Active Shooter Preparedness: Beyond Run/Hide/Fight

Run/Hide/Fight or Avoid/Deny/Defend – no matter which mantra is taught/trained, there is one unfortunate constant between both methodologies: the shooting has begun, and there is an imminent loss of life occurring at the workplace, school, church, grocery store, or wherever the active shooters have selected their targets. Thorough understanding of these methodologies is certainly important during an active shooter event. Often, bystanders freeze in disbelief that the incident is happening to them. This is not the common fight versus flight response. There is initial shock to the system. Repetition through training and exercises will create that imbedded response in the cerebellum to create the muscle memory needed for all bystanders to react and Run/Hide/Fight or Avoid/Deny/Defend. Not to dissuade from bolstering preparedness through this training, the fact remains that lives are being threatened when the response is initiated. A true active shooter preparedness plan needs to go beyond the Run/Hide/Fight or Avoid/Deny/Defend reaction.

Prediction of human behavior can seem complex. It can seem overwhelmingly daunting when put into the context of an active shooter event in which the incident can be over in less than five minutes. However, these shootings did not start with the first shot. The shooting did not begin when “all of a sudden, he took a gun out and started shooting everyone.” Examine the facts of the Columbine High School shooting on 20 April 1999. This is the shooting that coined the term “active shooter.” The assault did not start on April 20. It did not start at 11:19 a.m., when one of the two killers yelled, “Go! Go!” It did not start the morning of the attack, while they were carrying explosive devices that were set to detonate. It did not even start in 1999. In fact, the killers started posting violent blogs in 1996, which started the chances for intervention and prevention.

In 1998, the killers created a “Hit Men for Hire” video. They started to obtain weapons and hone their bomb-making skills. These were all precursors of events to come that were missed. This was further substantiated with the Federal Bureau of Investigation’s (FBI) report, A Study of Pre-Attack Behaviors of Active Shooters in the United States Between 2000 and 2013. The study, released in June 2018, found that many active shooters engaged in behaviors that signaled impending violence in the weeks and months prior to the attack. The FBI found that, on average, each active shooter displayed four to five concerning behaviors over time that were observable to others around the shooter.

Too often, an active shooter program’s “success” is measured by how familiar the occupants are with the reaction when the incident has begun. There is a sole focus on Run/Hide/Fight. Although the response is necessary, lives are being lost at that point. The National Preparedness Goal is “a secure and resilient nation with the capabilities required across the whole community to prevent, protect against, mitigate, respond to, and recover from the threats and hazards that pose the greatest risk.” This goal is applied to continuity of operations (COOP) throughout the United States. Communities and businesses will develop preparedness plans for a variety of disasters, such as hurricanes, tornadoes, flooding, winter storms, etc. However, this goal must be applied to active shooter events by developing protocols in each of the five mission areas of the National Preparedness Goal.


A company must think beyond insider threat as someone who will initiate cyberattacks against their company. An active shooter is a form of insider attack. The psychopathy of these offenders is vastly different than a serial killer. Ted Bundy was charming. Edmund Kemper was friends with law enforcement. Dennis Rader was a church leader and leader of a Boy Scout troop. Nikki Giovanni, a professor at Virginia Tech, said “there was something mean about this boy” when referencing Seung-Hui Cho (2007 shooter). If a person recognizes behaviors as problematic but takes no action, the opportunity for intervention is missed. Preventing an attack requires the observation of pre-attack indicators, or PAINs. When PAINs are observed, caution may be warranted and action taken to consider the context of the warning signs in order to determine if a threat assessment is needed. The PAINs must be available to all members of the community involved in the preparedness planning. As an active shooter progresses on a trajectory toward violence, these observable behaviors may represent critical opportunities for detection, intervention, and disruption. A shared awareness of the common observable behaviors demonstrated by active shooters may help to promote inquiries. These PAINs include:

  • Preoccupation with theme of violence or fascination with/asserting ownership of firearms;
  • Intimidating others;
  • Cross boundaries, such as excessive calls or emails;
  • Verbalized problems at home or financial problems;
  • Marked performance decline or unexplained increase in absenteeism;
  • Repeated violations of policies or resistance and overreaction to changes in policies/procedures;
  • Notable changes in personality, mood, or behavior and/or noticeable unstable, emotional responses;
  • Giving away personal possessions;
  • Showing noticeable decline in personal hygiene, increased use of drugs/alcohol, or unkempt appearance and dress;
  • Threat of suicide or self-harm;
  • Empathy with individuals committing violence; and
  • Behavior that is subject to paranoia.
2007 Virginia Tech massacre candlelight vigil. Source: Anonymous contributor/public domain.
Source: Anonymous contributor/public domain.


Having a workplace violence policy seems intuitive in today’s society. However, the depth of the policy must encompass more than just prohibitive actions. The previously noted FBI report shows that the most common response when concerning behavior was observed by others was to communicate directly to the active shooter or do nothing. As noted in the previous mission area, there are pre-attack behaviors that, if recognized, could lead to the disruption of a planned attack. Accurate and early reporting that allows for a well-timed intervention could be instrumental in resolving issues of workplace incivility before they have the opportunity escalate into physical violence. Processes and procedures for employees that observe PAINs must be detailed in the workplace violence policy.

The workplace violence policy must detail a threat assessment program and team. The identification of a potential perpetrator, assessment of the risks of violence posed by a given perpetrator at a given time, and management of both the subject and the risks that he/she presents to a given target are all identified through the formulation of a Threat Assessment Team (TAT). The TAT’s objective is to use internal agency specialists to prevent violence from occurring, such as human resources, security personnel, and Employee Assistance Program (EAP) personnel. The TAT serves as a central convening body that ensures that warning signs observed by multiple people are not considered isolated incidents and do not go undocumented.


