The article presents the results of an empirical study of social identity markers in users’ digital self-presentation that are relevant to assessing the risk of armed attacks in educational organizations. The study is based on open digital profiles from the VKontakte social network. A comparative content analysis was conducted on three groups of users: individuals who committed armed attacks in educational organizations, individuals identified at the stage of preparing such attacks, and users demonstrating signs of involvement in the relevant subcultural environment without having committed unlawful acts at the time of analysis. The findings show that the digital self-presentation of users involved in this environment contains a stable set of markers reflecting the direction of interests, symbolic self-identification, and the nature of digital activity. The study demonstrates that these groups form not isolated categories but a continuum of involvement in a common subcultural context. The results suggest that the analysis of digital self-presentation can be considered a promising approach to identifying pre-criminally significant risk markers in the digital environment.