Knife attacks happen faster than an officer can react, making the cues before the blade the officer’s best defense. This article reviews those cues, where the evidence runs out, and how FOCUS is built to fill the gap.
Why the blade is different
A knife attack at close range can finish before an officer even sees it start. Force Science time-and-motion research found that a suspect standing 9 feet away can charge and slash an officer in just over half a second. At arm’s length, the numbers drop further. FSI data puts a knife thrust at 0.10 seconds, a pick-style attack at 0.18 seconds, and a palmed blade at 0.23 seconds.
Distance alone does not solve the problem. Sandel et al. (2021) found that a suspect crossed 21 feet in about 1.5 seconds. Officers under stress averaged 1.43 seconds to draw and fire (range 0.93–2.40 s), and they hit the target in only 75% of trials (Blake et al., 2023). The authors called 21 feet an ineffective distance for drawing and firing on a charging attacker.
The math is simple. If the attack takes less time than the response, the officer has to start responding before the attack does. In other words, the officer has to work “left of blade”: spotting indicators that an attack may be about to occur so action can be taken before it, not in reaction to it.
Cue cluster 1: Concealing and accessing the blade
The most consistent cues come from the knife itself. A person carrying a hidden weapon keeps interacting with it, and those interactions can be seen.
- Security checks. People carrying concealed weapons tend to touch or adjust them many times, sometimes with only a light bump of the elbow, wrist or hand (Dorn & Dorn). U.S. Secret Service training material lists a “security feel” when nervous as an indicator for both fixed and folding blades.
- Carry signatures. Folding knives are often worn on the strong side with the belt clip showing, most commonly in the right front pocket or waistband. Fixed blades may show as a bulge, often with a “point” at the end of the handle.
- Palming. Dorn describes palming as most common with knife carriers and says it often signals imminent risk to the observer. The carrier may run the blade up along the forearm or behind the leg to hide it from the front.
- Clearing the draw path. One instructor reports that before nearly every knife attack he witnessed, the attacker stretched or adjusted clothing to get clear access to the weapon, often several times, checking it each time. This comes from field observation, not a controlled study.
- Altered movement. A weapon under clothing can make an arm or leg stiffer, or cause unnatural reaching for objects instead of bending down.
No single one of these cues proves anything. Dorn’s work emphasizes behavior clusters, with the totality of circumstances setting how likely it is that a person is armed.
Cue cluster 2: Approach, attention and positioning
The second group of cues shows an attacker setting up the moment to strike. Knife attacks are close-range events, so these cues usually play out within a few steps of the officer.
- Fixed attention on the target. Before attacking, the person typically has their eyes fixed on the intended victim.
- Target glancing, scanning, and accomplice glancing. Practitioners name moving around the person, target glancing and scanning, sometimes paired with clothing adjustments, as the strongest signs of danger.
- Waiting for distraction. A review of knife attacks on officers says the attacker usually waits until the officer is distracted or vulnerable, then strikes in a fast burst of repeated stabs.
- Off-angle approach. In a review of 250+ CCTV incidents, civilians were more likely to be attacked from the rear or side than from the front. Over 90% of knife-defense videos on YouTube still train a front-facing attack.
- Blading plus hand position. The JDLR interdiction research found that officers judging a threat looked for blading combined with hand or arm position and movement. The most common threat cluster was a bladed stance with clenched hands or hands in pockets.
The calm attacker
Some of the most dangerous knife attackers show no arousal at all. Our initial analysis shows that a planned attack can show almost none of the primal cues officers are taught to watch for. Deception and setup cues include unusual requests to move the officer or other people showing up without explanation. The 2024 Bellevue, Washington ambush fits this pattern: the suspect lured officers with a false 911 call and talked with them before pulling a knife from his jacket.
Cue cluster 3: The first motion of the attack
Once the attack starts, the evidence is less settled. The two largest video reviews disagree on the first movement.
- Empty-hand lead and grab. A review of 150+ attacks caught on CCTV and phone cameras found that 71.1% were led with the empty hand. The knife stayed close to the side, and when attackers led with the free hand, they used it to grab the victim about 80% of the time.
- The finding did not replicate. A later review of 250+ incidents did not find the 70% free-hand pattern. It found concealment split almost evenly, and 56% of offenders displayed the knife openly before attacking.
- Burst stabbing. Most attacks on officers involve a violent burst of repetitive stabs from various angles. Clinical data from 431 edged-weapon patients put the average at 2.4 wounds per victim (Bleetman et al., 2003).
The first movement also changes how officers fare. In one agency’s simulation with 91 officers, those who backed straight up were stabbed an average of 6.5 times. After training on aggressive lateral movement, the average fell to about 1.5. A 2023 Police Practice & Research study similarly recommends a firearm draw of around one second and lateral or backward movement, especially at 21 feet and closer.
