Shift At Midnight makes threat recognition part of the job. The official Store description says that players examine an ID, cross-check a computer, and observe behavior before deciding whether a customer is safe. If the creature leaves the station, the routine changes: board up, place traps, and hide. This page keeps those public facts together while separating confirmed information from details that still need a live current-build check.
The identity-check loop
Threat information begins before a chase. A customer can look ordinary while the team is still gathering evidence, so treat the ID, computer, and observed behavior as separate signals. Record which signal failed and what the customer did. That makes the next decision explainable instead of relying on a teammate’s feeling that someone looked strange.
The public Store copy does not provide a complete creature encyclopedia, fixed tell list, or guaranteed order for every investigation. A guide can safely describe the workflow—inspect, compare, observe, decide—without inventing a universal answer for every generated shift. If a future patch changes a tell, the workflow remains useful while the individual observation must be updated.
Publicly named threats
Official announcements are the best place to attach dates to threat names. The July 23 update mentions the Marionette and says its HP was lowered. It also says the Jack in the box became louder. Those notes prove that both names are part of the current game’s public update history, but they do not by themselves define every attack, spawn rule, or optimal counter.
The July 29 announcement says that Rakes emerge from the forest in Endless/Post-Story. That statement is explicitly mode-scoped. Do not copy Rakes into a generic Story checklist without the mode label, and do not assume that a balance note applies to the base Story route. The page for each threat should carry the date and mode attached to the evidence.
When a threat leaves the station
The Store description identifies the defensive choices, not a rigid script. First report the last known position and keep an exit open. Then decide whether a barricade changes the route, whether a trap protects that route, and whether hiding is safer than confronting the creature. In a group, announce the plan so two players do not block the same doorway.
Threat behavior can be affected by layout, mode, update branch, and team size. The game advertises randomly generated shifts, so one successful path is not proof of a fixed safe room. Capture a short observation with the shift or mode, the creature name if known, what triggered it, and what changed after the patch. This is more useful than publishing a number without context.
Evidence confidence
Use three confidence levels when recording a discovery. Confirmed means the official Store page or a dated official announcement states it directly. Observed means the team reproduced it in a named mode and build but no official page states it. Unverified means a community report or a single run suggests it but lacks enough detail. Only the first category should become a universal statement without a warning.
This distinction matters for health, damage, audio range, and spawn timing. The official July 23 note gives a health-balance change for the Marionette, but not a permanent number to repeat in every guide. The July 29 note gives a mode placement for Rakes, but not a promise that future patches will leave it unchanged. Link the source and date beside claims that can age.
A threat log for co-op
Make one player responsible for the evidence callout and another for route planning. The observer can say what the customer did; the route player can keep the station exit usable. If a third player is present, they can prepare a trap or watch the team’s retreat. This division prevents everyone from staring at the same customer while the defensive state develops.
Use proximity chat deliberately. A short call such as “ID failed, computer mismatch, last seen by front door” gives the team a location and a reason. Avoid a long theory during the breach. After the shift, add the full observation to the log with the mode and date so the public guide can distinguish a repeatable clue from a one-off event.
Do not collapse every threat into one table
The names in the official notes belong to different pieces of evidence. The Marionette HP change is a balance note, the Jack in the box audio change is an audio cue note, and the Rakes statement is a mode-scoped spawn note. They should not be merged into one list that implies every creature appears in every shift. Keep the source sentence attached to the name whenever a page is updated.
Threat pages should also explain what a player can do with the information. A louder sound can affect listening and callouts; a balance change can affect whether a confrontation is sensible; a mode-scoped spawn can affect which checklist a player opens. If the source does not answer the tactical question, mark it as a live-test item instead of inventing an answer.
When a new official note changes a threat, update the date beside the claim and recheck the mode boundary. A player returning after a patch needs to know whether the note changes an investigation clue, a defense option, or only balance. Keeping those categories separate avoids a common error: treating a lower health value or louder sound as evidence that the customer’s identity check works differently.
Sources and limits
Recommended guides
Choose the guide that matches what you want to do next.
All Threats guides
1 focused guides with steps, checks, and current caveats.