Ask an untrained observer to spot a threat in a crowd and they will look for something that matches a mental image of danger: a scowl, a hood pulled low, someone moving fast. Trained security professionals look for something almost the opposite: they look for whatever is different from everyone else around it. The single most important concept in behavioural threat detection is not a checklist of suspicious traits. It is baseline and deviation, a methodology built on establishing what normal behaviour looks like in a specific environment, then noticing who departs from it.

What baseline and deviation actually means

The approach is drawn directly from behavioural analysis techniques used by the FBI and described extensively by former Special Agent Joe Navarro in his work on non-verbal behaviour. A baseline is the range of ordinary behaviour that a given environment produces: how people stand, how fast they move, where they look, how they interact with staff and with each other, under normal conditions. Once a security professional has internalised that baseline for a specific venue, at a specific time, deviation becomes visible almost automatically. A person is not suspicious because they are nervous in the abstract. They are worth attention because they are more nervous, more still, more watchful, or more evasive than everyone else in that same environment at that same moment.

This distinction matters because context changes what counts as normal. Rapid scanning of exits is unremarkable in a passenger at an airport gate and worth noting in a spectator at a concert who has already found a seat. A raised heart rate and shallow breathing are expected in someone jogging to catch a train and out of place in someone standing still at a ticket barrier. Baseline and deviation forces the observer to calibrate to the actual environment rather than apply a generic profile that produces both false alarms and missed signals.

Establishing a baseline in a live venue

For venue and event security, baseline establishment happens continuously and largely through pattern recognition built over repeated shifts in the same or similar spaces. Several dimensions matter most.

• Movement tempo: Most attendees at an event move with a recognisable rhythm tied to the activity, arriving in bursts around doors opening, slowing near points of interest, moving with purpose toward seating or facilities. A person moving significantly slower or faster than the surrounding tempo, without an obvious reason such as carrying luggage or shepherding children, stands out once the baseline tempo is established.
• Gaze behaviour: Ordinary attendees look at the stage, the exhibits, their companions, or their phones. Their gaze pattern is engaged with the event itself. A person whose gaze is disproportionately directed at security personnel, camera positions, entry and exit points, or barrier lines, rather than the event, is exhibiting a deviation worth tracking, particularly if it is sustained rather than a brief, natural glance.
• Interaction with the environment: Most people in a crowd interact naturally with their surroundings: they lean on rails, chat with neighbours, adjust position for a better view. A person who remains rigidly still, avoids contact with surfaces or other people, or maintains an unusual amount of personal space in a dense crowd is deviating from the tactile, socially engaged baseline of the environment.
• Clothing and load-bearing behaviour: This is not about profiling based on appearance, which the baseline-and-deviation method explicitly rejects. It is about how a person carries themselves relative to what they are wearing or carrying. Someone dressed for the weather but sweating heavily, or someone whose gait suggests they are compensating for unexpected weight or bulk under clothing, is a physical deviation independent of what they look like demographically.

Why this method outperforms profile-based screening

Profile-based approaches, which flag individuals based on demographic or appearance-based traits, are both operationally weak and legally and ethically problematic. They produce high false-positive rates, since the traits used are common among harmless attendees, and they are trivially evaded by anyone with intent to cause harm and enough awareness to blend in visually. Baseline and deviation is behaviourally grounded rather than trait-grounded, which makes it both more accurate and defensible: the observation being flagged is a specific, describable behavioural deviation from a specific, observable local norm, not an inference drawn from someone's appearance.

This also connects to the broader distinction covered in Non-Verbal Communication Is Not Mind Reading: reading deviation from baseline tells a security officer where to direct further attention, not what a person is thinking or planning. It is the first stage of a screening process, not a verdict.

From detection to response: what security teams do with a deviation

Identifying a deviation is only useful if it triggers a proportionate, structured next step. Effective security operations train staff on a graduated response rather than a binary alert-or-ignore decision.

• Increased observation: The lowest-tier response is simply continuing to watch the individual for a longer window, looking for a cluster of additional deviations rather than acting on a single signal, which is rarely sufficient on its own.
• Approach and engagement: A brief, low-pressure interaction, such as a friendly check or a request to see a ticket, often resolves ambiguity quickly. Genuine deviation frequently has an innocent explanation that becomes clear the moment a person is engaged directly, and the interaction itself can be read for further congruence or incongruence between verbal and non-verbal responses, a principle explored in our guide to reading deception in real time.
• Escalation to a supervisor or law enforcement liaison: Reserved for clusters of high-confidence deviations, particularly those involving proxemic behaviour around sensitive infrastructure, sustained surveillance-pattern gaze behaviour, or physical indicators consistent with concealed items.

Training the skill: why this cannot be taught from a slide deck

Baseline and deviation is fundamentally a perceptual skill built through exposure, not a rule that can be memorised. Security professionals develop reliable baselines by working the same or similar environments repeatedly and receiving structured feedback on what they noticed and what they missed. Effective training programmes combine classroom grounding in the underlying research with supervised floor time in live or simulated environments, where trainees practise articulating what baseline behaviour looks like in that specific space before being asked to identify deviations from it. This mirrors the same de-escalation groundwork covered in Calm Is Contagious, where the underlying skill is also a matter of calibrated observation under real operational pressure rather than an abstract awareness exercise.

The Bottom Line

Effective venue and event security does not depend on spotting people who look dangerous. It depends on knowing, in granular and current detail, what normal looks like in a specific environment, and training staff to notice departures from that norm regardless of who is producing them. Baseline and deviation is more accurate than profile-based screening, more defensible operationally and ethically, and, critically, trainable at scale across a security team.

Related reading

• Calm Is Contagious: Non-Verbal De-escalation for Frontline Security Teams
• Reading Deception in Real Time: A Field Guide for Security Professionals
• Behavioural Profiling at the Gate: What Airport Security Can Learn from FBI Interview Techniques

Security teams building this capability across venue and event operations can start with behavioural detection training for security teams, or individual security professionals can explore online courses in reading facial expressions.