Threat Theory Crafting
The Core Principle
If every supernatural entity in the setting exists in relationship to an outside force that provides structure, purpose, and coherent identity and if that relationship is what makes them functional members of the hidden world rather than catastrophic presences within it, then the threat categories resolve into something much more specific than "monster vs. community member."
Every supernatural threat is, at the cosmological level, an entity in a broken, failed or corrupted force relationship. The nature of the failure determines the nature of the threat. This is not a moral distinction. An entity whose force was destroyed didn't choose its condition any more than a dhampir chose their hunger. But the condition produces behavior that is dangerous regardless of its origin.
The hidden world's existing threat-designation systems are all built around appearance and capability. They ask: what is it, and what can it do? This framework asks a different and more fundamental question: what is its relationship to the force that structured its existence, and what went wrong?
The Failure States
There are four distinct conditions that produce threats from what would otherwise be structured supernatural communities:
Patron Destruction — the outside force no longer exists. Entities that were once organized around it are functionally orphaned, operating on instinct and survival imperative without the coherent purpose or organizational logic the force provided. They're not evil. They're unmoored.
Patron Banishment — the force still exists but cannot currently access the mortal realm. The entities remain but their connection to purpose and structure is severed. They still feel the pull of what they were built for but cannot complete the circuit. This is a particularly dangerous state because the drive remains while the governing relationship that shaped its expression is gone.
Patron Capture or Control — another force has subsumed or is weaponizing the original force's entities. This produces entities that still have coherent purpose and organizational structure but the purpose has been redirected. They're not unmoored; they're pointed at the wrong targets by something that isn't their originating force.
Force Desperation — the force still exists but is threatened in ways that cause it to abandon its sustainable relationship with its intermediaries in favor of extraction. A force whose material anchoring is collapsing doesn't maintain the careful management model. It starts consuming its own instruments.
Mapping the Threat Categories
Undead Threats
Patron Destruction's Most Visible Product
The undead threat category (zombies, ghouls, revenants, feral vampires) represents the vampire propagation mechanism running without patron force oversight.
A vampire operating within the Bloodline Courts' structure has its patron force's interest in sustainable predation built into its organizational context. The Courts exist, at the deep level, because the originating forces needed long-term management structures. A vampire that creates indiscriminately, that produces ghouls and feral spawn without the selectivity the patron force requires, is a vampire whose connection to its force has been severed or degraded.
Feral vampires aren't just politically unaffiliated. They're metaphysically unmoored. The hunger that every dhampir carries as background experience is what a feral vampire is, the consumption imperative without the shaping influence that gives it direction and limit. They propagate, because that's what the mechanism does, but the propagation produces ghouls and revenants rather than viable lineage because the patron force's shaping influence isn't present to make the contamination take hold properly.
This explains something the threat compendium doesn't explicitly address: why zombie propagation produces mindless entities rather than functional vampires. It's not a weaker version of the vampire's blood-mechanism. It's the mechanism running without the organizing principle. The patron force's absence doesn't just remove the politics, it removes the coherence.
The implication for player characters: When the party hunts a feral vampire, they're not hunting a rogue community member. They're encountering the wreckage of a patron force relationship that failed. The question that changes everything: what happened to the patron force? Because the feral vampire is a symptom and symptoms have causes.
Shadow Entities
Compact Entities Without Compact Structure
The existing documentation already distinguishes between shadow entities operating under compact obligations and those operating freely but it frames this as a disposition difference rather than a structural condition.
This framework reveals it's structural. A shadow entity operating under a functioning compact with an active Hollow patron is doing exactly what it was designed to do. It has purpose, constraint and the specific discipline of something that knows it is being tracked by an entity that expects returns on its investment. This is why Shadow-Bound Marked and compact-operating shadow entities have the recognition relationship they do; they're both instruments of the same force category, operating in the same organizational logic.
A shadow entity whose Hollow patron was destroyed, banished, or whose compact was severed is a different thing entirely. It's still in the mortal realm but the mechanism is gone. It has no patron to return to, no accounting to satisfy, no investment relationship creating the discipline of sustainable predation. It is a consuming thing with nothing external to its own hunger providing structure.
