This article provides a detailed, practical framework for employers and managers to:

• Distinguish credible threats from non-credible statements,
• Evaluate risk using lawful, job-related indicators,
• Know when and how to involve law enforcement,
• Create strong documentation that stands up to scrutiny,
• Pursue legal remedies (including restraining/protective orders),
• And understand why armed security is the appropriate private-security response when credible threats exist.

Why Employee Threats Must Be Taken Seriously

Workplace violence is rarely spontaneous. In many cases, threats, warning signs, escalation, and behavioral changes appear well before an incident occurs. The consequences of failing to respond appropriately can be severe:

• Safety risk: Employees, customers, and visitors may be exposed to violence.
• Civil liability: If an employer knew—or should have known—about a credible threat and failed to take reasonable measures, the employer may face negligence claims and other civil exposure.
• Insurance and regulatory issues: Carriers and regulators frequently evaluate whether the employer acted reasonably and implemented risk mitigation.
• Operational disruption: Threat situations create staffing issues, morale problems, and reputational harm.

A professional response is calm, factual, documented, and decisive. The goal is not panic. The goal is risk control.

What Counts as a Threat?

A threat does not need to be perfectly worded or explicitly stated to be treated seriously. Threats may include:

• Direct threats: “I’m going to hurt someone,” “I’m going to shoot this place up,” “I’m going to kill my supervisor.”
• Conditional threats: “If they fire me, someone’s going to get hurt,” “If I don’t get my way, you’ll regret it.”
• Weapon references: Mentioning firearms, knives, or other means of harm, especially paired with anger, resentment, or planning.
• Violent ideation: Statements that reflect fascination with violence or a desire to cause harm (even if framed as joking).
• Escalating hostility: Increasingly aggressive language, intimidation, or threatening behavior patterns over time.

Context matters. Capability matters. Pattern matters. Employers should evaluate the totality of circumstances rather than isolating a single sentence.

Distinguishing a Credible Threat From Non-Credible (“BS”) Statements

Not every angry or inappropriate statement is a legitimate threat of violence. Employers must avoid both extremes:

• Overreacting to non-credible statements (which can create HR and legal issues), and
• Underreacting to credible threats (which can create catastrophic safety and liability outcomes).

The correct approach is evidence-based and articulable.

Indicators of a Credible Threat

A threat should be treated as legitimate when one or more of these factors exist:

1) Specificity

• Names specific people (“my manager,” “that coworker”)
• Identifies a location (“the office,” “the parking lot,” “the breakroom”)
• Mentions a timeline (“tomorrow,” “after my shift,” “when they least expect it”)
  Specific details elevate risk significantly.

2) Capability

• Access to weapons (stated or reasonably known)
• Statements indicating ability or readiness to carry out violence
• Past violent behavior or experience
  Intent without capability is concerning; intent plus capability is serious.

3) Escalation Over Time

• Threats become more frequent or severe
• Language shifts from frustration to revenge or harm
• Behavior worsens instead of stabilizing
  Escalation is one of the strongest predictors of violence.

4) Corroboration

• Multiple witnesses heard the same statements
• Texts, emails, voicemails, social posts, or recordings exist
• Complaints from different employees align
  Corroboration shifts the issue from subjective to objective.

5) History and Pattern

• Prior threats (even if no violence occurred)
• Prior confrontations, intimidation, or aggressive behavior
• Documented discipline for hostile conduct
  History matters in threat assessment.

6) Refusal to De-escalate

• The employee cannot or will not calm down when redirected
• The employee refuses to leave the workplace or continues engagement
• The employee continues threats after warnings
  Loss of emotional control and refusal to disengage increase risk.

Indicators a Statement Is Less Likely to Be Credible

Statements are less likely to be credible when they are:

• Vague frustration without violence (“this place is ridiculous”)
• An isolated comment immediately retracted or clarified
• Unsupported by any corroboration, escalation, or pattern

That said, less credible does not mean ignore. The proper response is still to document and monitor, because patterns often start small.

The Standard to Apply

Employers should be able to answer:

“Can we articulate, based on facts, why this represents a real risk?”

If yes: escalate appropriately.
If no: document, monitor, and manage through policy.

What Employers Should NOT Do

When threats occur, many businesses make predictable mistakes. Avoid the following:

• Do not confront the employee alone. Always have leadership protocols and safety in place.
• Do not minimize the threat as “venting,” “joking,” or “blowing off steam” without evaluating facts.
• Do not handle it informally (handshake agreements, verbal warnings only, private conversations with no records).
• Do not allow continued unsupervised access to people, sensitive areas, or the facility after a concerning incident.
• Do not rely solely on verbal warnings as the primary control measure when credible risk exists.

These approaches often look indefensible in hindsight—especially when documentation is weak.

Evaluating the Employee’s History and Behavioral Indicators (Lawfully)

Threat assessment must be based on documented, job-related indicators, not rumor, profiling, or unauthorized investigations. The goal is to evaluate risk using information that is lawful, relevant, and defensible.

