Identity Can Wait. Safety Can’t. CTAP-25 + TIPS® Change the Equation
Share Post
This article was originally published in the Theseus Fixated Risk Management Bulletin: Issue 2026.
When an anonymous threat surfaces, can your team move forward with confidence, or are you forced to wait for identity first?
Michael Rozin, a certified Threat Manager (CTM®), is the founding partner and president of Rozin Security and Rozin Technologies, international firms specializing in proactive security risk management, behavioural threat assessment, and counter-terrorism preparedness. With nearly 25 years of experience in security and protective operations, he has worked across both public and private sectors to develop innovative threat-detection and risk-mitigation strategies.
This article highlights how the TIPS® (Threat Information Protection System) case management platform serves as the central hub for evaluating, organizing, and managing concerning communications from the moment they surface. Through its integration with CTAP-25, TIPS enables structured, content-based risk assessment even before a subject’s identity is known – ensuring that early signals are captured, interpreted, and advanced through a coordinated, defensible management process. We’ll cover:
- Identity-Independent Assessment – Why confirmation of a subject’s identity is not required to begin evaluating fixated risk.
- Content-Driven Risk Indicators – How CTAP-25 analyzes language, tone, fixation, and escalation to determine threat level.
- Workflow Integration with TIPS® – How pairing CTAP-25 with TIPS creates an end-to-end process from initial message to triage to comprehensive investigation.
- Application in Practice – A real-world example illustrating how early, content-first screening accelerates detection and prevents critical signals from being overlooked.
In this day and age, when individuals or organizations are dealing with fixation, they are initially alerted with some form of communication – a threatening email, a suspicious text, a stream of angry comments. The challenge is that anonymity is easier than ever to maintain.
As a result, many teams feel stuck until they can identify the person behind the message, because most structured professional judgment (SPJ) tools require background details, such as the complete name of the subject, past behavior, and location.
But in real-world scenarios – especially those originating online – this information is often unavailable. And delays can aggravate risk, in that grievance- and fixation-driven behaviours often escalate through communication long before the individual is identified. Waiting for confirmation of identity before assessing risk can mean reacting too late.
CTAP-25 + TIPS®: Bringing Content-Based Threat Assessment and Case Management Together
CTAP-25 is an evidence-based, reliable, and defensible structured professional judgment (SPJ) tool designed for the initial assessment of concerning communications. Its core strength lies in evaluating what is communicated – rather than who communicated it. This content-first approach enables threat teams to act earlier and with more structure, even when identity, history, or contextual details are incomplete or unknown.
Once a case is screened and triaged, organizations still need to document the incident, track ongoing behavior, correlate new information, and coordinate response across security, HR, legal, communications, and leadership.
This is where integration with Rozin Technologies’ TIPS® Case Management Platform becomes essential.
While CTAP-25 provides a rapid, content-driven evaluation model, TIPS supplies the operational backbone that carries a case forward, centralizing evidence, communications, and behavioral patterns over time, and ensuring decision-makers stay aligned throughout the lifecycle of the case.
Without TIPS, threats are likely to be managed in isolation and patterns or anomalies are often overlooked. Together, CTAP-25 and TIPS create a seamless, end-to-end workflow.
What is TIPS®? TIPS® (Threat Information Protection System) is a purpose-built, centralized threat assessment and case management platform – designed by threat managers for threat managers – to streamline reporting, evaluation, and targeted violence prevention. Its interface is engineered around natural cognitive processes: threat managers do not need to switch between screens, hunt through folders, or piece together information from disparate systems. All critical data, signals, and case activity are available at a glance in a single, cohesive workspace, reducing distraction and supporting clear, accurate decision-making.
With the newly announced partnership between CTAP-25 and TIPS,® organizations can now apply CTAP-25 directly within existing case workflows. Assessors can screen emails, social media posts, voicemails, web submissions, and
even anonymous communications using a structured, repeatable process that: works with or without subject identity; scales across single incidents or long-term fixation cases, and functions reliably even during staff turnover or handoff.
From First Message to Full Case: CTAP-25 + TIPS in Practice
Imagine an organization begins receiving increasingly hostile social media posts from someone calling himself “Mr. Z.” No verified name, no address, no known affiliation—just escalating language and growing fixation.
Step 1: Quick Correspondence Screen (QCS)
The public-facing team (PR, HR, customer care, or executive assistants, for example) uses CTAP’s Quick Correspondence Screen (QCS), available via TIPS’ intuitive intake forms, to flag risk indicators based solely on the content of the messages. The QCS is intentionally simple and requires minimal training, allowing non-security staff to quickly surface concerning communications.
The posts exhibit multiple potential risk factors (a threat; grievance and increasing anger; large numbers of communication; prolific messaging and references to violence and violent imagery) so are immediately escalated to the security team for a full CTAP-25 assessment.
Step 2: Case Escalation and Identity Development in TIPS
Once the case is opened in TIPS, the security team conducts a structured CTAP-25 assessment using its 25 defined risk factors to establish priority and determine whether further action is required. Simultaneously, TIPS’ advanced
link-analysis engine begins correlating the submission against historical data. Within seconds, the system identifies more than a dozen prior cases involving the same author, Mr. Z, automatically surfacing patterns of fixation and escalation that would otherwise remain hidden.
With all related communications aggregated in one place, analysts can monitor behavior over time, advance identity development, and coordinate a unified response with HR, legal, and leadership.
Step 3: Building an Investigation
Without TIPS, related communications might remain scattered across inboxes and teams. With TIPS they link automatically, whether a hostile email sent several months prior, a voicemail on Wednesday or new social post on Friday.
After triage, analysts can leverage the fully integrated Thomson Reuters CLEAR product within TIPS to enrich the case with real-world intelligence, including possible identity, location, past incidents, criminal history, known associates, and proximity to potential targets. Because CLEAR is embedded directly into the TIPS workflow, analysts
can run searches, review findings, and add relevant data to the case without ever leaving the platform.
A previously anonymous profile becomes a structured, risk-qualified case—with early warning signs documented, links established, and a coordinated response underway.
The integration of CTAP-25 and TIPS® closes a long-standing gap in managing fixated and anonymous
threats: the ability to evaluate risk immediately based on what is communicated while simultaneously building a structured, evidence-driven case around the actor as new information emerges.
CTAP-25 delivers rapid, defensible, content-based triage at the earliest stage, often before identity, history, or context are known. TIPS then carries the case forward, linking communications across platforms, surfacing behavioral patterns through advanced link analysis, enriching identity development through embedded CLEAR searches, and
coordinating a unified response through role-based sharing and centralized documentation.
Together, they transform isolated signals into a coherent threat picture, accelerate intervention when escalation is occurring in real time, and give organizations the structure, visibility, and speed required to prevent harm – not simply respond to it.
If we want better outcomes, we need systems that connect information as quickly as risk moves—so teams can act with full context, with no blind spots. If you’re ready to move in that direction, let’s talk.
