The analysis of vulnerabilities in large complex spaces is fundamentally problematic. The lack of capacity to generate a threat assessment merely exacerbates this problem. Lacking as well, in current literature is a developed methodology. To overcome this problem, we propose an approach using multi-agent modelling, which is also melded with three dimensional (3D) tactical understandings. Our approach builds on a microsimulation decision support tool, which was developed for a behavioural simulation of CBRN events. Microsimulation is based on the individual; who as an individual has a number of attributes, and which are stochastic (when repeated within an attribute). This approach is then enveloped. The simulations approach is intended for simulation of global and social controls and is designed to deal effectively with separate population groups. Each group has rules based on the group’s behaviour and attributes, and complex scenarios can be built very simply. This therefore, enables analysis of emergent group behaviours and patterns. Our approach is akin to chemical or fire spread quantification. It views particle spread analysis as synonymous with complex movement (or stationary location) of many active agents within a complex 3D environment. This approach, we believe is needed to ‘solve’ the counter terrorism problem presented by scenarios such as the 2007 Haymarket attack; such as, how to analyse such events, as well as develop effective interdiction. A discrete behaviour model approach is suggested. This approach through repeated simulation (within the same parameters) should build up a statistical pattern of domain behaviour. As well, information on the outcome of changing behaviour can also be logged. Therefore, individual outcomes can be matched against real-time data to give best prediction of eventual outcomes, and the range of future strategies based on closest approach to reality. Taking this approach, potential targets could then be given random attributes including movement, size, speed, destination, and degree of deception being used in behaviour. Superimposing targets from known information and still building in random attributes about what is not known, will allow forward prediction with back-correction over time as information becomes more available. As well, failure rates and other assumptions could also be gradually relaxed, and this will allow for continuous assessment of assumptions as real data becomes available.