The research gap
No peer-reviewed study has yet systematically coded the behaviors that come before knife assaults on officers. What exists covers the edges of the problem but not its middle.
| Evidence area | What it gives us | What it leaves out |
|---|---|---|
| Time-and-motion studies (Force Science, Sandel et al., Blake et al.) | Peer-reviewed speed data for attacks and officer draws | Measures the attack after it starts, not the cues before it |
| Weapon-concealment screening (Dorn, USSS) | Field-tested carry indicators | Built mostly around firearms; no false-positive or base-rate data for knives |
| CCTV and phone video reviews (150+ and 250+ incidents) | Real attacks, real first movements | Self-published, viral-video samples, mostly civilians; findings conflict |
| Behavioral threat assessment (FBI, USSS) | Validated warning behaviors | Covers weeks to months before an attack, not seconds |
| Instructor experience | Rich, practical cue lists | Anecdotal and unweighted |
Three gaps matter most for patrol officers.
- No officer-specific cue data. Most video reviews show civilians being attacked in public. Police encounters involve commands, contact, and cover, and a subject who knows they are being watched.
- No weighting of cue clusters. Practitioners agree that clusters matter more than single cues. No study shows which combinations predict a knife attack, or how strongly.
- No link between cues and justification. Courts judge knife cases on articulable threat behavior. In Kisela v. Hughes, the dissent stressed that the woman did not raise the knife or make any aggressive movements. Officers need validated language for the cues they saw, and most training doesn’t provide it.
The result is a research and training gap. Officers are taught how fast a knife attack is and are left on their own to spot it coming.
How FOCUS fills the gap
FOCUS takes the scattered cues above and turns them into one structured, scored, and documentable system for law enforcement encounters. It addresses each of the three gaps directly.
1. A knife-specific cue taxonomy. FOCUS organizes indicators by domain instead of as a loose checklist. For edged weapons, those domains map onto the three cue clusters in this article:
- Concealment and access: security checks, palming, blade along the forearm, clearing the draw path, strong-side carry signatures.
- Approach and attention: target glances, scanning, fixed stare, off-angle movement, blading combined with hand position.
- Deception and setup: calm compliance paired with positioning, requests that move the officer, people arriving without explanation.
2. Clusters, not single cues. FOCUS scores what it observes on the FOCUS Risk Index (FRI). Each indicator is weighed together with amplifiers (close range, low light, no cover, credible weapon information) and mitigators (time, distance, cover, less-lethal options). The total places the subject in a risk band that guides tactics. This turns the practitioner consensus that clusters matter into a repeatable process.
3. Cues tied to articulation. FOCUS gives a reporting template that runs from observed facts through context, risk reasoning, and alternatives considered to the Graham decision. An officer who wrote “he bladed his right side away while touching his right front pocket at ten feet, in low light, with no cover available” has described the threat in exactly the terms courts weigh.
Building the evidence base
FOCUS is also positioned to produce the data the field lacks. Coding FRI scores against body-worn camera footage of real edged-weapon encounters will give the first officer-specific dataset of knife pre-attack behavior. That work could answer three open questions: which cue clusters come before knife assaults on officers, how far in advance they appear, and how often they show up in encounters that end peacefully.
Dr. Travis Yates is currently teaming with Greenville County Sheriff Sergeant Tim Lewandowski and the Tactical Behavior Team to produce the study.
Conclusion
Knife attacks are too fast to react to and too common to ignore. The cues that come first are real and fall into three clusters: concealing the blade, setting up the approach, and the first motion of the attack. They have been described by instructors, screeners, and video analysts, but no one has yet validated them for police encounters. FOCUS closes that gap by giving officers a structured way to see the cluster, score it, act on it, and explain it.
Sources
- Blake, D., Suss, J., Wolfe, D., & Arsal, G. (2023). ‘Curb sitting’: An evidence-based policing practice or an officer safety myth? Police Practice and Research, 24(1), 109–121.
- Bleetman, A., et al. (2003). Wounding patterns and human performance in knife attacks. Journal of Clinical Forensic Medicine, 10, 243–248.
- Butler, C. (2025). Training to see the threat that isn’t shouting. Calibre Press.
- Dorn, M., & Dorn, C. Seven signs a weapon is being concealed. Crisis Prevention Institute; updated in Campus Safety (2023).
- Force Science Institute. Sprint study on offender speed. Police1.
- Firearm draw performance and survivability against charging knife attacks (2023). Police Practice and Research.
- JDLR: Observable Behavior During a Police Interdiction (AMX). FOCUS project library.
- Kisela v. Hughes, 584 U.S. ___ (2018). FOCUS project library.
- Defending against spontaneous knife attacks. Police Magazine.
- The winning edge: Improving knife defense training. Police Magazine.
- Knife attacks pre-violence indicators. Boston Krav Maga.
- Knife attacks: Analysis of 150+ videos (summary of Urban Fit and Fearless study).
- The Self Defence Expert. 250+ knife incident study and data-driven survival guide.
- BWC: Man lures Wash. officers with fake 911 call. Police1.
- Law enforcement expert on identifying weapons. STN.
- U.S. Secret Service. Armed Individuals: Edged weapons. Also in the FOCUS project library.