A warning sign is a reason to speak to someone, not proof of anything. The US Cybersecurity and Infrastructure Security Agency (CISA) is clear on this: people have bad days, and becoming sad, argumentative or angry does not mean there is intent to cause harm (CISA: De-escalation Series, Recognize). What helps is noticing a pattern or a change, and telling the right person early.
It matters because the stakes are real. The US Bureau of Labor Statistics counted 733 work deaths from violent acts in 2024, and 470 of them were homicides (BLS: Census of Fatal Occupational Injuries in 2024).
This guide gives 12 behaviours to notice in 3 sets of 4, then how to report them and a short session to run with staff. The 12 is our grouping of the observable behaviours in two CISA documents, Pathway to Violence and the De-escalation Series above. No source names a list of exactly 12, and we leave out personal stressors such as money worries, illness or divorce, because CISA lists them separately, as risk factors that may give reason for concern when viewed together, not as observable behaviours.
This is general information, not a way to diagnose anyone. Your own workplace policy and the law where you work govern what you do next.
What counts, and what does not
The Occupational Safety and Health Administration (OSHA) defines workplace violence as any act or threat of physical violence, harassment, intimidation or other threatening behaviour at the work site, from threats and verbal abuse to physical assault and homicide (OSHA: Workplace violence).
CISA says co-workers, peers, friends and family are often best positioned to notice warning signs, and that people who know someone well can spot a change in baseline behaviour: a hard worker who stops caring about their work, or an outgoing person who becomes withdrawn. Look for patterns, not a single bad day.
Set A: Conduct at work (4 behaviours)
- Increasingly erratic, unsafe or aggressive behaviour. CISA's Pathway to Violence lists this first. What to do: note what you saw and when, then pass it on.
- Disgruntlement toward colleagues. Resentment of peers, which CISA lists among observable changes in behaviour. What to do: tell a manager or HR if it grows or targets a person.
- Unwillingness to follow rules or policies. A new or growing refusal to comply with established rules. What to do: report the pattern, not a one-off.
- Stalking, harassing or bullying. Conduct aimed at one person is serious in its own right. What to do: report it at once, and keep the person it targets safe.
Our pick: stalking, harassing or bullying. It is conduct that most workplace policies already cover, so you do not have to guess about intent. You report what happened, and the people responsible decide what comes next.
Set B: Words and interests (4 behaviours)
- Threats of violence, spoken or written. What to do: take any threat seriously and tell a manager or HR at once. In an emergency, see the reporting section.
- Inappropriate statements or jokes. CISA lists these among the signs. What to do: if it is about harming people, report it and let the right team judge it.
- Fascination with previous incidents of violence. What to do: note what you hear, because one comment may mean little and a repeated focus is a pattern.
- New, increased or unhealthy interest in weapons. What to do: report it if the interest is new, growing or linked to anything above.
Our pick: threats of violence. It is the clearest case. You do not have to interpret a threat, and the right action is to report it straight away.
Set C: In the moment (4 behaviours)
- Argumentative or uncooperative behaviour. CISA lists this under observable physical behaviours, and the same page reminds you that bad days happen. What to do: stay calm and keep your distance, and report it if it keeps happening or escalates.
- Signs of tension in the body. Clenched jaw or fists, pacing or restlessness, trembling or shaking. What to do: do not confront the person. Create space and tell someone.
- Violating others' personal space. What to do: step back and tell a manager if it continues.
- Displaying a weapon, or threatening to use one. What to do: leave and call 911 (or your local emergency number).
Our pick: displaying or threatening with a weapon. It needs no judgement: it is an emergency, and the right response is to get away and call for help.
What to do and how to report
OSHA says there are currently no specific OSHA standards for workplace violence. It does say it is critical that all workers know the policy and are trained on prevention methods, the signs of potential violent behaviour and how to react when an incident occurs (OSHA: Workplace violence). With 733 work deaths from violent acts in 2024 (BLS), early reporting is worth the effort.
What you do depends on what you see:
- Imminent danger. If a threat appears imminent, call 911 or local law enforcement (CISA: Pathway to Violence). Do not enter any situation or location where you feel threatened or unsafe (CCOHS: Violence in the workplace).
- Concerning behaviour, no imminent threat. Inform others of what you have seen. CISA says to tell a supervisor, manager, security guard or other designated employee or team member.
- Where your policy provides one. Use the route it names: your manager, HR or an anonymous channel. CCOHS says a good policy outlines a confidential reporting process and assures that no reprisals will be made against people who report in good faith.
Stick to facts: what you saw or heard, when and where. Do not guess at motives, and do not try to handle it alone.
Ways to host a warning-signs session with AhaSlides
A short session works best when people answer for themselves and can raise concerns without being singled out. Build the slides from the examples above.
- Pick Answer: a "Notice, report or ignore?" quiz with fresh scenarios. For example, "A colleague snaps in a meeting after a long week" (a bad day on its own; keep an eye out for a pattern), "A colleague jokes about bringing a weapon to work" (report it) and "Someone shows a weapon in the car park" (leave and call 911).
- Word Cloud: "Where could someone report a concern here?" The answers show whether people know your routes.
- Rating Scale: "How safe do you feel raising a concern?" Rate 1 to 5, then talk about the lowest scores.
- Open Ended, anonymous: one question for the safety lead.
- Q&A: people send questions without having to say them aloud.
Swap in your own policy, contacts and routes so the slides match what staff will do. For more ideas see 100 workplace safety topics, anonymous survey and workplace violence in healthcare: 10 prevention steps.
Some AhaSlides course templates are written for specific laws. The California workplace violence prevention (SB 553) and New York retail worker safety act templates follow those state laws, so check whether they apply to your workplace before you use them. There is also a template for workplace violence prevention in healthcare.
Frequently asked questions
What are the warning signs of workplace violence?
Threats, aggressive or erratic behaviour, harassing or bullying, and unhealthy interest in weapons or fascination with past violence. CISA lists these among observable behaviours, and none of them proves intent on its own.
What should you do if you see warning signs at work?
Tell a supervisor, manager, HR or another designated person. If a threat appears imminent, call 911.
Is a bad day a warning sign?
No. CISA says people have bad days, and becoming sad, argumentative or angry does not mean there is intent to cause harm. Look for a pattern or a change in someone's normal behaviour.
Does OSHA have a workplace violence standard?
No. OSHA says there are currently no specific standards for workplace violence. It does say a well-written, well-implemented prevention programme, combined with engineering controls, administrative controls and training, can reduce the potential for violence. It also says workers should be trained on the signs of potential violent behaviour.
Where to start
Pick one set, run it as a 10-minute session and finish by showing everyone how to report. People who know the route are the ones who use it.