The Greater Shadow Entity that attacks without provocation, that cannot be negotiated with through standard compact mechanisms, that the existing documentation describes as operating without recognizable logic; this is what a Hollow entity's instrument looks like when the Hollow is gone. The coldness is still there. The consuming nature is still there. The patient management that made the entity usable is not.
The specific horror: Some of these entities know what happened to their patron. They were present when the force was destroyed or banished. What they're doing in the mortal world in the aftermath is not random predation. It's the behavior of something that has lost the organizing principle of its existence and is responding to that loss. Whether that produces rage, desperation, a warped attempt to replicate the compact structure it no longer has or something that looks like grief expressed through destruction depends on the entity.
Cryptids
The Long-Orphaned
The existing documentation explicitly states that cryptids have no tradition weaknesses, cannot be affected by cold iron or salt and are not banished by ritual. They are treated as biological entities with anomalous characteristics rather than supernatural ones. This is the evidence of their condition.
Cryptids are what lineage-adjacent populations look like after their patron force connection has been severed for long enough that the metaphysical attunement has faded entirely and only the biological modifications remain.
A population of creatures that was once in relationship with an outside force doesn't cease to exist when the force is gone. The biological modifications the force made or catalyzed persist through reproduction. The anomalous physical capabilities, the anomalous ecological behaviors, the sensory characteristics that don't fit any natural taxonomy; these are inherited. What's lost is the metaphysical layer: the tradition access, the coherent relationship to the force's purpose, the organizational structure that made the population something more than animals.
Bigfoot lineages in this framework are remnant populations of what was once a skinchanger-adjacent community, a different primal animal pact, with a primal spirit that no longer exists or was severed from its mortal expression so completely that the biological inheritance is all that remains. The creature has the body modifications without the companion presence. The anomalous ecology without the territorial logic that would make it comprehensible. The sensitivity without the tradition to use it.
The Mothman's apparent precognitive behavior is the ghost of a faeborn-adjacent liminal perception, running without the Glamourist tradition to give it framework or the Threshold Society to give it purpose. The creature sees something like what faeborn see but has no conceptual structure for what it's perceiving. It responds to the perception with distress behaviors that look to human observers like warnings or omens.
The most important implication: Tradition countermeasures don't work on cryptids not because they're immune to the metaphysical layer, but because they're no longer in it. You can't expel something with an exorcism ritual that isn't operating on the ritual's relevant substrate. You can't cold-iron something that has no fae attunement left to disrupt. They're treated like animals because, at the metaphysical level, they've become animals. Biological inheritors of a lineage whose force is gone.
Shapeshifter Threats
Three Distinct Failure Modes
The shapeshifter threat category is actually three different kinds of force relationship failure, which is why the entries feel so different from each other.
The Werewolf is patron capture or corruption. The existing compendium distinguishes werewolves from skinchangers; same apparent capability, different origin. The framework clarifies what that difference is. Where the skinchanger pact is a bilateral negotiation with a primal animal spirit that has genuine investment in the continuation of the relationship, the werewolf infection is the pact mechanism running under a different force's control. Something; not the original primal spirit, but something that wants the apex predator capability without the relationship, found a way to replicate or seize the transmission mechanism.
The werewolf's involuntary transformation under the full moon, its loss of cognitive function in the shifted state, its treatment of other humans as prey rather than pack. These are the pact expression without the primal spirit's presence inside the carrier. The skinchanger's beast is patient and with them because the spirit is genuinely present as a companion. The werewolf's beast is something else operating through the same channel, something that seized the mechanism without establishing the relationship. The carrier experiences it as invasion rather than integration, which is exactly what it is.
The Skinwalker is a human who deliberately broke the pact structure to replicate the force's mechanism through personal action. They didn't receive the pact from a force; they tried to be the force unilaterally, through ritual violence. The result is an entity operating on pact-adjacent biology without either the primal spirit's companionship or the original force's organizing principle. What they created is a consuming imitation: the transformation capability without the partnership, the predator's biology without the predator's ecological purpose.
