I've written about the attack cycle for for many years now, but it is not the only model for understanding pre-attack behavior and indicators. The Pathway to Violence model is also very helpful. Here is how the two models fit together. https://www.torchstoneglobal.com/where-the-attack-cycle-intersects-the-pathway-to-violence/

Once an attacker goes beyond ideation and decides to act, the pathway to violence begins to intersect with the activities and behaviors associated with the attack cycle, to include target identification and selection, planning and preparation (training, weapons acquisition, etc.)

During these three phases of planning and research, preparation and probing and breaching, those planning an attack are vulnerable to detection by the target.

Investigations into terrorist attacks also frequently provided ample evidence of attackers' grievances and violent ideation. But in most terrorist cases, the victim doesn’t have visibility into the grievances and ideation driving the attacker.

In most cases, the target of an attack will only be aware of the assailant’s grievance and violent ideation if they have contact with them. The pathway to violence model is thus widely used for assessing threats related to workplace violence, stalkers, school shooters, etc.

Since terrorism victims don’t usually have visibility into the grievances and ideation phases, their first chance to detect attack-related activity is when the planning phase of the pathway to violence begins – which is roughly analogous to the start of the attack cycle.