Behavioural Detection: Cost of Missed Cues

As threats evolve and blend into everyday settings, spotting danger before it unfolds has become essential. Today’s security professionals aren’t just expected to respond, they’re expected to anticipate, identify, and intervene before an incident even begins.

This proactive approach to threat management relies on one critical skill: the ability to recognise behaviour that doesn’t fit.Behavioural detection, rooted in behavioural science, provides a structured way to assess whether someone’s actions signal a deeper intent,not through bias or appearance, but through subtle, observable cues.

When used effectively, it becomes one of the most powerful tools in any protective strategy. But when it’s ignored, misunderstood, or underutilised, the consequences can be catastrophic.

In this post, we’re unpacking the power of behavioural detection, a skillset that, had it been used properly, might have changed the outcome of one of the UK’s deadliest terror attacks: the Manchester Arena bombing in 2017. More than just a story, this is an analysis of what went wrong and what security professionals, frontline staff, and businesses everywhere can learn from it.

The Role of Risk and What Is Behavioural Detection?

Behavioural detection is the practice of identifying potential threats by observing how people behave, not what they look like. It focuses on actions, not assumptions. And it’s rooted in behavioural science, not hunches.

You’re not looking for someone who looks dangerous. You’re looking for someone who’s out of place. Someone who doesn’t match the context. Someone whose body language, pacing, eye contact, or clothing signals discomfort, deception, or a deeper intent.

At Futurum Risk, we utilise a structured methodology known as OATEER to train individuals in behavioural detection. This model provides a comprehensive framework for identifying and addressing potential threats before they escalate.

• Observe your environment with intent and purpose
• Assess behaviours objectively and without bias
• Target individuals who display unusual or high-risk patterns
• Engage safely, calmly, and intentionally
• Elicit verbal and non-verbal responses that help confirm intent
• Respond with the correct level of intervention

What Went Wrong at Manchester Arena

On 22 May 2017, a suicide bomber detonated an explosive device in the foyer of Manchester Arena, just after an Ariana Grande concert. He killed 22 people and injured more than a thousand others.

The attacker, Salman Abedi, was not unknown. In fact, he was spotted by security and members of the public multiple times on the night displaying behaviours that should have raised alarm bells.

Let’s break it down through the OATEER lens.

1. Observe
   

   Abedi spent nearly an hour lurking in a blind spot near the venue. He entered and exited the area repeatedly. He was alone, not meeting anyone, not attending the concert. He wore a heavy jacket in warm weather. He had a bulky, heavy backpack, visibly weighing him down. He kept his head down. He looked nervous.

   This wasn’t subtle. But no one put it together.

2. Assess
   

   This is where training makes all the difference. A trained eye would’ve asked:

   • Does he match the concert audience?
   • Why is he circling back to the same area repeatedly?
   • What’s with the oversized bag and the heavy clothing?It’s about matching behaviour to context and when there’s a mismatch, treating it seriously.
3. Target
   

   He was seen by several security stewards, and even flagged by a member of the public who said he looked “dodgy.” But no action was taken. One staff member admitted they were “scared of being wrong.”

   At this stage, a trained person should have zeroed in on him, kept visual contact, updated a supervisor, and prepared to escalate if needed.

4. Engage and Elicit
   

   Engagement doesn’t have to be aggressive. It can be as simple as a friendly question: “Hi, are you waiting for someone?” The goal is to make the person speak, move, and react.

   Abedi was approached once. Witnesses said he looked panicked and became more nervous. That’s the moment someone trained in behavioural detection knows it’s time to dig deeper or call for backup.

5. Respond
   

   Tragically, there was no meaningful response. No intervention. No law enforcement contact. Despite everything, he was allowed to stay. At 22:31, he detonated his device.

The Inquiry: Findings and Failures

The official public inquiry into the Manchester Arena bombing revealed a series of systemic and individual failures that ultimately contributed to the devastating outcome. Importantly, the breakdown wasn’t due to a lack of physical security infrastructure, it was a failure to recognise and act on behavioural cues.