Workplace Performance and Conduct

• Sudden decline in performance or reliability
• Attendance problems or no-call/no-show patterns
• Repeated disciplinary actions
• Persistent conflict with supervisors or coworkers
  A stable employee who suddenly deteriorates may warrant increased scrutiny.

Professionalism and Workplace Standards

• Repeated hygiene or uniform issues (especially if worsening)
• Increasing disregard for workplace standards
• Sudden changes in self-care or appearance combined with other warning signs
  Appearance alone is not determinative, but changes can indicate instability when paired with threatening behavior.

Emotional Regulation and Anger Indicators

• Outbursts, intimidation, or bullying
• Threatening “jokes” or hostile comments
• Inability to accept correction or supervision
• Increasingly confrontational interactions
  Repeated anger-related incidents are a major risk factor.

Prior Threats or Escalation

• Previous threats, even if not acted upon
• Statements about revenge, retaliation, or harming others
• Escalating severity over time
  Prior threats are among the strongest indicators that current threats are serious.

Substance Abuse Issues (When Documented)

• On-duty impairment incidents
• Policy violations related to drugs or alcohol
  This must be based on documented workplace evidence—not rumor.

Financial Stressors (When Lawfully Known)

• Wage garnishments
• Requests for advances or emergency pay (if disclosed)
• Financial distress voluntarily disclosed to management
  Financial stress alone does not equal violence, but it can intensify risk when combined with threats or instability. Employers should not run unauthorized credit checks.

Relationship or Domestic Issues (When Lawfully Disclosed)

• Protective orders affecting the workplace
• Domestic disputes that spill into the job site
• Threats involving partners or family that may impact workplace safety
  Only include information lawfully known or voluntarily disclosed.

When to Contact Law Enforcement

Law enforcement should be contacted when a level of probable cause has been established that a legitimate threat of violence has been made.

This is a critical standard because it ties police involvement to articulable facts, not fear or speculation.

Probable cause may exist when:

• A threat is direct, repeated, or escalating
• Weapons are referenced or implied
• Specific harm, targets, or timelines are mentioned
• Witness statements corroborate the threat
• Written or recorded communications exist
• The employee refuses to disengage or leave
• Behavior indicates planning or intent

Once this threshold is met, continuing to “handle it internally” can become legally and operationally indefensible.

File a Police Report and Create a Record

Even if no arrest occurs, filing a police report is often a necessary step because it:

• Creates an official record of the threat
• Supports future enforcement actions
• Strengthens restraining/protective order requests
• Demonstrates responsible escalation and due care
• Protects the business in future litigation

Businesses should treat reporting as a risk-management function, not a public-relations concern.

Filing a Restraining Order or Protective Order

When threats are specific, repeated, or severe, employers should strongly consider pursuing a restraining order or protective order in coordination with law enforcement and legal counsel.

Restraining/protective orders are appropriate when:

• A legitimate threat has been documented
• The threat is ongoing, escalating, or repeated
• The employee attempts contact or access after separation
• Law enforcement advises additional legal safeguards
• Management needs enforceable boundaries to protect staff and operations

A restraining/protective order:

• Is issued by a court, not the employer
• Establishes legally enforceable boundaries
• Creates immediate legal consequences for violations
• Strengthens law enforcement response authority when violated

For businesses, restraining/protective orders also:

• Demonstrate proactive risk mitigation
• Support decisions to restrict access and contact
• Strengthen justification for armed security deployment
• Reduce civil liability exposure when properly implemented

Security does not replace the legal process. Professional armed security helps enforce boundaries, control access, and document violations while court orders are in effect.

Documentation Is Not Optional — Document, Document, Document

If it is not documented, it effectively did not happen. Employers should assume that a threat event may later be evaluated by:

• Law enforcement
• Courts
• Attorneys
• Insurance carriers
• Regulators

Your documentation tells the story of what happened, what you knew, what you did, and why your actions were reasonable.

What Employers Must Document

Incident Reports

• Date, time, and location
• Exact words used (quote the statement; do not paraphrase)
• Who heard it and who reported it
• What action was taken and by whom
• Whether police were contacted and when

Employee Statements

• Written statements from witnesses (collected promptly)
• Supervisor and management statements
• The employee’s statement, if appropriate and safe to obtain

Notes and Observations

• Behavioral changes and escalation patterns
• Attempts to de-escalate and the outcome
• Compliance or refusal to comply
• Any statements suggesting planning, revenge, or intent

CCTV and Digital Evidence

• Preserve CCTV footage immediately (many systems overwrite quickly)
• Save relevant emails, texts, internal messages, voicemails, or social posts (when lawfully accessible)
• Document chain-of-custody practices for evidence preservation

Documented Coaching, Counseling, and Discipline

• Coaching sessions and counseling notes
• Written warnings, performance improvement plans (PIPs)
• Policy violations and corrective action logs

External Actions

• Police report numbers and case IDs
• Officer names and agencies (when available)
• Copies of restraining/protective orders
• Written instructions or recommendations from counsel (as appropriate)

Documentation Mistakes to Avoid

• Relying on memory instead of records
• Vague language (“he was upset”) instead of facts (“he stated: ‘…’”)
• Mixing opinions into formal reports
• Delayed documentation
• Failing to preserve video or messages

Documentation is not busywork. It is risk management and legal protection.

