Rob Andress
Violence Prevention Consultant, SAS-AP
Close Quarter Combative Instructor
Pure & Applied Debilitation Instructor
Active Threat Survival Trainer (A.L.I.V.E.)
Street Safe Self Defence Training Company
What is a risk behaviour cluster?
A risk behaviour cluster is a group of observable, connected behaviours that appear within the same situation and begin pointing toward increasing concern. A single behaviour does not prove that violence will occur. Changes in baseline, ignored boundaries, concealed hands, positioning, closing distance and words that conflict with actions become more meaningful when they appear together. The purpose of identifying a cluster is not to predict violence with certainty. It is to recognize changing risk early enough to create distance, seek support or leave safely.
People often believe violence begins with the first punch, the first shove, the first grab or the moment a weapon appears.
It doesn’t.
That is simply the moment violence becomes undeniable.
Before that first physical act, something has often changed. The person may have changed. The conversation may have changed. The distance between you may have changed. Someone who was loud and emotional may suddenly become quiet. A hand that was visible may disappear. A person who was standing several feet away may begin moving closer, even after being asked to stop.
Those changes matter because behaviour is information.
For more than two decades, I have taught people how to protect themselves from violence. One of the greatest mistakes I continue to see is the belief that we can identify danger through one dramatic warning sign.
We look for the raised fist. The open threat. The weapon. The behaviour nobody could possibly misunderstand.
The problem is that those are not always early indicators. In many cases, they are confirmation that the situation has already crossed into violence or is only seconds away from doing so.
Real behavioural awareness happens earlier than that.
It happens when we begin recognizing clusters of risk behaviour.
A List of Warning Signs Is Not Enough
When people are taught about violence, they are often handed a list.
Clenched fists. Pacing.
Heavy breathing. A change in voice. Aggressive posture. Glaring. Invading someone’s personal space.
These are not made-up signs. The Canadian Centre for Occupational Health and Safety identifies behaviours such as pacing, trembling, clenched jaws or fists, changes in voice, rapid breathing, abusive language and violations of personal space as possible warning signs of workplace violence. NIOSH and OSHA training materials identify many of the same observable changes.
But here is the problem.
A list without context can create as much confusion as awareness.
A clenched fist does not prove someone is about to strike you. Pacing does not prove someone is violent. Avoiding eye contact does not prove someone is hiding something. A person may be frightened, anxious, frustrated, traumatized, neurodivergent or simply uncomfortable.
One behaviour may have several reasonable explanations.
That is why we don’t identify violence through one movement. We identify increasing risk through clusters of behaviour.
A cluster begins to form when several observable behaviours appear within the same period of time and start pointing in the same direction.
The person’s voice changes. One hand disappears. Their body position changes. They begin looking around the environment. They stop responding meaningfully to what is being said. They continue closing distance after being asked to remain where they are.
Any one of those behaviours may be explainable.
Together, they begin telling a different story.
This does not prove violence is about to occur. Human behaviour is not a mathematical equation, and anyone claiming they can predict an attack from three gestures is teaching fiction.
The FBI makes this distinction in its behavioural-analysis guidance. No single behaviour means a person is moving toward targeted violence, but multiple concerning behaviours may provide legitimate cause for concern.
That is the difference between prediction and risk recognition.
We are not claiming to know what the person will do next. We are recognizing that the conditions around us are changing and that the possibility of violence may be increasing.
Risk Behaviour Is About What Someone Is Doing
We need to be very clear about what we mean by risk behaviour.
Risk behaviour is not someone’s clothing. It is not their age, culture, race, mental-health history or social position. It is not deciding that someone looks as though they don’t belong.
Risk behaviour is observable conduct that increases concern within the circumstances.
Is the person taking away distance? Are they ignoring reasonable boundaries? Are they trying to isolate someone? Are they blocking access to an exit?
Are they concealing their hands? Are their words offering reassurance while their actions continue creating control?
These behaviours matter because they may increase the person’s opportunity to use violence while reducing our ability to respond safely.
That is what makes a cluster significant. The behaviours are not simply occurring at the same time. They are beginning to work together.
Someone becoming louder, pacing and breathing heavily may be showing increasing emotional distress. That deserves our attention, but it does not automatically mean an attack is imminent. The person may still be listening. They may still be responding to questions. They may still be respecting distance and boundaries.
Another person may suddenly become calm. They stop arguing, conceal one hand, turn part of their body away and begin moving closer.
The first person may be expressing emotion.
The second person may be preparing to act.
We cannot know that with absolute certainty. What we can recognize is that the second cluster presents a different level of risk.
Start With Change
Recognizing a cluster begins with
baseline.
Baseline does not mean deciding what a normal person should look like. It means paying attention to what has been normal for this person, in this environment, during this interaction.
Someone may naturally speak loudly. They may avoid eye contact. They may constantly move their hands while speaking. Those behaviours may be part of their baseline and have no connection to violence.
What deserves our attention is change.
