Years ago, I wrote that a strong safety and security program should give an organization two things: time and distance. I still believe that. But I have become more precise about what those words mean, and about the work required to make either one useful.
A locked door may delay unauthorized entry. A well-designed perimeter may create separation. Earlier reporting may give a team an opportunity to examine a concern before someone arrives at that door. These are different capabilities, and each depends on people knowing what to do with the opportunity it creates.
After 30 years in the security industry, the question I keep returning to is practical: does your program give you room to make a considered decision, or does meaningful coordination begin only when the situation becomes urgent?
Time begins before the alarm
When security professionals discuss time, we often mean the interval between detection and response. How quickly does an alarm reach the right person? How long does it take to verify the event, communicate instructions, and take protective action? Those questions matter. A delay has limited value if nobody recognizes it or uses it.
Prevention adds an earlier interval: the time between someone noticing concerning behavior and the organization making a proportionate, informed response. That interval can be lost without a single equipment failure.
Consider a fictional workplace. An employee tells a supervisor that a former partner has been sending increasingly threatening messages and asking about their work schedule. The supervisor listens but is unsure whether a personal matter belongs with HR or security. The employee does not know there is another reporting option. Several days pass before anyone responsible for safety planning receives the concern.
The opportunity was not created when security finally opened a case. It existed when the employee first asked for help. Unclear responsibility consumed part of it.
That is why a reporting channel is an operational capability, not simply a form on a website. People need to know where to bring a concern, what happens after they report, and how to reach someone when the usual recipient is unavailable. The receiving team needs a way to recognize urgency, acknowledge receipt, and assign the next step.
Earlier information needs careful interpretation
Receiving information sooner does not establish that violence is likely. The FBI emphasizes that no single behavior establishes that someone is moving toward targeted violence, while combinations of concerning behavior may warrant attention. It also recognizes the role of family members, friends, and others who observe and report concerns.1
For a team, the practical work is to examine what was reported, how reliable it is, what remains unknown, and what protective or supportive action the circumstances justify. A grievance is not a prediction. Distress is not proof of dangerousness. A pathway model can support inquiry, but it is not a timetable that every person follows.
In the fictional workplace example, the team would need to understand the reported messages, the employee’s concerns, and any relevant access or safety issues. It would also need to involve appropriate partners and consider the employee’s preferences without promising confidentiality or outcomes it cannot provide. The purpose is a coordinated response to the circumstances, not a label applied to a person.
Distance is physical. Opportunity is operational.
My earlier essay used distance broadly to describe discovering a concern farther from a crisis. That remains a useful idea, but the distinction matters. Learning about a concern earlier does not physically separate a person from a potential target.
Physical distance and delay come from protective arrangements suited to the setting. CISA’s Security Planning Workbook describes layered security across outer, middle, and inner perimeters as a way to slow or discourage unauthorized access.2 The appropriate combination still depends on the site, the people using it, and the concern being managed.
A building may need controlled entry, reliable door hardware, usable communications, or changes to how visitors reach occupied areas. Those measures need maintenance, clear procedures, and practiced responses. A camera that records an approach and a system that alerts someone in time to act serve different purposes.
Earlier assessment creates a different kind of room: an opportunity to consider support, review authorized access, coordinate with relevant partners, and develop a safety plan before immediate circumstances narrow the choices. That work complements physical protection. It does not replace it.
The distinction is especially important when a person already has legitimate access. A perimeter alone cannot resolve a concern involving an employee, student, patient, or other authorized visitor. The team has to understand the behavior and context while considering what safeguards are appropriate and within its authority.
What does your team do with the room it has?
I would test a prevention program by walking a fictional concern through it. Start where the information first appears. Follow it to the person who receives it, the team that reviews it, and the people responsible for carrying out the response. At each handoff, ask what could delay the next step and who would notice.
Useful measures might include how long an urgent report waits for review, whether assigned actions are completed, and whether a reassessment occurs when new information arrives. Faster is not automatically better. The aim is timely attention matched to the concern, with enough structure to avoid both neglect and unnecessary escalation.
This is where Threatalytics AI can support the work. It can help organize supplied behavioral information, make unresolved questions easier to examine, and support documented reasoning and follow-up planning. Your organization still has to establish the reporting routes, verify information, assign responsibilities, and carry out its decisions. Assistive intelligence cannot recover an observation that nobody reported or create physical protection on its own.
Time and distance remain worthwhile goals because they can preserve options. Their value depends on what an organization does with those options: who receives the concern, how the team evaluates it, and whether a responsible action follows. That is the capability I would want to examine before the next crisis tests it.
Does this sound familiar?
Does your team get involved early enough?
Have you ever learned about a concern and wondered why it took so long to reach the people who could help? Or worried that your organization’s strongest capability begins only after an alarm?
We welcome a conversation about those gaps, how your team receives and uses information, and whether Threatalytics AI could help you make better use of the time available.
Talk Through Your ChallengeSources and essay note
1. Federal Bureau of Investigation, Behavioral Analysis: Identifying and reporting concerning behavior.
2. Cybersecurity and Infrastructure Security Agency, Security Planning Workbook (September 2023), p. 12, on layered security.
Adapted and substantially updated from Jason Destein’s earlier April 16 essay, “Time and Distance.” This version was published on October 29, 2026. The workplace example is fictional. The discussion of organizational practice reflects the author’s professional perspective; the sources support the specific principles identified above.