The Wendigo is patron force itself, reduced and desperate, crossing directly into the mortal realm through human possession because it can no longer maintain existence through its original mechanism. Whatever spirit the Wendigo once was; a cold hunger spirit, something that once had a structured relationship with the mortal world through some population of intermediaries, that population is gone. The force survived its intermediaries' destruction by doing what forces are not supposed to do: entering the mortal world directly, taking a host, and consuming the host's life to sustain itself. The insatiability is structural. It was designed to be sustained by a relationship it no longer has, and no amount of direct consumption can replace what the relationship provided.
Fae Threats
Court-Severed Entities
The fae threat entries represent fae entities whose connection to the originating liminal force has been degraded by court destruction or severance.
A functional fae operates within a court structure that maintains its connection to the force. The court is not just political organization, it's the network of obligation and exchange that keeps the boundary between the fae realm and the mortal world permeable in a managed way. A fae outside court structure loses the managed permeability and retains only the aspects of its nature that can sustain themselves without organizational support.
The banshee in this framework is a fae entity whose court was destroyed or whose specific liminal function, the threshold between life and death, became its entire remaining nature when everything else the court provided was removed. It can still perceive death-thresholds. It can still mark them. It can no longer do anything else, because everything else required the court relationship. It wails because it is an entity made of liminal perception that has been reduced to a single threshold expression, endlessly.
The will-o'-wisp is a fae entity that lost its court and retained only the misdirection function, the glamour that creates false paths. Without court purpose giving that function direction, it misdirects without reason, leading travelers astray not as strategy but as the only thing it still knows how to do.
The structural implication: The cold iron vulnerability that all fae share is not a tradition-specific weakness. It's a material whose metaphysical property is antithetical to liminal space. Iron closes boundaries, fixes things in place, prevents the permeability that fae existence requires. For a court-connected fae, cold iron is dangerous but manageable. For a court-severed fae that no longer has the organizational infrastructure to compensate for that vulnerability, cold iron is existentially destabilizing. The weapon that was once a serious inconvenience becomes catastrophic when the force relationship maintaining the entity's coherence is already compromised.
Aberrations
The Hardest Case
The existing documentation describes aberrations as entities from outside the setting's metaphysical substrate entirely, from dimensional spaces or void-adjacent realities foreign to the human reality layer. The wrongness they produce is described as categorical rather than relational.
The framework complicates this. Not by replacing the existing account, but by suggesting that "from outside this reality layer" may be a description of a current state rather than an original nature.
If a patron force is destroyed completely; not just banished, not just severed from its intermediaries, but fundamentally eliminated from the metaphysical substrate, what happens to entities that were constituted from that force? They don't cease to exist. They lose the organizing principle that made them coherent within the mortal world's metaphysical logic. Without the force's substrate providing their structure, they begin to follow the logic of whatever they're made of which, if the force was sufficiently alien or if the destruction was violent enough, may be logic that the mortal world's reality layer genuinely cannot accommodate.
In this reading, aberrations are not visitors from another dimension. They are the remains of forces, or the fragments of entities constituted from forces, that have been so thoroughly severed from the metaphysical substrate to which they once belonged that they now exist as if they were from outside it. The wrongness is real. The reality incompatibility is real. But its origin is not alien invasion, it's the wreckage of something that was once structured and has lost its structure so completely that it now reads as foreign.
The Breach that aberrations come through is not a dimensional portal. It is a wound — a place in the metaphysical substrate where a force once existed and was removed, leaving a gap that reality hasn't healed. Aberrations don't come through Breaches from somewhere else. They coalesce at Breaches because that's where the substrate is thin enough that entities without coherent force relationships can achieve material expression.
The critical implication: Closing a Breach without understanding what force was destroyed to create it addresses the symptom. The wound remains. Something will coalesce there again, possibly something worse, because the gap in the substrate is the condition, not the aberration.
What This Does to the Setting's Organizations
Every organization's threat model becomes partially wrong in the same way: they're classifying by type when they should be classifying by force relationship. The Vanguard's threat designation misses the most important variable. A Bloodline Court vampire is not the same kind of problem as a feral vampire is not the same kind of problem as a vampire whose patron force was captured and weaponized by something else. They look identical. The "appropriate" response is completely different in each case.
The Network's hunt-based model is even more incomplete. It's calibrated for destroying threats, but destruction is the wrong response to entities in patron destruction failure states. Killing the werewolf doesn't address whatever seized the pact mechanism. Destroying the shadow entity doesn't explain why its Hollow patron is no longer managing it.
