A supervisor forwards a concerning message to HR. HR records it and assumes security will review the safety implications. Security has a separate incident record but does not know about the message. A member of the threat assessment team hears that the matter is being handled and waits for an update.
In this fictional example, information has moved, but responsibility has not moved with it. Nobody has confirmed who is reviewing the concern, what information that person needs, or when the organization should expect a next step. Each department may be doing part of its job while the handoff between them remains incomplete.
That is the problem I want organizations to examine before they buy another tool. Do the parts of the prevention process work together, and how would anyone know if they did not?
After 30 years in physical security and enterprise risk work, I have become less interested in whether an organization can list its systems than in whether it can explain what happens between them. A reporting form, an incident platform, an access-control system, and a multidisciplinary team can all serve useful purposes. Their presence does not establish a coordinated prevention process.
Start with a report that has an owner
The first responsibility is reporting and intake. People need an understandable route for raising a concern, and the organization needs someone responsible for receiving it. A channel also needs arrangements for absences, urgent concerns, and reports that reach the wrong department. Otherwise, the organization is depending on individual initiative to repair a gap in its design.
Receipt should produce more than a stored message. The original account needs to be preserved accurately, the relevant timing and source recorded, and the concern routed to an appropriate reviewer. The person making the report should not have to decide whether the situation meets an assessment threshold before anyone will listen.
In the opening example, the missing step is not another form. It is confirmation that a designated person has accepted responsibility for the next review. A forwarded email is evidence of transmission. It is not, by itself, evidence that the handoff was completed.
Give reviewers a usable account
The second responsibility is structured review. Authorized reviewers need a working account of what has been reported, what is supported by the available information, and what still needs clarification. Dates, sources, competing explanations, and significant gaps should remain visible as the account develops.
This is where Threatalytics AI can support the process. It can help organize information supplied for review, develop a neutral synthesis, and make decision-relevant questions easier to examine. It does not make every source reliable or every apparent connection meaningful. Reviewers still need to check the output against the underlying information.
In the fictional example, the message and security record may be related. They may also concern different people or circumstances. Bringing them together should allow that question to be examined, rather than quietly turning a possible connection into an established fact.
This work does not require every system to feed a single database, and it does not give everyone permission to see every record. An organization can coordinate relevant information through an authorized, documented process. Technical connections may help where they are appropriate and available, but they cannot substitute for agreement about who may share what, for which purpose, and with whom.
Make the team’s decision explicit
The third responsibility is multidisciplinary decision-making. The team needs to determine the significance of the available information, identify what it still needs to know, and select a response proportionate to the circumstances. Different professional perspectives should inform that discussion. Disagreement can reveal an assumption that deserves closer examination.
A structured summary should help the team have that discussion. It should not become a verdict that everyone is expected to accept. Where information is incomplete or conflicting, the record should reflect those limits and explain how they affected the decision.
The output needs to be clear enough for someone outside the meeting to understand the next step. Who is responsible? What authority do they have? What needs to happen, and what change would require the team to reconsider? A documented rationale supports review of the decision. It does not guarantee that the decision is correct or legally defensible.
Governance belongs throughout this process, rather than at one designated stage. It shapes intake, access, information sharing, professional review, and the actions people are permitted to take. These responsibilities remain with the organization and its qualified professionals.
Keep responsibility attached to the response
The fourth responsibility is intervention and follow-through. A team may agree on clarification, support, protective measures, or another appropriate response. Those decisions have limited value if the assigned actions are never carried out or nobody checks whether circumstances have changed. Immediate safety concerns require the relevant emergency response rather than waiting for a routine review.
In the opening example, a completed handoff would mean that someone accepted the review, clarified the relevant information, and communicated an appropriate next step to the people responsible for implementing it. It would also mean that the case had a way back to the team if new information changed the situation.
I describe these connected responsibilities as a Targeted Harm Recognition and Response Stack, or THRRS. It is an operating model for examining how the organization works, rather than a requirement to purchase a particular collection of products. Reporting and intake, structured review, team decisions, and follow-through need to remain connected even when different people and systems support them.
An organization can have a working intervention strategy without AI. The relevant question is whether assistive intelligence improves a specific part of that strategy while preserving professional control. For Threatalytics AI, that means supporting the review and documentation work without claiming to establish the reporting channels, connect every system automatically, or execute the organization’s response.
The practical test is to follow a fictional concern through your own arrangements. Ask each recipient what they receive, what they do with it, and how they know the next person has taken responsibility. Where the answers become uncertain, there is a concrete opportunity to improve the process.
Connected prevention is not achieved because information was sent. It begins to work when the right people receive it, examine it, decide what it requires, and remain accountable for the next step.
Does this sound familiar?
Did the report move without a clear owner?
Have you ever forwarded a concern, assumed someone else was handling it, and later discovered that nobody owned the next step?
If that sounds familiar, it may be worth examining the handoffs in your process. We welcome a conversation about where information gets stuck, what your team needs, and whether Threatalytics AI could help.
Talk Through Your ChallengeAbout this essay
Adapted from Jason Destein’s February 26 essay, “The End of Disconnected Silos!” This version was published on October 29, 2026. The opening example is fictional. THRRS describes the author’s proposed operating model.