Recalibrating Active Shooter Preparedness Plans For Today’s Threats

By |2023-01-30T23:04:22+00:00December 8th, 2022|0 Comments

The evolution in risk & response: an active shooter threat is dynamic and complex.

There is a clear upward trend in the number of active shooter incidents each year.  The most recent FBI report for the period 2017–2021 shows that the number of active shooter incidents identified in 2021 represents a 52.5% increase from 2020 and a 96.8% increase from 2017. Despite countless hours and dollars spent on active shooter defense, this problem is getting worse each year.

Source | FBI, 2022 (Note: The FBI defines an active shooter as one or more individuals actively engaged in killing or attempting to kill people in a populated area.)

Research indicates that active shooter incidents are acts of targeted violence that are predatory in nature. The perpetrator(s) typically begin planning and preparing for their attack long in advance of the first shot fired. Another FBI report, focused on the pre-attack behavior of active shooters found that shooters demonstrate between four and five observable indicators that they are on the pathway to violence before they strike. Family, friends, co-workers, classmates, all are positioned to see and hear the warning signs to an impending attack but often don’t recognize the significance of their observations or know who to tell or how to report their concerns.

The effects of an active shooter incident are devastating and long-lasting. The physical damage done can be catastrophic, not only to those shot, but to their families, employers and communities. While there are many examples of active shooter incidents lasting five minutes or less, the social and emotional consequences can last a lifetime. It is important for leaders and decision-makers to understand and anticipate the entire lifecycle of an active shooter incident, not simply plan or train for the minutes of terror between ‘shots fired’ and ‘shooter down.’

There are several important steps to recalibrating an organization’s active shooter preparedness and response plans to align them with this evolving threat, and those steps correspond the entire event lifecycle.


Active shooters, in schools, businesses, houses of worship, and public places have multiple motives for their attacks. OSHA has historically defined workplace in four types, but a fourth type has emerging in the post 9-11 environment that requires equal attention.

Type I violence occurs during the commission of a property crime such as a robbery, theft or trespassing. In this scenario, there is no legitimate business relationship between the offender and the organization. The organization or victim is selected because of the perception that there is something of value to be taken, such as cash, medications or electronics. Type I violence is most common in convenience stores, liquor stores, and gas stations, as well as taxis and limousines, where people may work late at night, all alone, and have cash on hand. Most instances of Type I violence are reported in the news as robberies, but the victims are clearly on the job and in a workplace when these occur.

Type II violence is the most prevalent in hospital and health care environments and in fact, health care and social service workers are four times more likely to be the victims of violence on the job than any other type of worker in the U.S. (OSHA, 2014). In instances of Type II violence the offender is known to the organization as a client, customer or patient, and the violence occurs during the routine delivery of services. In some settings the risk of assault or injury by customers or clients represents a real and ongoing threat in everyday work.

Type III violence is what the type of violence most commonly thought of as “workplace violence. This is coworker- to-co-worker violence. There are many instances in which this also involves worker-to-supervisor, and in some cases supervisor-to-worker violence. In academic settings this may manifest itself as student-to-student or student-to-faculty violence. In Type III workplace violence the perpetrator is a current or former employee (or student) of the organization. The motivating factor is often one or a series of interpersonal or work/ school-related conflicts, losses or traumas, and may involve a sense of injustice or unfairness. Those in positions of authority are often at the greatest risk of being victimized. It is important to note that even workers or students who have separated from the organization may still represent a risk of violence in some situations. When violence and abuse follow a worker from home to work, it is considered

Type IV or “Intimate Partner Violence.” It is important for employers to recognize that violence and abuse at home are not just personal problems; they can and do intrude into the workplace, sometimes violently with tragic consequences. There are many cases each year, often involving multiple victims, when a former spouse or partner brings their violence or aggression to their partner’s workplace. The perpetrator may know their partner’s work hours, parking location or other information that may make them vulnerable. The risk of violence increases significantly when one party attempts to separate from the other. Type IV violence is typically a spillover of domestic violence into the workplace and refers to perpetrators who are not employees or former employees of the affected workplace. Women are more often the targets. Hospital and health care environments may be particularly vulnerable to Type IV violence since the workforce is likely to be predominantly female.

Type V violence involves a violent actor who is an extremist of some sort who believes that violence is necessary, justified or deserved in their radical views. In such cases violence is directed at an organization, its people and/or property for ideological, religious or political reasons. Violence perpetrated by extremist environmental, animal rights, and other value-driven groups may fall within this category. In Type V violence, target selection is not based on a sense of personal or professional injustice in the workplace, but rather rage against what the targeted organization does or represents. Type V violence can also target locations that are populated by certain groups targeted by racially or ethnically motivated extremists. Attacks of this type have targeted business, such as shopping centers, health and fitness clubs, and special events.

While some organizations or settings may have a greater risk of certain types of violence, none are immune from all five types. All have the potential to evolve into active shooter incidents and must be understood and considered in planning and preparedness efforts.