The Grimoire Compact and the BUA's research division are the organizations best positioned to understand this framework. They're the ones that investigate rather than just respond. The question "what happened to this entity's patron force" is a research question before it's an operational one. This gives both organizations a relevance to campaign-level threats that exceeds their apparent operational capacity.
The Threshold Society's Veil maintenance work becomes even more significant: they're not just sealing fractures in the barrier between the mortal world and the Liminal. They're patching wounds left by force destructions. Their wardens, most of whom are Faeborn and therefore intimately connected to a force whose structural interest is in boundary permeability, are maintaining the infrastructure that prevents Breach formation, which means they're working against the conditions that produce aberrations, whether they understand it in those terms or not.
The Campaign-Level Question
This framework generates one question that the setting should hold open as a long-term mystery: who or what is destroying patron forces?
Force destruction on the scale required to produce the threat environment the setting depicts; enough orphaned entities to fill a threat compendium, enough Breaches to require a standing maintenance organization, enough force-severed populations to constitute cryptid ecology, isn't random. Forces don't destroy themselves. The banishment framework implies agents capable of banishing forces. The capture framework implies forces powerful enough to subsume others.
Something is operating at the cosmological level of the setting with enough capability to alter the force landscape. The organizations, the lineage communities, the threat response infrastructure; all of this is downstream of that operation, managing its consequences without knowing its cause.
That question is the setting's deepest architecture. It doesn't need to be answered in any given campaign. But every threat the players encounter, every orphaned entity and every Breach and every feral vampire, is evidence in the same investigation, if the players ever think to treat it that way.
The Establishment Process
A force attempting to build operational presence in the mortal world goes through recognizable stages regardless of its nature. These stages look identical to threat activity from the outside which is why the hidden world's organizations respond to them as threats. They are threats while also being something else simultaneously.
Stage One: Probe. The force tests whether the mortal world's metaphysical substrate will accept its nature. Low-commitment incursions, individual entities pushed through to assess resistance and opportunity. The force is reading the environment, not building in it yet. These are the entities that appear without apparent purpose and leave without establishing territory.
Stage Two: Transmission Testing. The force identifies a human population and experiments with propagation mechanisms. It needs to know whether it can alter humans in ways that produce viable intermediaries, and if so, what mechanism works. This stage is characterized by spread patterns that don't produce consistent results; some altered humans thrive, some degrade, some produce something the force didn't intend. This is what a lineage looks like before it stabilizes.
Stage Three: Infrastructure Building. The force establishes compact relationships, possession footholds, and organizational nuclei, the equivalent of the first Bloodline Courts or the original pact negotiations. This stage has the most visible organizational activity: meetings, agreements, hierarchies forming. It also has the most intense Veil risk, because something new operating at scale before it has established the discretion that comes with community maturity is inherently visible.
Stage Four: Stabilization. The propagation mechanism produces consistent results. The first recognizable community forms. Generational inheritance begins. At this stage, the force has succeeded in principle, it has produced intermediaries, but the community is fragile, small and targeted by every existing hidden-world organization that sees it as a threat before it has the organizational capacity to defend itself.
Stage Five: Recognition or Suppression. The emerging lineage either survives long enough to be acknowledged as a community or it's eliminated in Stage Three or Four before the distinction between threat and community becomes undeniable.
The existing lineages all survived to Stage Five and beyond. The threat compendium is full of entities in Stages One through Three whose establishment attempts are being actively disrupted.
The Crossroads Demon
Stage Three Infrastructure
The Crossroads Demon is the clearest example of deliberate establishment activity currently visible in the setting. Every behavior in its threat entry reads differently through this framework.
The compact broker that finds desperate humans and offers terms isn't just predatory. It's building a compact network from scratch, emulating the same architecture the Marked lineage operates through, but being constructed by a force that doesn't have an established intermediary community yet. Every deal it makes is a new compact relationship. Every obligation it generates is a thread connecting its source force to the mortal world.
The entity has been operating in one city for eighteen months. Six deals. A network being built carefully, not explosively. This is Stage Three behavior: establishing the compact infrastructure that a new lineage of Marked-equivalents would eventually require.
