates and discards.
The staff who can tell you about three things that turned out to be nothing are the ones paying attention. Those are your good observers, and right now nothing in your program can see them.
Want to know how your people actually behave under an ambiguous signal? Contact Grab The Axe for a behavioral security assessment, or start with our free Human Attack Surface Score.
With a dual background in I/O Psychology (PhD Candidate) and Business Management (MBA), Marie bridges the gap between clinical rigor and operational strategy. She oversees B2B relations, compliance, and the 'business' of risk management.
View Author Page →