    1. The ANSI American National Standard for Workplace Violence Prevention and Intervention has been updated over the past several years to replace the term “active shooter” with “active assailant.” This is more than mere semantics, it reflects the need widen the focus exclusively from firearms to attacks possibly involving vehicles, explosives, and other types of weapons. This shift if based in the types of attacks that have been experienced around the world over the past decade. This shift should not just be reflected in policy, but also in training and physical security measures. It is important for employees, students and others to anticipate a range of threats to increase safety and survivability.
    2. While an act of mass violence may seem senseless, to the perpetrator, their actions make perfect sense. Individuals who commit targeted violence don’t just snap. This type of violence is a decision; it is planned and purposeful, and typically the result of a smolder crisis, rather than a sudden crisis. It is critical that organizations of all types have or have access to behavioral threat assessment teams (BTAM) to receive and evaluate threats and concerning behavior suggesting that someone is moving alone the pathway to violence. Workplace violence prevention training, at a minimum, must introduce the behavioral risk indicators associate with targeted violence, how to and who to report concerns to, and how to make people safe when violence occurs.

      It is also important to make the important shift in a workforce or student body from “bystanders” to “upstanders.” Upstanders are prepared to recognize concerning behavior and communicate their observations to the appropriate parties. They not only become a force multiplier for security efforts, but a part of a cultural change to prevent violence in organizations and communities.  All employees or students must understand their important role safety and security.

    3. Employee wellness programs must be integrated into safety and security, as well as human resources and legal efforts to prevent targeted violence. Stress is at an all-time high and the FBI report on active shooter pre-incident behaviors clearly indicates the leading precipitants associated with active shooter incidents are mental health stressors. This should in no way be misconstrued as individuals with illnesses being at greater risk of violence. All major studies examining the relationship between mental illness and violence have demonstrated that mental illness is not causal in mass violence. Individuals with mental illness are more likely to be the victims than the perpetrators of violence, but mental illness can be a contributing factors. Many people are at a breaking point due to the combine effects of the pandemic, the economic and political environment, and a host of cascading crises. The American Psychological Association found in its most recent Stress in America survey that most adults feel overwhelmed by the steady stream to crises over the past two years. Organizations of all types must recognize the powerful effects of stress and the warning signs that someone is approach their tipping point, where overwhelming feelings can become aggressive or violence actions.
    1. Be prepared to stopping the killing. When considering the critical role of bystander intervention, it is important to remember that in studies of active shooter incidents, even when law enforcement was present or able to respond within minutes, civilians often had to make life and death decisions, and therefore, should be engaged in training and discussions about the decisions they may face. Training must be reality-based and aligned with the actual dynamics likely to be encountered in an active shooter situation. Simply showing training videos or informing employees and students that they should “run, hide or fight” is insufficient. Leaders and planners would do well to remember that “practice does not make perfect; perfect practice makes perfect”, therefore it is critical to prepare people for the real challenges they may face in an active shooter. It is important to stress that “fight” means: Distract: Interrupt the Shooter’s focus; Disrupt: Interrupt the Shooter’s momentum or rhythm; Disarm: Interrupt the Shooter’s access to weapons. Everyone should also be trained to use teams, use improvised weapons, and use the element of surprise.
    2. Stop the dying:Training should also envision the moments after the shooting regardless if the shooter has been downed or has moved on. It is likely that there will be serious medical and psychological trauma that requires immediate attention, and that others in the environment may be the best and possibly the only sources of rapid assistance. The most common cause of preventable death in an active shooter incident is the failure to control severe bleeding. Across the U.S., on average, it takes approximately 7 to 15 minutes for first responders to reach the scene and often longer for them to safely enter and start treating patients. Victims who experience massive trauma don’t have that much time and can often bleed to death in as little as three minutes. Access by EMS, in some cases, could take up to 30 minutes before initial patient contact – likely longer. Mortality rates are high as patients “bleed out” prior to medical contact while resources are waiting in staging.

      Given this harsh reality, some communities and organizations have begun to train and equip citizens in bleeding control, also referred to as “B-CON.” In addition to instruction in the basics of B-CON techniques, some organizations have begun prepositioning B-CON supplies in safe rooms and other points likely to experience casualties. Wall-mounted Kits, Carry-Kits and Throw Kits are designed to provide bystanders and initial first responders with quick and easy access to essential medical equipment for stopping life-threatening bleeding. Each Throw Kit contains high-visibility illustrated instructions that take the user through step-by-step procedures to ensure proper care and device application based on what they observe as injuries. The Throw Kit also includes a tourniquet, occlusive trauma bandage, petrolatum gauze, a tape board, emergency blanket and casualty marking card. No matter how rapid the arrival of professional emergency responders, bystanders will always be first on the scene. It is important to leverage this resource to save lives and reduce both the physical and emotional trauma that may arise for those standing helplessly nearby watching a coworker suffer and die simply because they had no awareness, knowledge or skills to help save a life. Train those in the environment in B-CON.

