How Thwarted Attacks Happen
Most targeted school violence does not happen without warning. Research consistently shows that individuals who carry out attacks typically display behavioral indicators beforehand, share their intentions with at least one other person, and follow a planning pathway that takes time to develop. This means that prevention is possible, and that the systems schools put in place to identify and respond to early warning signs are among the most valuable investments they can make.
Thwarted attacks, meaning incidents where planning was detected and interrupted before harm occurred, often follow a recognizable pattern. A student says something to a peer. The peer tells a trusted adult. The adult reports it through a formal channel. A threat assessment team reviews the information and takes action. Each step in that chain depends on the previous one working correctly. When any link breaks, the opportunity for intervention can be lost.
The Role of Student Reporting
In many thwarted incidents, the initial report came from another student. Peers are often the first to know when a classmate is in crisis or has expressed harmful intentions. Schools that have built a culture where students feel safe reporting concerns, and where they trust that reports will be handled discreetly and seriously, are significantly better positioned to catch early warning signs than schools where reporting is seen as risky or ineffective.
Anonymous reporting systems, such as tip lines or digital platforms, lower the barrier for students who want to report but fear social consequences. These tools work best when they are actively promoted, when staff respond to every report, and when students see that their tips lead to visible action. A tip line that appears to go nowhere will stop receiving tips.
Schools should also ensure that students understand what kinds of information to report. Threats, weapons talk, sudden behavioral changes, expressions of hopelessness, and concerning social media content are all worth reporting. A short annual conversation with students about why reporting matters, framed around protecting the community rather than getting someone in trouble, can meaningfully increase the volume of useful tips.
What the Threat Assessment Team Must Do Well
When a report comes in, the threat assessment team's job is to gather information quickly, evaluate the level of risk, and take proportionate action. This sounds straightforward, but it requires training, discipline, and clear protocols. Teams that lack a structured process often default to their instincts, which can lead to either overreaction that damages relationships and trust, or underreaction that allows a situation to escalate.
Effective threat assessment teams use a structured protocol, document their findings and decisions, and include perspectives from education, mental health, and law enforcement. They also understand that their goal is not prosecution or punishment but safety, which sometimes means connecting a student with support services rather than pursuing disciplinary action. The response should be calibrated to the actual level of risk, not to the school's need to be seen as taking action.
Building the Conditions for Prevention
Prevention depends on conditions that take years to build. A school where students trust adults, where staff know their students well enough to notice behavioral changes, and where reporting is normalized rather than stigmatized is a school that is positioned to catch warning signs before they become crises. These conditions are the product of daily interactions, consistent relationship-building, and a school culture that prioritizes connection alongside academics.
Administrators can support these conditions through concrete practices: ensuring that every student has at least one adult in the building who knows them by name, training staff to recognize behavioral warning signs as part of their professional development, and creating clear, visible pathways for anyone in the building to report a concern without bureaucratic friction.
After a thwarted incident, schools should conduct a structured debrief to understand what worked and what could be improved. Which parts of the reporting and response chain functioned as intended? Where did the process slow down or create uncertainty? These debriefs, conducted privately and without blame, are some of the most valuable learning opportunities a school safety program can generate.