These standards guide selection for the Weekly Soft-Target Violence Brief, the U.S. Soft-Target Incident Map, and, when warranted, Special Incident Reports. Inclusion is based on the totality of circumstances and protective-security relevance—not a single numerical trigger.
What We Monitor
Events are identified through credible publicly available reporting, including law-enforcement and public-agency releases, court filings, emergency-management information, reputable news organizations, and other corroborated open sources.
- Schools and educational facilities
- Houses of worship and faith-based facilities
- Public spaces and community locations
- Mass gatherings, entertainment and special-event venues
- Public-facing government, commercial and office environments
- Transportation and other high-traffic locations
- Other soft targets or crowded places with meaningful protective-security implications
Events Considered
Completed attacks, attempted attacks, disrupted plots, credible attack preparations, and significant security incidents may be considered when credible public reporting establishes a meaningful connection to soft-target protection.
Events do not need to meet every factor below. The central question is whether the event provides useful information for prevention, detection, response, mitigation, or protective-security planning.
Weekly Brief Inclusion Threshold
An event may be included when credible reporting supports one or more of the following:
- Significant violence or attempted violence: death, injury, substantial disruption, or a clear potential for serious casualties.
- Soft-target relevance: the location, intended target, or circumstances involve a publicly accessible, crowded, or comparatively vulnerable environment.
- Disrupted attack planning: authorities identify meaningful operational progression such as target selection, weapons acquisition, surveillance, written or communicated plans, or movement toward execution.
- Protective-security significance: the event exposes a meaningful issue involving access control, screening, perimeter security, detection, reporting, emergency procedures, communications, staffing, or another protective measure.
- Successful intervention or control: personnel, citizens, law enforcement, technology, physical-security measures, or established procedures materially prevent, interrupt, or reduce consequences.
- Notable tactics or methods: attack techniques, weapons, deception, surveillance, vehicle use, explosive threats, unmanned aircraft, insider access, or other methods with potential applicability to similar facilities.
- Pattern or trend relevance: an incident contributes to an observable series, recurring vulnerability, target preference, tactic, or operational pattern important to protective-security professionals.
Incident Map Threshold
The U.S. Soft-Target Incident Map generally follows the same substantive inclusion standard as the Weekly Brief. A mapped incident must also have a meaningful U.S. geographic location supported by public reporting. Map markers use approximate city/general-area locations rather than precise facility coordinates.
Historical backfill records and weekly-brief records are distinguished by provenance only; that distinction is not a severity, threat, confidence, or risk rating.
Special Incident Report Threshold
A Special Incident Report may be produced when an event warrants analysis beyond the normal weekly summary—for example, a major or coordinated attack, substantial casualties, advanced disrupted planning, an unusual or evolving methodology, extensive pre-incident activity, a significant security failure, an important example of controls working as intended, or an event with broad implications for similar organizations.
No single numerical casualty threshold automatically requires a Special Incident Report.
What Generally Does Not Meet the Threshold
Events are normally excluded when they are primarily private or interpersonal with no broader soft-target implications; available reporting is too limited or unreliable to establish essential facts; an incident consists only of generalized threats without credible indicators of intent or operational progression; or the event provides little identifiable protective-security relevance.
Source & Analytic Standard
We distinguish between confirmed facts, preliminary reporting, and analytical observations. Information may be updated as additional credible reporting becomes available. Security-gap observations are limited to what credible public reporting reasonably supports, and unsupported rumor or unverified social-media claims are not treated as established facts.
These products are not official threat assessments, formal risk ratings, or predictions of future events.
Does this event provide meaningful information that could help an organization better understand, prevent, detect, respond to, or mitigate violence affecting a soft target or crowded place?
When the answer is yes—and the available information is sufficiently credible—the event is considered for inclusion. Editorial judgment remains necessary because real-world incidents vary in context, reporting quality, severity, and protective-security significance.