Deploying countermeasures to mitigate the threat of an active shooter is only the first step. With any strategy, response, procedure, and technology, a robust training program must be developed. Faith in the technology deployed as a countermeasure must be unquestioned. The countermeasures must be tested on a bi-annual basis. For instance, a fire drill does not only test the occupants’ response to evacuate the building. It also tests the fire annunciator panel to ensure it is operational when needed. If a public address system or mass notification system has been purchased as a countermeasure for active shooter events, it must be known that the equipment will work when the time comes.

Inclusion of first responders is necessary for familiarization of the building design, floor plans, and any breaching equipment that may be necessary. As the subject matter experts, they can work with property management to identify additional actions that must be taken that may not be known to the layperson. For example:

  • How do the office telephone numbers and address appear when 9-1-1 is called?
  • Has a reverse phone tree been developed so first responders can trace the phone number that initiated 9-1-1 response to a specific office in the event the caller cannot talk?
  • Has a master key or access control card been created and stored in a secured location for first responders to utilize during an event?

There may be other tools that can help first responders. For instance, the Virginia Tech shooter chained the doors. This inhibited law enforcement response because bolt cutters were needed. This is something that can be purchased and stored in the pre-staged equipment area for first responders.


Although knowledge of and focus on Run/Hide/Fight is the basis for this article, other aspects must also be considered. During the run aspect, occupants perhaps should not report to their normal rally point. As in law enforcement, there is a traditional and a dynamic response to active shooter events. During a fire or other evacuation incident, the traditional response is acceptable to report to a rally point. However, active shooter is a dynamic response. The FBI report indicated that 22 of the 23 incidents that occurred in business environments were perpetrated by a current or former employee. These employees know the rally point locations. If the perpetrator is count driven (maximum number of casualties) versus target driven (seeking one target and eliminating those in the way), there is an increased risk in reporting to a known location. The Columbine High School perpetrators staged explosive devices to explode to maximize their deadly impact.

Events over the past years have also demonstrated the potential for complex and devastating attacks in crowded gathering places, known as hybrid targeted violence. These acts of violence may involve a team of attackers operating at one or more locations simultaneously using a combination of various weapons, including vehicles. Al-Qaida endorsed the Pulse Nightclub lone wolf operation and proclaimed that it would inspire others to do the same. Occupants cannot report to their common, known rally point during these dynamic incidents. Developing an alternate rally point, such as a designated phone number to call following the incident, is critical in maintaining the safety of the occupants once they are out of the building.

Bleeding remains the leading cause of death in active shooter incidents. The Pulse Nightclub shooting in Orlando report showed fatalities resulting from severe blood loss. The Hartford Consensus summarized it best by stating, “No one should die from uncontrolled bleeding.” Until law enforcement has neutralized the threat, emergency medical services may not be able to enter the facility. Time is critical. Death from severe blood loss can occur from 20 seconds to five minutes. As noted earlier, these events may be over in that amount of time. Also, a shot is fired, on average, every fifteen seconds once the event begins. Every bystander carries a set of tools at all times to control hemorrhage – his or her hands. Learning the techniques to apply pressure, applying a tourniquet, or applying a hemostatic bandage is critical to saving lives. Training in hemorrhage control should take its place alongside training to perform cardiopulmonary resuscitation and the use of Automated External Defibrillators. A bleeding control kit must be available. The recommended location is with the AED. Classes are available via or


Recovery efforts are greater than activation of a continuity of operations or business continuity plan. The immediate reunification with loved ones is not always possible following an active shooter incident. However, family members must be provided with timely, accurate, and relevant information. Lessons from pervious events suggest that establishing a team of professionals that would assist and provide services to family members significantly reduces the anxiety of family members, streamlines communication capabilities, and shares accurate information. A Family Assistance Center (FAC) team must be established to serve as a centralized information hub for first responders. The FAC must be prepared to speak with family members about what to expect when reunited with loved ones and ensure effective communication with those who have language barriers or need other accommodations, such as sign language interpreters. Psychological first aid (PFA) training must be provided to the FAC. It is important to provide rapid psychological support to victims and survivors who may have been forced to remain in hiding, in lockdown, or prevented from leaving the scene until giving statements to investigators. PFA training can be provided in person or online. The Psychological First Aid: Field Operations Guide provides information to help survivors immediately in the aftermath of a traumatic event.

In-depth plans have been developed for numerous manmade and natural disasters. These plans encompass mitigating factors as well as recovery components for after the catastrophic event occurs. This same approach must be taken with active shooter events. A plan cannot be based solely on Run/Hide/Fight. Lives are being lost the second this response is initiated. Following the National Preparedness Goal’s five mission areas will develop a substantial preparedness plan with the goal of disrupting and intervening prior to an actual event.

Chad Hyland

Chad Hyland is a retired police officer from Virginia. He served as a SWAT operator, K9 handler, and instructor in numerous disciplines, including active shooter. He has trained multiple police agencies at all levels in the police response to these events. Since retirement, he served as a private sector supervisory security manager and as the business continuity manager for a nationwide company prior to his return to the public sector. He now serves in a supervisory capacity to a security team that administers all security disciplines, including emergency management and continuity of operations. His instruction in active shooter mitigation continues, to include being a certified instructor in bleeding control from the American College of Surgeons.



No tags to display


Translate »