What the existing Creditor Framework describes for Hollow entities; the investment logic, the patience, the long-term accounting, is what the Crossroads Demon is attempting to build from the ground up. It is the advance agent of something that wants to be a patron force but doesn't have a human population yet. The deals it makes are seed investments. The humans it compacts are, from the force's perspective, the founding generation of what will eventually be a lineage community.
The Shadow Warden whose designated target is a Light-Bound Marked member of the Order becomes legible here too. If a new force is building a compact network, its first organizational priority is eliminating the existing force with the most direct opposition posture. The Illuminated's Sacred Fire tradition is specifically structured to confront shadow entities. A new shadow-adjacent force trying to establish itself would want the Order's most capable practitioners neutralized before its lineage community is large enough to withstand direct confrontation.
Lycanthropy
Stage Two Transmission Testing
The werewolf is Stage Two failure or Stage Two in progress, depending on the perspective.
Where the primal animal spirits required millennia to develop their bilateral pact and produce the skinchanger lineage, something else found a way to seize the transmission mechanism directly. The werewolf bite propagates a modified version of the pact-biology without the bilateral negotiation, without the primal spirit's companion presence, and without the thousands of years of gradual stabilization that made the skinchanger lineage what it is.
The results are consistent with a force that has learned how the skinchanger mechanism works and is trying to replicate it quickly: the physical modifications propagate (enhanced body, transformation capability, the silver vulnerability that is the bane-material signature of pact-adjacent biology) but the metaphysical layer doesn't stabilize (no companion presence, forced and involuntary transformation, loss of cognitive function in shifted state). The force got the biology right and the relationship wrong.
The Alpha werewolf is the most interesting element in this reading. Alphas have social sophistication, pack management capacity, and something that looks like genuine investment in their pack community. Behavior that, in a stable lineage, would be the community governance function. The Alpha who has been stable and careful for three years isn't just a managed threat. They are the beginning of what a werewolf community would look like if the establishment attempt succeeded long enough to reach Stage Four. The force is learning from the Alphas that survive, adjusting the propagation mechanism through the biological feedback of who thrives and who degrades.
The Alpha that has recently "gone rogue" may not have destabilized. The Alpha may have been contacted by the originating force, attempting to move from unmanaged transmission to something closer to the bilateral relationship the primal spirits have with their skinchanger families. What looks like erratic behavior might be an entity experiencing, for the first time, something equivalent to what skinchangers describe as the companion presence, without any framework to understand it.
Possession Patterns
Stage Three Organizational Building
Not all possession is equal in this framework and the distinction matters operationally.
Random possession, an entity taking a host for immediate predatory purpose, is opportunistic. It has no establishment logic. But the threat compendium describes something different alongside it: the Possessed Operative who has been in place for fourteen months, gathering BUA intelligence for an unknown third party. The Doppelganger living as a BUA analyst for the same duration. A Greater Shadow Entity living as a human in a suburban neighborhood for four years without harming anyone, waiting for something.
These are not predators. These are agents. The force behind them is building an intelligence infrastructure, mapping the hidden world's organizational structures, identifying its capabilities and weaknesses, positioning assets in advance of something.
The critical distinction: a force at Stage One or Two doesn't need intelligence. It needs to know whether its propagation mechanism works. A force at Stage Three needs to understand the environment it's building in; who will resist the establishment attempt, what their capabilities are, where the gaps in the hidden world's response infrastructure are. The long-duration placed entities are intelligence collection for a force that has already decided to build here and is now planning the specific approach.
The Greater Shadow Entity that hasn't harmed anyone is the most unsettling entry in this reading. An entity capable of harming people that has been present for four years and hasn't, isn't passive. It's patient. It's waiting for something specific, which means it knows what it's waiting for, which means it has direction from something outside itself. It is an instrument of a force that is operating on a timeline the hidden world hasn't identified yet.
Curses
Propagation Mechanism Prototypes
The Cursed Individual's Involuntary Transmission mechanic is, in the framework of establishment attempts, a force testing whether it can build a propagation mechanism through the curse vector rather than the infection vector or the compact vector.
