Behavioral Threat Assessment in California: How Investigators Evaluate Real Risk

A former employee keeps showing up in the parking lot. An ex-partner's messages have shifted from angry to unsettling to strange. A relative with a documented history of volatility has started talking about a grievance in a way that worries everyone around them. In each of these situations, families and employers ask the same question a behavioral threat assessment is built to answer: is this person actually dangerous, or does it just feel that way?

If someone is in immediate danger right now — a weapon is present, a threat has a specific time and place attached to it, or violence has already started — call 911 first. A private investigator supports a threat assessment and the steps that follow it. A private investigator does not replace law enforcement in an active emergency.

What Is a Threat Assessment, and How Is It Different From a Guess?

A behavioral threat assessment is a structured evaluation of a specific person's words, conduct, and history to determine whether their behavior is moving toward violence — and if so, how quickly. It is not a hunch, a background check, or a one-time gut reaction to a scary email. It is a documented process: gathering the full record of what the subject has said and done, identifying patterns, comparing those patterns to known pathways to violence, and producing a written assessment that names the specific risk factors present and absent.

Greg A. Tucker, license #PI188351, built this skill set before it was a private-sector service. In 27+ years of investigative work — including a term as a Lieutenant with the Texas Department of Criminal Justice and later as a Senior Parole/Probation Officer with the Florida Department of Corrections — he spent years assessing risk in people with documented histories of violence, which is exactly the population behavioral threat assessment was originally built to evaluate. That background, combined with graduate work in forensic psychology, criminology, and legal studies, now informs how G.A. Tucker PI's forensic behavioral profiling work evaluates subjects in family and workplace cases out of our Murrieta office and how the findings get written up for an attorney, an HR department, or a court.

Behavioral analysts rarely hold a California PI license. Private investigators rarely hold a graduate degree in forensic psychology. An assessment that draws on both — the academic framework and the license to legally investigate, document, and report — looks at a case differently than either discipline does alone.

One distinction matters more than any other here: this work is behavioral and investigative, not clinical. A forensic psychology degree is academic training in how and why people behave the way they do. It is not a clinical license. We do not diagnose, we do not perform psychological evaluations, and we do not render a clinical opinion about whether a subject has a mental illness. A threat assessment answers a narrower, more useful question — what has this person actually said and done, and what does that pattern indicate about risk.

Making a Threat Is Not the Same as Posing One

Research from the U.S. Secret Service's National Threat Assessment Center, going back to its original work on assassination and school violence, established a finding that still holds: most people who make a direct threat do not go on to act on it, and most people who commit targeted violence gave no direct threat to their target beforehand. Treating every angry voicemail as equally dangerous — and every quiet subject as safe — gets the risk backward in both directions.

That is why a threat assessment does not stop at the content of a single message. It looks at the subject's full trajectory: whether their behavior is escalating, whether it is narrowing toward a specific target, and whether it shows the markers that research associates with the pathway to violence rather than venting.

Warning Behaviors Worth Tracking

• Fixation — an intensifying, disproportionate preoccupation with a person, place, or cause, measured in how much time, communication, or planning the subject devotes to it.
• Identification — the subject begins to see themselves as a soldier, avenger, or someone with a special mission, often borrowing language from past attackers or armed-conflict imagery.
• Leakage — the subject tells a third party, posts online, or otherwise reveals intent to harm someone, even indirectly or in a context that seems like venting.
• Novel aggression — a first-time act of violence or intimidation, unrelated to the original grievance, that tests the subject's own willingness to cross a line.
• Grievance narrative — a fixed, often distorted story of having been wronged, which the subject returns to and expands on across weeks or months.

None of these behaviors came out of theory. They come from decades of case-level research into attacks that were stopped and attacks that were not, cataloged by groups like the Secret Service's own threat assessment research teams and the FBI's behavioral science programs. A subject showing one of these in isolation is common. A subject showing several at once, in a tightening pattern, is what moves an assessment from "monitor" to "act."

Escalation Is a Pattern, Not a Single Event

No single warning behavior proves anything by itself. What an assessment weighs is frequency, direction, and speed: is contact increasing or decreasing, is the subject's language narrowing from general anger to a specific target and method, and is the timeline compressing. A disgruntled former employee who has been quietly stewing for eight months behaves differently, on paper, than one whose messages have gone from monthly to daily in the last two weeks. Our forensic behavioral profiling process exists to map that trajectory in writing, not just describe it in conversation.

