Stalking Threat Assessment & Response Guide

A stalking threat assessment is a structured evaluation of a stalker’s behavior, escalation pattern, access to the target, and stated or implied intent, used to determine how dangerous the situation actually is and to build a matched safety, investigative, and legal response. It replaces guesswork and generic advice with a documented risk level and a specific plan of action, built by professionals who assess this pattern for a living rather than reacting to a single frightening incident in isolation.

Stalking is rarely a single event. It is a pattern — repeated, unwanted contact or surveillance that causes a reasonable person to fear for their safety — and that pattern almost always escalates before it resolves, whether toward disengagement or toward violence. Individuals, executives, and employers facing a stalking situation are frequently told to “just document everything” or “get a restraining order” without anyone actually evaluating how dangerous the specific person and the specific pattern are. A proper threat assessment closes that gap. It is written for the individual under threat, the corporate security or HR leader managing a workplace stalking case, and the family office or executive protection team responsible for a principal facing an obsessive or fixated pursuer.

What is a stalking threat assessment and who actually needs one?

A stalking threat assessment is a formal, evidence-based evaluation — not a hunch — of whether a specific stalker is likely to escalate to confrontation, property destruction, or violence, and what that escalation is likely to look like if it happens. It draws on the documented history of contacts and incidents, what is known about the stalker’s relationship (or lack of one) to the target, any prior history of violence or criminal conduct, and behavioral indicators that correlate with elevated risk in the published stalking and threat-assessment literature. It is warranted any time unwanted contact or surveillance has become a repeated pattern rather than a one-time event: an ex-partner who will not disengage, an obsessive admirer or fixated stranger, a disgruntled former employee or client, or an anonymous individual escalating from online contact toward real-world approach.

How do professionals actually gauge how dangerous a specific stalking situation is?

Risk is not measured by how frightening a single incident felt in the moment — it is measured by pattern, trajectory, and specific behavioral indicators that the threat-assessment field has correlated with escalation. The table below outlines the general risk tiers used in professional practice and the signals that move a case from one tier to the next.

Risk tier	Typical pattern	Escalation signal to watch for
Lower concern	Isolated unwanted contact, no direct threats, no known history of violence, target and stalker have no ongoing forced proximity	Any repeat contact after being told to stop is the first signal this tier will not hold
Elevated concern	Repeated contact across multiple channels (in person, phone, social media, third parties), attempts to learn the target’s schedule or location	Appearance at locations not publicly disclosed indicates active surveillance, not coincidence
High concern	Direct or implied threats, approach at the target’s home or workplace, prior history of violence or protective-order violations, or evidence of surveillance/tracking	Any acquisition of a weapon, or a violated protective order, is a critical trigger for immediate escalation of the response
Imminent danger	Explicit threat with means and opportunity, recent violent act, or a documented history of a rapid escalation trajectory in this specific case	Law enforcement and immediate protective measures are engaged without delay; this tier is not managed by documentation alone

No table substitutes for a case-specific evaluation. The same behavior can sit in a different tier depending on the stalker’s known history, access to the target, and whether prior warnings or protective orders have already been violated. That is why a professional assessment reviews the specific facts of the case rather than applying a checklist mechanically.

What should you do immediately if you believe you are being stalked?

Before a full professional assessment is even underway, there are concrete steps that measurably reduce risk and preserve the evidence a later investigation or prosecution will need.

1. Document every contact, immediately and consistently. Record the date, time, location, what happened, and any witnesses for every incident, no matter how minor it seems in isolation — the pattern is what matters, not any single event.
2. Preserve the original evidence, not just a description of it. Save messages, voicemails, emails, and social-media contact in their original, unaltered form; a screenshot without metadata is far weaker evidence than the preserved original.
3. Do not engage, and do not try to reason with the stalker. A clear, single “no contact” statement communicated once, ideally through counsel or law enforcement, is generally sufficient; repeated engagement after that point can reinforce the stalker’s fixation rather than resolve it.
4. Tighten your digital footprint. Review location-sharing settings, social-media privacy, and check personal devices for unauthorized tracking software or hardware trackers, which are increasingly common tools in stalking cases.
5. Notify the people around you. Employers, building security, close family, and, where relevant, your children’s school should have a description of the individual and a plan if that person appears.
6. Engage law enforcement and legal counsel early. A police report creates an official record even before a protective order is sought, and legal counsel can advise on the protective-order process specific to your jurisdiction.
7. Get a professional risk assessment before deciding your safety plan is “enough.” What feels like an adequate response to a frightening event is not the same as a response calibrated to the actual, evaluated risk level of the specific stalker.

How is an anonymous or unidentified stalker actually identified?

When the stalker is unknown, anonymous, or hiding behind fabricated accounts and burner numbers, identification becomes a digital investigation problem before it can become a legal or protective one. Honeybadger Solutions handles this identification work in-house and nationwide: open-source intelligence (OSINT) to connect anonymous accounts and communication patterns to a real identity, digital forensics on devices the target controls to detect stalkerware or unauthorized tracking software, and analysis of the communication trail itself — message metadata, calling patterns, and technical artifacts — to build an evidentiary chain that connects an anonymous contact to a specific person. This work follows documented chain-of-custody procedures from the first step, because evidence collected informally, without proper handling, is frequently the reason a strong case does not hold up in front of a prosecutor or a judge later.