Key findings included:

• The bomber, Salman Abedi, was observed on at least three occasions by security staff and stewards during the evening yet none of these sightings triggered formal escalation or intervention.
• Two separate members of the public raised concerns about Abedi’s appearance and behaviour. One even directly confronted him, suspecting he may be hiding something dangerous. These concerns were either dismissed or inadequately followed up.
• No official action was taken. Despite multiple opportunities to question, isolate, or disrupt Abedi, security teams failed to follow through, largely because they did not recognise his behaviour as suspicious or did not feel empowered to act.
• Security staff admitted they lacked both training and confidence. One member of the team said they were unsure whether they had the authority to engage Abedi, revealing a dangerous uncertainty in the chain of command.
• CCTV blind spots were a known vulnerability. These areas, including where Abedi hid for nearly an hour, had not been proactively monitored or covered by patrols. No additional human surveillance was deployed to compensate for those weaknesses.

What the inquiry made painfully clear was that technology did not fail, people did. And not for lack of care, but for lack of preparation. The report described the situation as one of “significant missed opportunities” all of which could have been avoided through better behavioural awareness and structured response training.

Why Behavioural Detection Works

Behavioural detection isn’t a new concept, it’s been quietly forming the backbone of elite security programmes for decades. What’s surprising is just how underused it remains outside of those specialist environments. Too often, organisations rely on physical security or technology alone, assuming that cameras and barriers will do the job. But as we’ve seen, whether in airports, public spaces, or private venues, technology doesn’t interpret intent. People do.

When applied correctly, behavioural detection delivers proven, measurable results:

• In the United States, the TSA’s Behaviour Detection Officers have referred over 100,000 individuals for secondary screening since the programme’s inception, many based purely on behavioural indicators before any physical threat was visible.
• In Israel, a country long recognised for its proactive security stance, up to 98% of passenger screening relies on behavioural assessment rather than traditional scanning technologies. The focus is on identifying intent before action.
• A 2024 study published in Security Journal found that trained behavioural observers were up to 70% more accurate in identifying suspicious intent than untrained counterparts. Training significantly reduced missed threats and improved pre-incident intervention rates.

Most incidents that make headlines follow a familiar postmortem: “He looked out of place,” “She was acting strangely,” “We thought something wasn’t right.” Yet, in the absence of structured training, these instincts aren’t acted on, either because they’re dismissed, misunderstood, or not backed by institutional authority.

Futurum Risk: Bringing Behavioural Science Into Practice

At Futurum Risk, we believe that security professionals at every level, from CCTV operators to executive teams, should have access to the same behavioural science principles used by elite agencies. That’s why we offer specialist behavioural detection training programmes, built on real-world application and adapted to a variety of operational contexts.

Our courses are based on the OATEER model, which gives teams a clear, structured way to observe, assess, and act on behavioural cues. From recognising micro-signals of distress or deception, to confidently escalating potential threats, our approach empowers staff to act decisively and proportionately.

These courses are led by Futurum Risks Managing Director James Ellender, an expert trained in behavioural science and threat recognition, with experience working alongside law enforcement, private security, and strategic risk advisory roles. His deep understanding of both the psychology and practical application of behavioural detection means our training isn’t theoretical, it’s immediately actionable.

Why Behavioural Detection Matters

Modern threats don’t always rely on advanced tools or covert methods. Often, they exploit something far simpler, human inattention. In high-pressure environments, even trained personnel default to routine if they don’t have a structured behavioural framework to guide decision-making.

Behavioural detection fills that gap. It allows frontline teams to assess anomalies with clarity, not instinct. And crucially, it gives them the confidence to act early before a situation escalates into crisis.

This isn’t just for law enforcement or high-risk sites. Anyone tasked with public safety, operational oversight, or personnel management needs this training , from security teams and CCTV operators to legal professionals, corporate leaders and frontline staff.

When applied properly, it enhances both safety and performance.

At Futurum Risk, our behavioural detection training is built on global best practices and taught by specialists with real-world experience. Our Managing Director, trained in behavioural science, leads our programmes with a focus on practical application and confident, structured decision-making.

Because ultimately, it’s not just about noticing something.

It’s about knowing what to do next and having the training to follow through.