- How to Read the 13 Domains
- What This Credential Is (and Isn't)
- Domains 1-2: Foundations and Prevention Programs
- Domains 3-5: Active Shooter, Threat Assessment, School Safety
- Domains 6-8: Investigations, Interviews, Behavioral Analysis
- Domains 9-13: Recovery, Law, Partnerships, Auditing, Emergency Action
- Exam Format, Fees and Eligibility
- Sequencing Your Prep Around the Domains
- Where These Skills Get Used
- Frequently Asked Questions
- The 13 domains are unweighted preparation topics from McAfee Institute's curriculum synopsis, not a formal exam blueprint.
- The exam is a three-hour final requiring at least 70% to pass.
- Exam-only costs USD $450 for one attempt; the full course is USD $1,497 with 50 instructional hours.
- Eligibility needs a degree plus experience, ranging from one to four years depending on education.
How to Read the 13 Domains
The Certified Workplace Violence and Threat Specialist (WVTS) credential is issued and examined by McAfee Institute. Its current program page enumerates a set of preparation topics, and this guide organizes them into 13 content areas. Before you build a study plan around them, understand what they are and what they are not.
Because the topics are unweighted, a sensible approach is to prepare evenly, then spend extra time on whichever areas are newest to you. A former school resource officer may find school safety familiar but need work on legal obligations. An HR investigator may know interviews cold but have little exposure to active-shooter planning. For a broader preparation framework, see our WVTS study guide.
What This Credential Is (and Isn't)
This article concerns the Certified Workplace Violence and Threat Specialist credential from McAfee Institute. The "WVTS" acronym is shared by other, unrelated credentials in other fields, and nothing about those programs applies here. If you are new to the term, our explainers on what WVTS is and what WVTS stands for cover the naming in more detail.
It is also distinct from the Certified Threat Manager (CTM) offered by the Association of Threat Assessment Professionals. CTM is a useful comparison point for people working in threat assessment, but it is a different credential with its own scope and requirements, and it does not substitute for WVTS preparation.
Domains 1-2: Foundations and Prevention Programs
Domain 1: Workplace-violence foundations
This is the vocabulary and conceptual layer everything else rests on. Expect questions that test whether you can classify an incident and reason about its origins.
- Defining workplace violence broadly, from threats and intimidation through physical assault
- Distinguishing categories of perpetrator relationship to the workplace (for example, outsider, customer, coworker, personal-relationship spillover)
- Recognizing that most concerning behavior is a process over time, not a sudden event
- Separating a threat made from a threat posed, since the two are not the same
Domain 2: Prevention programs
Here the exam moves from understanding violence to building structures that reduce it.
- Components of a workplace-violence prevention program: policy, reporting channels, training, response protocols
- Why clear, low-friction reporting matters more than any single technical control
- The roles of HR, security, legal and management in a coordinated program
- How to make a program durable rather than a one-time training event
Scenario questions in these domains tend to ask what a prevention program should do first or what a gap in a program looks like. Practice reasoning from principles rather than memorizing lists.
Domains 3-5: Active Shooter, Threat Assessment, School Safety
Domain 3: Active-shooter planning
This domain covers preparedness for the lowest-frequency, highest-consequence scenario.
- Planning elements: communication, decision-making authority, drills and coordination with responders
- Common response frameworks and when each applies
- Pre-incident preparation versus in-incident decisions versus post-incident actions
- Considerations for different facility types and occupant populations
Domain 4: Behavioral threat assessment
Arguably the intellectual center of the credential. Behavioral threat assessment focuses on observable behavior and context rather than profiles or checklists of traits.
- Why the goal is evaluating risk of violence, not predicting it with certainty
- Structured, team-based review of concerning behavior
- Information gathering from multiple sources and weighing it fairly
- Case management options: monitoring, intervention, referral, and when to escalate
Domain 5: School safety
The curriculum includes school settings, which bring distinct populations, legal frameworks and reporting dynamics.
- How threat assessment adapts to students, staff and campus communities
- Coordination with families, mental-health resources and law enforcement
- Balancing safety with fairness and the rights of minors
Domains 6-8: Investigations, Interviews, Behavioral Analysis
These three domains form a connected chain. Investigations gather facts, interviews generate much of the information, and behavioral analysis helps interpret it.
Domain 6: Investigations
Expect process-oriented questions about how to run a sound inquiry into threatening or violent conduct.
- Planning an investigation and preserving evidence and records
- Documentation standards that will withstand later scrutiny
- Maintaining objectivity and avoiding premature conclusions
- Coordinating internal and external investigative resources
Domain 7: Interviews
Interviewing is a skill the exam treats as practical, not academic.
- Preparing for and structuring interviews of witnesses, subjects and reporting parties
- Rapport-building and open-ended questioning
- Recognizing the difference between interviewing for information and confrontation
- Documenting responses accurately
Domain 8: Behavioral analysis
This domain addresses interpreting communication and conduct. The historical module list for this program included a truncated title referring to deception theory, which suggests the curriculum has touched on how deception is studied. Because that full title was never retrieved, treat any specific theory as unverified and concentrate on the general principle: indicators are cues for further inquiry, never proof on their own.
- Analyzing written, verbal and online communications for concerning content
- Understanding the limits of behavioral cues and the danger of overconfidence
- Baselining: comparing behavior to what is normal for the individual
Domains 9-13: Recovery, Law, Partnerships, Auditing, Emergency Action
Domain 9: Organizational recovery
After an incident, an organization must restore function and support people.