When does a stalking case require physical security or executive protection?

A threat assessment that places a case in the high-concern or imminent-danger tier — direct threats, documented surveillance, a violated protective order, or a stalker with a known history of violence — is the point at which physical protective measures become appropriate alongside the legal and investigative response. That can mean residential and workplace security assessments, close protection during a defined period of elevated risk, or a security detail for an executive, public figure, or private client whose visibility makes them a specific and identifiable target. Within Arizona, this physical protective capability is delivered by Honeybadger Solutions’ own in-house, AZ-licensed close-protection and security personnel. Outside Arizona, protective operations are delivered through a commanded, vetted-partner network of licensed providers, directed from Arizona command, so a principal traveling or relocating during an active threat period is covered under one consistent standard rather than a patchwork of unfamiliar local vendors.

A parallel technical concern in high-concern cases is whether the stalker has planted a covert listening device, GPS tracker, or hidden camera at a residence, vehicle, or office. A technical surveillance countermeasures (TSCM) sweep, conducted by trained personnel with the proper detection equipment, is the only reliable way to confirm or rule that out — a visual search alone routinely misses professionally concealed devices.

What is the role of law enforcement and protective orders?

Law enforcement and the courts are central to a stalking response, and a professional threat assessment is built to support that process rather than substitute for it. A documented incident history, professionally organized evidence, and a formal risk assessment give a police detective and a prosecutor a stronger case to act on than a fragmented set of screenshots and a verbal account. Protective orders, criminal stalking charges, and civil remedies each carry different requirements and different timelines depending on the jurisdiction, and the specific legal strategy — including whether and when to pursue a protective order — is a decision that should be made with a licensed attorney. This article is educational and does not constitute legal advice; anyone facing a stalking situation should consult qualified counsel about the options available in their jurisdiction.

How should a workplace handle an employee who is being stalked, or a stalker who is an employee?

Workplace stalking cases cut two ways, and both require a formal response rather than an informal, ad hoc one. When an employee is being stalked, whether by a current or former partner, a client, or a stranger, the employer has a direct interest in the safety of everyone on-site: the response should include a documented description and photo of the individual shared with front-desk and security staff, a plan for what happens if the person appears on the property, and coordination between HR, security, and the affected employee rather than leaving the employee to manage building access alone. When the stalker is a current or former employee, the case intersects with insider-threat and workplace-violence-prevention protocols: a documented risk assessment, coordination with legal counsel on any separation or disciplinary action, and, in higher-risk cases, security presence during a termination or other high-tension interaction.

How do you build the evidence file that holds up for prosecution or court?

An evidence file that has actually been professionally assembled looks fundamentally different from a folder of screenshots. It is organized chronologically, every item is preserved in its original form with metadata intact rather than only a photograph of a screen, a documented chain of custody exists for every piece of digital evidence from the moment it was collected, and any device forensics performed follow procedures that will hold up to challenge in court. This is precisely where cases most often break down when handled without professional support: a screenshot with no verifiable source, a device examined informally before forensic imaging, or a gap in the incident timeline that a defense attorney can use to cast doubt on the whole pattern. Building the file correctly from the first documented incident is far more effective than trying to reconstruct one after the fact.

Frequently asked questions

How is a stalking threat assessment different from just filing a police report?

A police report documents an incident for the official record. A threat assessment is a broader evaluation of the stalker’s overall pattern, escalation risk, and likely trajectory, used to build a matched safety, investigative, and legal plan. The two support each other: a strong police report feeds into the assessment, and a formal assessment gives law enforcement and prosecutors a clearer picture of the risk than an isolated incident report alone.

Can a stalker be identified if they use an anonymous account or a burner phone?

Frequently, yes. Digital forensics and open-source intelligence techniques can connect anonymous accounts, spoofed numbers, and burner devices to a real identity through communication patterns, metadata, and technical artifacts left behind even when a stalker believes they are untraceable. This work should be handled by professionals following documented chain-of-custody procedures so the evidence remains usable in a criminal or civil case.

When should I get an executive protection detail instead of just a protective order?

A protective order is a legal instrument; it does not physically prevent a determined individual from approaching. A physical protective detail becomes appropriate when a professional threat assessment places the case in a high-concern or imminent-danger tier, such as a stalker with a documented history of violence, a violated protective order, or evidence of active surveillance of the target’s home or workplace.

Should I confront the stalker or try to talk to them directly?

Generally, no. Repeated engagement, even in an attempt to reason with the stalker or ask them to stop, can reinforce a fixation rather than end it. Professional guidance typically favors a single, clear no-contact communication delivered through law enforcement or counsel, followed by strict non-engagement and reliance on the documented plan built through the threat assessment.