How Do You Evaluate a Stalker, a Former Employee, or an Estranged Family Member?

Each relationship type carries a different risk profile, and a competent assessment treats them differently rather than applying one template to every case. A stalker with no prior relationship to the victim behaves on a different timeline than a former employee with a badge that still works, or a sibling locked in an inheritance dispute — the underlying method is the same, but what counts as a meaningful warning sign shifts with the relationship. Across Murrieta, Temecula, Wildomar, Menifee, and Lake Elsinore, G.A. Tucker PI's behavioral threat assessment intake starts by identifying which of the three is actually in front of us.

• Stalking cases — the analysis focuses on whether contact is increasing, whether the subject has located the victim through new or surprising means, and whether the subject has a documented history of escalating control or violence in prior relationships.
• Disgruntled former employees — the analysis weighs access (badges, keys, remaining logins), specificity of any grievance language, and whether termination or a disciplinary action created an acute trigger point. This is the core of a workplace violence threat assessment.
• Estranged family members — the analysis has to account for shared history, custody or inheritance disputes that may be driving the conflict, and prior documented incidents, since family cases often carry years of context that a stranger-on-stranger case does not.

From Assessment to Protection: What Happens Next

An assessment is only useful if it changes what the family or employer actually does. The deliverable is a written document, but the value is in the specific, proportionate steps it recommends — steps a family, HR department, or school typically carries out with support from counsel and, where appropriate, law enforcement.

1. 1Build a documentation protocol — a single, dated log of every contact, with originals preserved, so a pattern is provable rather than remembered.
2. 2Map the escalation timeline — plot every known incident chronologically to see acceleration or cooling that is invisible day to day.
3. 3Coordinate with the people who need to know — HR, campus or building security, school administration, or an attorney, briefed on the specific subject and specific risk factors, not a vague warning.
4. 4Adjust routines and environment — predictable patterns (parking, drop-off times, public schedules) get the first look, since removing predictability reduces opportunity.
5. 5Set defined triggers for escalation — agree in advance what change in the subject's behavior moves the response from monitoring to restraining order to law enforcement report.
6. 6Review on a schedule, not just after an incident — risk factors shift; a plan built in January can be outdated by June.

None of this makes a family or employer invulnerable. No assessment, security plan, or investigator can make someone's safety certain — risk is identified and reduced, not erased. What a structured process does is replace fear and guesswork with a specific, actionable picture of what is actually happening, which is usually the thing families and employers are missing most. Families managing a broader security program alongside a threat assessment often extend this work into our risk management services.

When Should You Call Police Versus Pursue a Civil Remedy?

California stalking is a criminal offense under Penal Code 646.9, covering a willful, malicious, and repeated course of conduct combined with a credible threat that places someone in reasonable fear for their safety or a family member's safety. If the facts fit that statute, law enforcement is the first call, not a private investigator. A police report also creates an official record that strengthens every later step, including any civil filing that follows it.

A licensed California investigator's role in either track is investigative, not legal: gathering public records, conducting lawful surveillance, documenting a timeline, and locating witnesses — material an attorney then uses to support a restraining order petition, a workplace separation, or a criminal complaint. That documentation work stays investigative, while the legal strategy stays with the client's attorney or, in a workplace matter, employment counsel.

When conduct is alarming and unwanted but falls short of the criminal threshold — repeated unwanted contact without a credible threat, for example — California's civil harassment restraining order process under Code of Civil Procedure 527.6 is the more common path. This is where investigative documentation matters most: a court granting a restraining order wants a clear, dated record of the conduct, not a description of how it felt. For workplace situations, consulting support often runs in parallel with the employer's own policies and legal counsel rather than replacing either.

In practice, most real cases involve both tracks at once — a police report plus a civil filing, or a workplace response plan that also documents a case for law enforcement if the subject's behavior crosses a legal line later. See the U.S. Secret Service National Threat Assessment Center for the published research behind this field, including its foundational work on identifying warning behaviors before an attack.

The Bottom Line

Fear is a reasonable response to a real threat, but it is not a plan. A structured behavioral threat assessment replaces that fear with specific answers: what this person has actually done, how fast it is moving, and what proportionate steps address it. To talk through a specific situation, request a confidential consultation with G.A. Tucker PI in Murrieta, CA.