A curse that spreads from one person to another under stress, that modifies the recipient's biology and produces supernatural capabilities at a cost to the host; this is what a lineage transmission mechanism looks like in its prototype stage, before it stabilizes into something heritable. The curse is consuming the host (Curse Drain) because the force hasn't found the right balance between modification and sustainability. It's producing capabilities (the curse manifestation that varies by source type) because the force is trying to determine what its intermediaries should be able to do.
The variation in curse type by source is the clearest evidence that multiple forces are in Stage Two simultaneously, running parallel experiments on human populations with different intended functions for the eventual lineage. Each curse type represents a different force's hypothesis about what it needs its mortal intermediaries to do.
The practical implication: a cluster of cursed individuals in a specific geographic area, all bearing the same curse type, is not just a threat response problem. It's a field site, a location where a force is actively conducting Stage Two experimentation. The BUA's forensic approach and the Grimoire Compact's research orientation are the right tools here, not elimination. Understanding what the force is testing and why has more long-term value than removing its test subjects.
The Fetch
Stage Three Direct Insertion
The Fetch, the fae threat that replaces humans and holds the originals in liminal space, represents a more sophisticated establishment strategy than propagation through alteration.
Where every existing lineage involves modifying humans to produce intermediaries, the Fetch mechanism is insertion of entities directly into human social positions. The replaced human's social network, institutional access, and accumulated relationships become the entity's operational infrastructure immediately, without the generational timeline that lineage establishment requires. The Fetch is a force testing whether it can shortcut the establishment process by placing its own entities rather than creating altered-human communities.
The implications for why the real human is kept alive rather than killed are significant. A Fetch that kills its original can be detected; Blood Sense, True Seeing, the specific wrongness that comes from something that isn't a person pretending to be one. A Fetch that keeps the original available has a fallback: if detection is imminent, the original can be returned, the entity withdraws and there's no body, no confirmed supernatural event, only a person who disappeared for a while and came back with gaps in their memory. The original is insurance against failed detection as much as a template for continued mimicry.
A force running multiple Fetch operations simultaneously isn't just conducting intelligence collection. It's building a shadow network of occupied social positions, the institutional equivalent of what the Marked lineage's compact network is, but constructed through replacement rather than alteration.
The New Lineage Recognition Problem
The most structurally significant implication of this framework is the one no existing organization is equipped to handle: at what point does an establishment attempt become a community?
The Vanguard's threat elimination model would suppress every Stage Two and Three attempt before it reaches Stage Four. From a pure threat-response perspective, this is correct. An unstable propagation mechanism in Stage Two produces entities that are dangerous and cannot be reliably managed. But Stage Four is where a community forms. Eliminating every Stage Two attempt means preventing any new lineage from ever reaching the point where the question "is this a community or a threat?" becomes genuinely ambiguous.
The existing lineages were not always functional communities. There was a point where the primal animal spirits' first skinchanger-adjacent families were indistinguishable from the werewolf-equivalent of their era. There was a point where the first Bloodline Courts were feral-vampire-equivalent threat clusters before the patron force's management investment produced organization. Every current lineage was, at some earlier point, exactly what the Vanguard would now classify and eliminate without deliberation.
The werewolf Alpha who has been managing a stable pack for three years is the clearest present-tense version of this question. The Compact of Lines' distinction between Skinchangers and infected shapeshifters exists precisely because the distinction matters but it requires a Lore Focus at 2D to make reliably, and it requires the investigator to be looking for it rather than responding to a threat designation. A Vanguard unit responding to an Alpha werewolf sighting isn't asking whether this population is in Stage Four of an establishment process. They're asking whether it's been designated.
The setting doesn't need to answer this question. It needs to make the question visible, because the organizations' failure to ask it is itself a source of ongoing, systemic harm both to establishment-attempt populations that might have become communities, and to the hidden world's political stability, which depends on a careful management of how many new forces acquire operational presence.
The Grimoire Compact, the Threshold Society and Safe Harbor are the organizations most likely to notice this problem. The BUA has the investigative infrastructure to document it. The Sovereign Circle has the philosophical framework. Its position that the compact is a tool to be managed rather than surrendered to gives it the conceptual vocabulary for treating a force relationship as something with terms that can be engaged rather than simply eliminated. None of these organizations has yet synthesized the observation into a formal position.
That synthesis, when it happens, will be the most politically significant development in the hidden world in generations.