When Armed Security Should Be Hired

Armed security should be hired based on risk, not convenience. Once certain thresholds are met, armed security is not optional—it is the appropriate mitigation measure.

Employers should consider hiring armed security immediately when any of the following exist:

Credible Threat of Violence

• Probable cause establishes that a legitimate threat has been made
• The threat is direct, specific, repeated, or escalating
• The employee references weapons, harm, or retaliation
  At this point the environment is no longer low risk.

Termination or Discipline Following a Threat

• An employee who has made threats is being terminated or disciplined
• The employee is emotionally escalated, hostile, or unstable
  Termination events tied to threats are among the highest-risk moments in workplace violence.

Refusal to Leave or Continued Access Attempts

• The employee refuses to disengage or leave the property
• Attempts to return after being removed
• Challenges access controls or violates boundaries
  These behaviors indicate loss of compliance and increased danger.

History of Violence or Escalation

• Prior violent behavior or credible threats
• Escalating pattern over time
  History combined with current threats strongly supports armed deployment.

High-Population or Public-Facing Environments

• Retail, grocery, warehouse, healthcare, or public locations
• Dense employee/customer populations
  Higher population density increases potential harm and raises the standard for deterrence and response capability.

Protective/Restraining Order Context

• A restraining/protective order is in place
• The employer must enforce boundaries and prevent unlawful access
  Armed security is often appropriate when enforcement and rapid response capability are required.

Why Unarmed Security Is NOT Appropriate for Credible Threats

Once a credible threat exists, the situation is no longer low risk. Unarmed security should not be used in credible workplace violence threat scenarios.

An unarmed guard:

• Cannot stop an armed attacker
• Cannot meaningfully intervene in a deadly-force event
• Does not deter someone intent on violence
• May become an additional victim

Using unarmed security in a known high-risk threat environment creates foreseeable failure and liability. It is not a reasonable safeguard.

Employers Must Take Action to Avoid Civil Liability

Once an employer becomes aware of a credible threat, inaction becomes legally significant. Employers have a duty to take reasonable steps to provide a safe work environment for employees, customers, and visitors.

Courts and insurers evaluate:

• Whether the risk was foreseeable, and
• Whether the employer took reasonable measures to mitigate it

When credible threats exist, reasonable action may include:

• Contacting law enforcement
• Filing police reports
• Pursuing restraining/protective orders
• Restricting access and controlling entry points
• Hiring armed security to provide a safe work environment

This is not escalation for its own sake. It is risk management aligned with foreseeable danger.

Q & A: Employee Threats and Security Response

Q: Should police be contacted for every threat?
A: No. Police involvement is appropriate when probable cause establishes a legitimate threat—direct, repeated, escalating, corroborated, or involving weapons.

Q: What if the threat was “just words” or made in anger?
A: Evaluate specificity, capability, escalation, corroboration, and history. Document regardless. A credible threat is still credible even if said in anger.

Q: Should a police report be filed even if no arrest occurs?
A: Yes. Reports create an official record and support restraining orders, enforcement, and liability protection.

Q: When should a restraining/protective order be considered?
A: When threats are specific, repeated, severe, or ongoing—especially if the employee attempts continued contact or access. Coordinate with law enforcement and legal counsel.

Q: Is unarmed security ever appropriate for credible workplace violence threats?
A: No. Unarmed security cannot stop an armed attacker and is not a reasonable safeguard in credible threat scenarios.

Q: When is armed security appropriate?
A: When probable cause establishes a legitimate threat, during termination/discipline after threats, when access boundaries are being violated, or when protective orders require enforcement.

Q: Can security “handle it” without police?
A: No. Security supports safety, deterrence, access control, and documentation. Law enforcement retains investigative and arrest authority.

Q: Can ignoring a credible threat create liability?
A: Yes. Failure to take reasonable steps after a credible threat is identified is a common basis for civil liability.

Contact Us for Workplace Threat Security Support

If your business is facing a credible workplace threat, guessing is not a strategy. Professional armed security provides:

• Controlled presence and deterrence
• Access control and perimeter management
• Professional documentation and incident reporting
• Coordination with law enforcement
• Support during termination and high-risk events

The goal is a calm, professional response that protects people and reduces foreseeable risk.

Related Articles:

• Workplace Violence Prevention
• Red Flags When Hiring A Security Company
• What Authority Do Security Guards Have in Colorado?
• How Much Does Security Cost In Colorado?
• Five Top Qualities Of A Security Guard Company

Legal Disclaimer

Legal Disclaimer: This information is provided for educational purposes only and does not constitute legal advice. Firearm laws can change, and local, state, federal, tribal, and municipal regulations may vary. Always verify current laws and consult a qualified attorney before carrying a firearm or making legal decisions related to self-defense. US Firearms Training Academy assumes no liability for actions taken based on this content.