    3. Stop the crying: This is not to say that individuals affected by violence should not cry, but rather that it is critical to respond to the powerful emotional reaction to this type of threat. The immediate reaction of people exposed to this degree of overwhelming psychological stress can make a bad situation worse. There is also a growing body of evidence indicating that rapid psychological support is critical in reducing the likelihood of long-term mental health complications stemming from exposure to traumatic events. For both clinical and tactical reasons, it will be necessary to begin managing the psychological trauma associated with an active shooter incident immediately, preferably during the incident itself. Psychological First Aid (PFA) is an evidence-informed approach for assisting children, adolescents, and adults in the immediate aftermath of disaster and terrorism. It is and every person skill set intended to be used in the immediate wake of a violent or threatening event to help reduce the physical and emotional arousal (stress response) that can lead to more harmful (frantic, unfocused) behaviors and potential long-term mental health consequences. Train those in the environment in Psychological First Aid.
    4. Plan for the recovery. Addressing post-attack recovery is best considered in a phase-specific manner. The Immediate Phase involves the first minutes through the first hours of the incident, and begins as soon as the first shot is fired. This begins with providing for basic needs such as safety and medical care, but also, establishing Family Reunification Center, providing Psychological First Aid and emotional support, crisis communications and media management, liaison with hospitals, and coordination with the incident command system and crime scene management, including witness statements with law enforcement agencies.

    The Early Phase includes the first days to weeks post-attack. In this phase it is important to mobilize and coordinate services with appropriate providers for early and ongoing emotional support, anticipate and support vigils, funerals and memorials, coordinate with local and federals victim support agencies, and support efforts to cope. It is likely that he the business continuity needs of an organization will extend from the Immediate to the Early Phase, as well.

    The Mid-Phase includes the first months through the one-year anniversary of the attack. It is important to anticipate litigation, both civil and criminal, and the effects that coverage of such cases will have on victims and witness. Begin planning for one-year anniversary well in advance of the actual date. It is also critical to continue ongoing support for victim’s families, survivors and witnesses, including medical and psychological care. During this phase it may be productive to develop After Action Reports and conduct necessary reviews and updates to policies, plans and procedures, as well as continuing to monitor media coverage (including social media) of incident and organizational response.

    Late-Phase tasks involve the one-year anniversary and beyond. It is important that organizations of all types recognize one-year anniversary and anticipate emotional difficulty associated with that milestone. It is also necessary to manage anniversary media attention to the anniversary, and continue to support ongoing rehabilitation and mental health care for affected individuals. Anniversaries of violent events are a time to take stock of the accomplishments of both individuals and the community or organization, to reassess the needs, and to enhance and strengthen connections with stakeholders. At the one-year anniversary and beyond, it is important to continue to create and share educational materials and foster partnerships that promote resilience and create a legacy.


    Based on current trends, it is realistic to anticipate that the number and frequency of active shooter incidents will remain high and possibly increase. This threat has become a foreseeable hazard that all organizations must take seriously. Seconds lost to denial, disbelief or indecision can have deadly consequences. As the active shooter threat continues to evolve it will be necessary for leader and decision-makers, as well as emergency responders to continue to recalibrate their policies, plans, and procedures, as well as exercises, to changes in the threat landscape. Applying the concepts described above can help organizations mature their active shooter preparedness posture and better align with today’s realities.


    The American National Standard for Workplace Violence Prevention and Intervention. ( ASIS/SHRM WVP.1-2011). American National Standard Institute, Inc. September 2011.

    Stress in America. American Psychological Association. March 2011.

    Active Shooter Incidents in the United States in 2021. Federal Bureau of Investigation. U.S. Department of Justice. July 2018. May 2022.

    Study of Pre-Attack Behaviors of Active Shooters in the United States Between 2000 and 2013. Federal Bureau of Investigation. U.S. Department of Justice. July 2018.

    Making Prevention a Reality: Identifying, Assessing, and Managing the Threat of Targeted Attacks. Federal Bureau of Investigation. U.S. Department of Justice. July 2015.


Recommend0 recommendationsPublished in Incident & Crisis Response

Share This Story, Choose Your Platform!

About the Author:

Steve Crimando is founder and principal of Behavioral Science Applications LLC, and director of the Homeland Security Human Factors Institute. He is an internationally known consultant and educator focused on the human element in security, emergency management, and business continuity.

Mr. Crimando is a Certified Threat Manager (CTM), Certified Disaster Response Crisis Counselor (DRCC), and a Board Certified Expert in Traumatic Stress (BCETS). He is also a Certified Master Trainer for the U.S. Department of Homeland Security National Threat Evaluation and Reporting (NTER) program.

With more than 30 years of frontline field experience, Mr. Crimando was deployed to the 9/11 and 1993 World Trade Center attacks, the Northeast anthrax screening center, and many other disasters and acts of terrorism. He is a published author who is frequently called upon by the media and the courts as an expert in crisis intervention. He provides training and support to multinational corporations, law enforcement, intelligence and military organizations, as well as NGO’s, such as the United Nations.

Leave A Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.