In threat assessment, what is "leaking behavior"?

"Leaking" is when a person who is moving toward violence reveals their intentions beforehand — through statements, behavior changes, or online activity — often without realizing it.

The concept matters because it's the basis for early warning: if attackers "leak" warning signs, the theory goes, those signs can be detected and acted on in advance.

The catch the research reveals:

• ~71% of leaking happens offline (conversations, behavioral changes noticed by family/friends, physical activities) and only ~29% online.
• So monitoring social media catches less than a third of leaking — it is necessary but not sufficient.

Why this is counter-intuitive: people assume the internet is where warning signs appear, but most still surface in the physical world among people who know the person. This is a core argument for fusing SOCMINT with traditional HUMINT and community-level awareness rather than relying on online monitoring alone.

Tip: Don't confuse leaking with a threat — leaking is the unintentional signaling of intent, which is exactly why it's a useful (if incomplete) detection opportunity.