- Post-incident support for affected employees and leadership
- Communication with staff, families and the public
- Learning from incidents and feeding lessons back into prevention
Domain 10: Legal obligations
Employers carry duties around safety, privacy, discrimination and fair process. Questions here reward careful reading.
- An employer's general duty to provide a safe workplace
- Balancing privacy, disability and anti-discrimination considerations with safety action
- Documentation and consistency as legal protection
- Knowing when to bring in legal counsel
Legal specifics vary by jurisdiction, so focus on the reasoning and the issues to spot rather than memorizing statutes you have not been taught.
Domain 11: Partnerships
No organization handles serious threats alone.
- Working relationships with law enforcement, mental-health providers and community agencies
- Information-sharing norms and their limits
- Establishing contacts before a crisis, not during one
Domain 12: Auditing
Programs decay without review.
- Assessing whether policies, training and reporting systems actually work
- Identifying gaps through drills, reviews and incident analysis
- Measuring and improving a program over time
Domain 13: Emergency action
This domain covers the immediate organizational response when violence or a credible threat is unfolding.
- Emergency action plans and the decision-makers who activate them
- Notification, evacuation, shelter and lockdown considerations
- Coordination with first responders and handoff to recovery
For a compact reference once you have worked through each area, our WVTS cheat sheet condenses the must-know points.
Exam Format, Fees and Eligibility
Knowing the logistics keeps surprises out of exam week. The facts below come from McAfee Institute's published pages as checked on October 5, 2026; always confirm against your own issued exam instructions.
| Item | Full Program | Exam-Only |
|---|---|---|
| Cost | USD $1,497 | USD $450 per attempt |
| Training included | 50 instructional hours, 50 CPE credits, lifetime course access | No training, manual or review quizzes |
| Exam license | One year included | One year, with proctoring |
| Final exam | Three-hour final, at least 70% to pass | Three-hour final, at least 70% to pass |
| Retake | New exam license required | New USD $450 license required |
McAfee Institute's general examination policy describes closed-book, single-sitting online testing with approximately 200 true/false, multiple-choice and scenario questions across its board examinations. That is a general figure, not an exact WVTS-specific item count, so do not plan around it as a guarantee. The proctoring description is also inconsistent in the issuer's materials: one overview mentions on-demand AI monitoring while its FAQ names ProctorU. Follow whatever your candidate instructions specify.
Eligibility paths
- Bachelor's degree or higher plus one year of relevant experience
- Associate's degree plus two years of relevant experience
- High-school diploma or equivalent plus four years of relevant experience
Qualifying fields include investigations, law enforcement, criminal justice, military service or comparable roles with direct criminal-investigation or intelligence responsibilities. Documentation and professional-conduct screening apply. On the course route, credential issuance requires submitting all quizzes, scoring at least 70% on course sections and the final, paying fees and receiving approved eligibility. Details are in our WVTS requirements guide.
Validity and renewal
Three timelines are easy to blur: lifetime course access, the one-year exam license, and the two-year credential validity. McAfee Institute's examination-license FAQ states that certification renewal is every two years, costs USD $125 and requires documented CPE. The exact CPE quantity and a WVTS-specific pass rate were not verified, so treat any pass-rate claim you encounter with caution; our WVTS pass rate article explains what can and cannot be said from available data.
Sequencing Your Prep Around the Domains
Because the domains are unweighted, order them by dependency rather than by size. The sequence below builds concepts before applying them. Adjust it to your background, and check WVTS exam dates and scheduling to align with your one-year license window.
Foundations and prevention
- Domains 1 and 2: vocabulary, categories and program components
- Write your own definitions before reading the course text
Threat assessment core
- Domain 4 first, then Domain 3 and Domain 5
- Work through case scenarios and decide next steps
Investigative chain
- Domains 6, 7 and 8 together
- Practice structuring an interview and documenting it
Organizational and legal layer
- Domains 9 through 13
- Spend extra time on Domain 10 if law is new to you
Integration and timed practice
- Mixed-domain scenario sets under three-hour conditions
- Revisit weakest domains and use the practice test
Key Takeaway
Use original practice questions rather than leaked exam content. Dumps are unreliable, may violate certification conduct rules and teach recall instead of judgment. Scenario questions reward reasoning, so practice explaining why an answer is best.
Where These Skills Get Used
The domains map to roles in corporate security, human resources, employee relations, campus and school safety, government and law enforcement, and consulting. Investigators, security managers and HR professionals who handle concerning behavior are natural candidates. Our overview of WVTS jobs explores the role landscape in more depth.
On compensation, be careful. Earnings depend heavily on the role, sector, region and seniority, and no verified figure ties a specific premium to holding this credential. The WVTS salary guide and the ROI analysis separate role-based earnings from any guaranteed certification effect. If you want to try sample items now, the WVTS Exam Prep practice test is a good starting point.
Frequently Asked Questions
No. They reproduce preparation topics named in McAfee Institute's current curriculum synopsis. They are unweighted and are not a formal exam blueprint or an official domain count.
An exact WVTS-specific count was not verified. The issuer's general policy describes approximately 200 true/false, multiple-choice and scenario questions across its board examinations, and the final is a closed-book, single-sitting, three-hour test requiring at least 70%.
Yes. An exam-only option costs USD $450 for one attempt with proctoring and a one-year license, but it excludes training, the manual and review quizzes. Retaking requires a new USD $450 license.
A bachelor's degree plus one year, an associate's plus two years, or a high-school diploma or equivalent plus four years of relevant experience in fields such as investigations, law enforcement, criminal justice or military roles.
Per the issuer's examination-license FAQ, certification renews every two years for USD $125 with documented CPE. The exact CPE amount was not verified, so confirm it with McAfee Institute before relying on it.