If Three Minor Events Are Classified Differently, Who Notices When They Belong Together?

Security operations teams classify incidents so they can count them. That is a legitimate need, but a taxonomy built for reporting does a different job from one built for detection. When a trespass, a suspicious person report, and an access violation are each closed correctly under their own category, nothing in most systems prompts anyone to ask whether they involve the same person. The fix is not to abandon classification. It is to make incidents searchable by the people, vehicles, places, and behaviors involved, so the comparison can be made routinely rather than by chance.

This article explains why reporting taxonomies hide patterns, what major post-incident reviews have found about scattered information, and what a better standard looks like.

Three incidents, three categories, no connection

Consider a hypothetical sequence. On a Tuesday morning, an officer at a distribution center finds a former contractor in the employee parking lot after his badge has been deactivated. He says he is picking up a jacket and leaves. The analyst closes it as Trespass, Resolved. Eleven days later, at a corporate office nearby, a receptionist reports a man loitering near the loading dock and asking an employee about a former colleague’s schedule. A different analyst logs it as Suspicious Person, Unable to Locate. Three weeks after that, a store manager reports someone tailgating through a back entrance. A third analyst closes it as Access Control Violation, Referred to HR.

Each ticket is minor and correctly closed. Read together, they could describe one person escalating in access and intent over a month. Nobody read them together, because the system routed each to its own category and closure code.

Reporting taxonomies do a different job

Incident categories exist to serve reporting: monthly statistics for leadership or clients, insurance and liability records, benchmarking, and staffing decisions. Counting requires one label per incident, in buckets that do not overlap.

That same design works against pattern discovery. The analyst picks one category from a dropdown. Detail that does not fit, such as the questions about a former colleague, the specific badge number, or the vehicle, ends up in a free-text narrative that nobody queries later, or is never recorded at all. At shift change, what carries forward is the classification and the closure note, not the observations behind them.

Most incident systems also make it hard to ask a cross-category question: show me every incident in the last 90 days, whatever its classification, involving this person, vehicle, badge, or location. If the data is organized by category first and entity second, that comparison depends on someone thinking to ask it and then doing it by hand.

What post-incident reviews have found

Major reviews of targeted violence have repeatedly found information that existed in pieces across different offices.

The panel that reviewed the April 2007 shootings at Virginia Tech, in which 32 students and faculty were killed, found that during the shooter’s junior year “numerous incidents occurred that were clear warnings of mental instability.” Its summary continued: “Although various individuals and departments within the university knew about each of these incidents, the university did not intervene effectively. No one knew all the information and no one connected all the dots.”¹

The U.S. Secret Service’s National Threat Assessment Center reached a related conclusion in its review of 27 mass attacks in public spaces during 2018. Whether an attack was later described as workplace, domestic, school-based, or ideologically inspired, the Secret Service reported that “similar themes were observed in the behaviors and circumstances of the perpetrators.”² The category assigned afterward is useful for statistics, but on the Secret Service’s account it says little about the warning behaviors that came before.

After the May 2019 shooting at the Virginia Beach Municipal Center, the independent review by Hillard Heintze found no clear motive, and the lead investigator said the probe did not find any clear signs that might have served as a warning to city officials.³ It did make a structural recommendation relevant here: that the city create a centralized database of employee performance and workplace issues.⁴ As The Virginian-Pilot later reported, “At the time of the 5/31 shooting, Virginia Beach didn’t have a centralized system for tracking employee complaints.” The city launched an online reporting system in 2021 to track potential workplace violence and complaint investigations.⁵

These cases are far more serious than the minor incidents most security teams handle every day, and none of them shows that a different system would have prevented an attack. They are included for a narrower reason. Each review found that relevant information was held in separate places, and that no structure existed to bring it together.

Research on behavioral crime linkage, the practice of judging whether separate offenses were committed by the same person from how they were carried out, shows that this kind of comparison can be done systematically. A 2024 review by Amy Burrell, Benjamin Costello, and Jessica Woodhams in Aggression and Violent Behavior examined 77 studies of linkage methods.⁶ The point for security operations is simple: linking events by behavior is a recognized analytical discipline, not guesswork, but it requires the behavioral detail to be recorded and searchable in the first place.

Is the taxonomy working against the mission?

The uncomfortable part is that the taxonomy in question is not broken by any normal measure. It closes tickets, produces clean reports, and satisfies auditors. The question is whether a system optimized for those purposes also makes it harder to notice an emerging threat before it escalates.

If three minor incidents in different categories are never compared, they are not being ruled unrelated after review. They are simply never examined together. That is a design problem, not an analyst’s failure.

Search by entity and behavior, not only category

A higher standard keeps classification for reporting and adds the ability to examine incidents by the people, vehicles, locations, and behaviors involved. That means capturing those details as structured data when the incident is recorded, and giving analysts one place to search across the trespass, suspicious person, and access control logs at the same time.

Hubstream’s incident and investigation management solution is designed to work across categories in this way. It records people, vehicles, and locations as linked entities and surfaces incidents that share them for an analyst to review, whatever their classification. Whether three minor events add up to a pattern, and what to do about it, remains a decision for the analyst and the threat management team. The software’s job is to make sure the comparison is possible.

Practical takeaway

Run one cross-category check this quarter. Take the last 90 days of closed trespass, suspicious person, and access control incidents and look for shared names, badge numbers, vehicles, and locations. Whatever you find, note how long it took and which details were missing because they lived only in free text. That gap tells you which fields to add to your intake forms and which comparison to make routine.