The person who was speaking quickly suddenly becomes silent. The individual who was moving continuously suddenly becomes still. Someone who was speaking to everyone in the room begins focusing entirely on one person. A visible hand disappears into a pocket or behind the body. The person who was keeping an appropriate distance begins moving closer.
Change does not au
tomatically mean danger.
Change tells us to pay closer attention.
Sometimes the baseline will be limited because we have never met the person before. In those situations, we look at the baseline of the interaction and the environment.
What was happening thirty seconds ago? What changed after a boundary was established? Did the behaviour begin improving, or did it start moving toward greater access, control and opportunity?
The direction of the behaviour matters.
Is the person becoming less agitated or more agitated? Are they creating space or taking it away? Are their hands becoming more visible or less visible? Are they beginning to communicate, or have they stopped listening? Are they respecting boundaries, or testing them?
This is far more useful than simply counting gestures.
A Boundary Gives Us Information
A boundary is not only something we communicate. It is also a way of gathering information.
If someone moves too close, we may say, “Please stay there.”
If they stop, that response tells us something.
If they ignore us and cont
inue moving forward, that tells us something more important.
The original movement may have been accidental. Continuing after a clear boundary has been established is no longer accidental in the same way. The person received the information and made a decision about whether to respect it.
Boundary testing may involve more than distance.
Someone may insist that we move somewhere more private. They may attempt to separate us from coworkers or witnesses. They may block a doorway while claiming they only want to talk. They may repeatedly touch someone after being told to stop. They may continue asking for personal information after that information has been refused.
One boundary violation may
be poor judgment.
Repeated violations begin creating a pattern.
The issue is not simply that the person made us uncomfortable. The issue is that they are learning whether our boundaries have consequences.
This matters because good people often talk themselves out of what they can clearly see. They don’t want to appear rude, paranoid or judgmental. They keep giving the other person one more opportunity because they want an innocent explanation to be true.
Predatory people understand this. They understand that politeness can hold someone in place. They understand that confusion creates hesitation. They understand that a person waiting for certainty is often a person who remains available.
Positioning Changes the Risk
People move naturally during conversation, so movement alone is not suspicious.
Positioning becomes important when it begins reducing our choices.
Someone steps between us and the doorway. They guide us toward a wall, vehicle or confined area. They move closer every time we move away. They position themselves where others cannot clearly see the interaction. They continue closing distance while keeping one side of their body turned away.
Again, none of those actions proves an assault is coming.
But when positioning, concealed
hands, ignored boundaries and focused attention begin appearing together, we are no longer looking at unrelated movements.
We are seeing a cluster that may be increasing access while reducing our ability to leave.
Distance is not empty space.
Distance is time.
Every step someone takes toward us reduces the time available to recognize, decide and respond. This is why personal-space violations are included among the possible warning signs identified by Canadian and American occupational-safety organizations.
We should never allow
someone to take away all of our distance simply because we are afraid of appearing rude.
When the Words and Behaviour Don’t Match
One of the strongest parts of a developing cluster is incongruence.
Incongruence occurs when someone’s words tell us one thing while their behaviour tells us something different.
“Relax. I’m not going to hurt you.”
Those words sound reassuring.
But what if the person continues moving closer? What if they are blocking the exit? What if one hand remains hidden? What if they glance around to see who is watching?
The words are offering reassurance while the behaviour is creating control.
When language and behaviour disagree, we need to give greater weight to the behaviour affecting our safety.
That does not mean we accuse the person of lying. It means we stop allowing their words to erase what we can see.
The same applies to de-escalation. A person becoming quiet does not necessarily mean we have successfully de-escalated them.
Did their body relax? Did they create distance? Did their hands become visible? Did they begin participating in the conversation again?
Or did the noise disappear while their positioning became more deliberate?
Silence can mean the situation is settling.
It can also mean the conversation is over in the other person’s mind.
Three Indicators Are a Trigger, Not Proof
We have talked about using three indicators as a decision point, and I believe that has real value when it is taught honestly.
Three credible indicators do not prove violence is going to occur. They tell us that enough information may now be present for our behaviour to change.
The first indicator gets our attention.
The second gives the first one context.
The third tells us the situation may no longer be moving randomly.
Something is developing.
That is the moment
to stop searching for excuses and start creating options.
But the number is not a countdown. We do not ignore two serious behaviours because we are waiting for a third.
Someone rapidly closing distance with one hand concealed may require an immediate response. Someone openly producing a weapon does not require us to search for more indicators. The seriousness of the behaviour must always take priority over the number observed.
Three unrelated, low-concern behaviours may mean very little. Two immediate, connected behaviours may mean a great deal.
The number should never replace judgment. It should interrupt denial.
Ask What the Behaviour Is Accomplishing
One of the best ways to assess a cluster is to stop asking what each movement means and begin asking what the combined behaviour is accomplishing.
Is it reducing distance? Is it creating isolation? Is it limiting access to an exit? Is it testing whether boundaries will be enforced? Is it concealing what the hands are doing? Is it shifting control of the environment toward the other person?
