Italy’s Interior Ministry has set guidance for handling evacuation decisions after receiving suspected threat messages sent in bulk, warning that only “serial” threats are considered inherently unreliable. In a circular sent to prefects and police chiefs, the ministry says a threat is to be treated as unreliable when it appears “manifestly serial,” meaning the messages are identical or substantially similar, come from the same source, and are sent indiscriminately to multiple recipients. The ministry adds that this approach applies unless additional risk indicators appear. These include the discovery of suspicious objects, anomalies detected through video surveillance that can reasonably be linked to the threat, prior episodes or reports, information suggesting a specific target is at risk, and other concrete circumstances that require strengthening protection measures. The circular also directs authorities to pay close attention to how information about alarms is communicated to the public. It warns that uncontrolled publicity could amplify the effects and increase public insecurity. Crucially, the guidance specifies that the reported “threat reports” are not treated as cyberattacks, and the directive does not change cybersecurity investigation procedures. Responsibility for managing cybersecurity incidents and related resilience and investigative work remains with the competent bodies, including postal police and the cyber security unit. As of now, the measure is guidance for authorities on managing suspected serial threats, with investigations and incident response continuing under the relevant competent organizations.