Every act of prevention begins with a choice. Leaders set the stage for what choice is made.
What Is an Upstander?
An upstander is someone who takes action when they see warning signs of violence, before harm occurs.
In a workplace, this could mean:
- Reporting a threatening comment
- Alerting HR to escalating behavior
- Documenting troubling patterns
- Supporting a targeted colleague
Bystanders freeze.
Upstanders act.
And what enables that? Culture
Barriers to Action
FBI data shows in 83% of active shooter incidents, someone observed warning behaviors beforehand. In 54% of those cases, they did nothing. A coworker saw the anger escalate. Someone heard the threat, read the disturbing message, or noticed the fixation, but stayed silent.
Maybe they:
- didn’t want to get involved
- didn’t want to get it wrong
- weren’t sure what they saw or heard
- assumed someone else would handle it
Or did they think they:
- wouldn’t be taken seriously
- would be punished for speaking up
- would face retaliation
- would make things worse
Your Organizational Culture Drives the Choice
Clear signs – Critical response.
Violent actors don’t just snap. They leak. You already know the pattern: verbal threats, disturbing posts, fixation on violence, grievance-fueled statements. Leakage isn’t rare. It’s routine. The problem isn’t recognition. It’s follow-through. People see the signs. What they don’t always see is a system that backs them when they speak up. The real question isn’t whether someone notices. It’s whether the environment gives them permission to act on what they see.
The difference between a bystander and an upstander isn’t awareness. It’s action. That action doesn’t just depend on personal courage. It depends on culture.
Organizations often overestimate their preparedness, and underestimate the power of the environment they create. Policies, training, and compliance frameworks are essential, but they’re just scaffolding. Behavior is shaped by belief. If employees believe their concerns will be heard, protected, and acted on, they’re more likely to report. If they’ve seen complaints ignored, mishandled, or punished, silence becomes the default. Upstanders don’t emerge in isolation. They are enabled, or suppressed, by the system around them.
Prevented before it started: what early action looks like
Long Beach, California (2019):
A hotel kitchen employee, upset over workplace grievances, confided in a coworker that he planned to “shoot up” the property. The coworker didn’t rationalize or delay. He reported it. Management called police. A search of the suspect’s home uncovered several rifles, high-capacity magazines, body armor, and detailed plans to attack.
Law enforcement credited the employee’s report with preventing a mass shooting.
San Jose, California (2022):
A recently terminated construction worker began stalking former coworkers, sending threatening emails, posting photos of himself with firearms, and referencing their home addresses. Leadership recognized the pattern, acted quickly, and contacted law enforcement. Officers obtained a gun violence restraining order and seized nine firearms.
The local police chief was blunt: lives were likely saved because the employer took the threat seriously.
In both cases, what made the difference wasn’t just that someone saw the warning signs. It was that they spoke up, and the organization responded.
Culture didn’t just encourage intervention. It demanded it.
Stopping the threat: upstanders in action
When violence erupts, their split-second decisions save lives.
Riviera Beach, Florida (2025): A patient at a VA medical center opened fire in the emergency department, shooting a physician and grazing another person. Amid the chaos, one doctor made a split-second decision to act. Unarmed, he tackled the gunman and struggled for control of the weapon, taking a round to the neck during the fight. With help from another staff member, he disarmed the shooter and prevented additional casualties. The FBI and medical staff later credited him with saving lives.
New Albany, Ohio (2025): During a night shift at a cosmetics factory, a worker began firing at colleagues without warning. One employee, rather than running, confronted the shooter and wrestled away the firearm. He was shot but successfully disarmed the attacker.
Two people were killed before the intervention, but police and witnesses were clear: without that employee’s actions, the toll would have been far worse.
In both cases, the upstanders weren’t armed or trained. They didn’t have special roles or authority. They acted because they believed it mattered, and because the culture, shaped by leadership, made it clear that speaking up, stepping in, and taking action weren’t just options. That was the expectation.
From insight to action: next steps for leaders
HR and security leaders must move past passive awareness campaigns and reliance on binders full of policies. A true upstander culture doesn’t emerge from posters on a wall. It’s built through deliberate action that reshapes the environment where employees work, speak, and decide whether to stay silent—or step up.
To instill such a culture, leaders must address the very conditions that influence behavior. That means removing fear, adding trust, and proving that speaking up leads to meaningful follow-through. Here’s what that looks like in practice:
- Hardwire psychological safety into daily operations. Employees need to know they won’t be punished, ignored, or labeled a troublemaker for raising a concern. This goes beyond policy language. It requires consistent behavior from supervisors and managers who respond without hesitation, reluctance, defensiveness or retaliation. Leaders must show, through actions, that reporting is welcomed—not risky.
- Design reporting pathways that work in real life. A hotline buried in an intranet page isn’t enough. Employees should have multiple ways to report, including anonymous options and direct, low-barrier channels to HR, security, or leadership. Every report must be acknowledged and addressed. When people see their concerns lead to action, trust grows.
- Train with purpose, not just for compliance. Upstander behavior doesn’t happen automatically. Employees hesitate because they don’t know what’s reportable or what will happen if they speak up. Realistic and practical bystander intervention and threat awareness training remove that uncertainty. Training should focus on real scenarios, show exactly how to act, and reinforce that you don’t need absolute certainty to raise a concern.
- Model and reward the behavior you want. When managers and executives take concerns seriously and intervene early, it sends a powerful cultural signal. Recognition matters. Share stories (even anonymized) of employees who prevented harm. Celebrate—not just quietly tolerate—the people who speak up.
- Close the loop every time. Silence breeds silence. If someone reports a threat and never hears what happened next, they’re less likely to speak up again. Even if details can’t be shared, let employees know their concerns were taken seriously and addressed. Transparency builds trust, confidence, and momentum.
- Integrate support, not just enforcement. A culture of early reporting is not only about catching “bad actors.” It’s also about connecting people in crisis with help before they spiral. When employees see that the organization responds with fairness, support, and care, not just punishment, they’re more likely to report earlier and more often.
Culture is your first line of defense
In every case we described, whether the violence was prevented or interrupted, someone saw something. Someone acted.
The organizations that succeed at preventing violence don’t just tell employees to “see something, say something.” They build a workplace where saying something feels safe, expected, and backed by real action. Culture, not policy alone, is what drives intervention before the tragedy.
Even organizations with well-established threat assessment and management programs cannot afford to neglect culture. Policies, teams, and protocols matter, but they only work when employees trust the system enough to use it.
Culture is what makes early reporting possible, intervention credible, and prevention sustainable.
That means continually reinforcing the basics: encourage reporting at the first sign of concern, respond with timely and trustworthy follow up, and show employees, through both words and actions, that their concerns are valued and acted upon. Strengthen your threat assessment process with consistent communication, cross-functional collaboration, and a multidisciplinary approach to early identification, intervention, and mitigation.
You cannot train your way out of silence. You have to build a culture that makes silence the exception.
If you want more upstanders, create a workplace that makes it safe, and expected, to speak up. Because when that moment comes, it will not be your policy binder that intervenes. It will be a person, and what they do will depend entirely on the culture you have built around them.