We cannot read someone’s mind, but we can observe what their behaviour is changing.
That distinction keeps behavioural awareness grounded in fact.
“He made me feel like he was dangerous” is an interpretation.
“He continued moving closer after being asked twice to remain where he was” is an observation.
“She looked crazy” is a judgment.
“She began pacing, struck the counter and threatened an employee” describes observable behaviour.
This is also how risk behaviour should be documented in the workplace. Record what was said, what was done, what changed, whether distance was taken away, whether boundaries were ignored and what response was required.
Specific observations give supervisors, security professionals and threat-assessment teams information they can evaluate.
Labels do not.
Recognition Must Change Our Behaviour
Recognizing a cluster only has value if that recognition changes what we do.
Many people see concerning behaviour and remain exactly where they are. They continue explaining. They continue negotiating. They continue hoping the situation will settle.
They have noticed the risk, but they have not acted on the information.
This is often where politeness becomes dangerous.
We don’t want to embarrass someone. We don’t want coworkers to think we overreacted. We convince ourselves to wait for one more indicator, something obvious enough to justify leaving.
The problem is that the next indicator may be the first physical act.
When a credible cluster begins forming, our response does not have to be dramatic. We don’t need to challenge the person, announce what we have recognized or prove that we are right.
We quietly improve our position.
We increase distance. We move toward an exit. We place a barrier between ourselves and the person. We bring a coworker into the interaction. We alert security, a supervisor or another appropriate resource. If the situation continues moving in the wrong direction, we end the interaction and leave.
If there is an immediate threat, we contact emergency services and follow the emergency procedures available to us.
Early recognition gives us the opportunity to respond with less confrontation and more control.
We also need to understand that taking protective action is not the same thing as making an accusation.
Leaving does not declare someone guilty.
Creating distance is not an act of aggression.
Calling for assistance is not an attack on someone’s character.
These are reasonable responses to changing risk.
The Goal Is Not Prediction
No credible instructor should promise that behavioural indicators allow us to predict every act of violence.
Human behaviour is too complex. Context matters too much. Some violent incidents develop with few observable warnings, while other situations display many concerning behaviours and never become physical.
That does not make behavioural awareness unreliable.
It means we use it responsibly.
We observe change. We look for clusters. We compare words with actions. We pay attention to distance, positioning, hands, boundaries and the environment. We make reasonable safety decisions before certainty arrives.
We are not trying to prove what another person will do.
We are deciding what we should do with the information available to us.
That is the heart of violence prevention.
One indicator is information.
A cluster creates context.
Context allows us to recognize risk.
Recognition gives us choices.
And choices made early may prevent us from ever needing to physically defend ourselves.
The first punch should never be the first moment we realize something is wrong.
We do not need to wait for violence to prove us right. We need to recognize when the level of risk has changed and give ourselves permission to change with it.
One behaviour is information. A cluster changes the risk. When the risk changes, our behaviour must change with it.
Rob Andress
Violence Prevention Consultant, SAS-AP
Close Quarter Combative Instructor
Pure & Applied Debilitation Instructor
Active Threat Survival Trainer (A.L.I.V.E.)
Street Safe Self Defence Training Company
About the Author
Rob Andress is the founder of Street Safe Self Defence Training Company and has spent more than two decades teaching reality-based violence prevention and self-defence across Canada. His work has taken him into schools, municipalities, corporate workplaces, healthcare environments, security operations, the real estate industry and northern Indigenous and Inuit communities.
Rob is known for a direct, experience-based approach that removes the fantasy from personal safety. He does not teach people to wait for violence and hope they remember a technique. He teaches them to understand human behaviour, recognize changing risk, identify pre-violence indicators and make safer decisions while choices are still available.
As a Violence Prevention Consultant, SAS-AP, Close Quarter Combative Instructor, Pure & Applied Debilitation Instructor and Active Threat Survival Trainer through A.L.I.V.E., Rob brings together behavioural awareness, situational awareness, de-escalation, threat recognition and practical self-defence. His message is simple: the greatest success is not winning the confrontation. It is recognizing the danger early enough that the confrontation never becomes physical.
Rob does not teach fear.
He teaches people how to see what others miss.
FAQ questions for the article
- What is a cluster of risk behaviour?
- Do three indicators prove violence is about to happen?
- Why is a change from baseline important?
- What should someone do after recognizing a credible cluster?
- Is one behavioural warning sign enough to identify a violent person?
Sources
- Canadian Centre for Occupational Health and Safety: Workplace Violence Warning Signs
- FBI: Behavioral Analysis
- FBI: Making Prevention a Reality
- NIOSH: Behavioural Cues
- OSHA: Workplace Violence Warning Signs
- Recognizing violence before it starts: How to Protect Yourself From Violent Situations
- T.R.A.A.C.S. training: T.R.A.A.C.S. Training
- Understanding human behaviour: Why Understanding Human Behaviour Matters
- The first moments of escalation: The First Five Seconds Decide Everything
- Corporate violence prevention training: Corporate Training
- Situational awareness training: General Self Defence