The need to train yourself, your loved ones, or your employees, on how to respond to an active shooter scenario is becoming alarmingly more apparent as terrorism has become a more prevalent modern-day threat than ever before. And although it has existed in societies across the globe for centuries, what is changing is the frequency and technology such subhumans decide to employ.

We simply are not here to debate politics, or determine the why behind this variety of violence. The fact is that the world is not always peaceful, evil does exist in some places, occasionally it shows itself, and this specific form of it is on many a business's (or individual's) list of safety concerns. What headlines are on the news, or how the media provides terrorists their desired fame and recognition as the prize for their violent acts is irrelevant. Terrorists seek platforms, and attention for their messages. "Active shooters" are terrorists by definition, and we feel they should be treated accordingly. We refuse to provide them a platform. We will not do that here. What we are going to do is discuss proactive risk mitigation for this type of event.

Very plainly: our aim is to educate and train, should you, your business, or place of worship ever be the intended target of such acts. Each of us at AVR Defense have given or received active shooter training, as first-responders and contractors working throughout corporate America. Each of us have assisted organizations (in both the government and civilian sectors) with developing and fine-tuning active shooter response plans.

This page contains high-level information on how to design and implement an Active Shooter Response Plan, with The Department of the United States Army's Integrated Physical Security Manual, FM 3-19.30 as the model.


At a high level, dealing with an active shooter scenario starts preemptively with Critical Incident (CI) Management and Planning. Planning being a critical input to the training of everybody in the organization's charge. Training is imperative to successful execution – always. We cannot stress this enough. Its design is a critical output. After proper Risk, Threat, and Impact Assessments have been performed, the organization may assign (or reassign) security resources as needed, and proceed with training security personnel and employees in their roles and responsibilities. Full evaluations must be performed to accurately assess strengths and weaknesses of the organization's security infrastructure.

Per FM 3-19.30, the organization should adopt the integrated approach, constructing four levels of threat mitigation: DETERRENCE, DETECTION, DEFENSE, and DEFEAT. This integrated approach to physical security should be the foundation of the CI Management System. A security audit performed by our team evaluates each of those four elements, their respective procedures already in place, and details how well the organization implements and drives those procedures and protocols. A full assessment report by the audit team is then provided that breaks down strengths, weakness, efficiencies and inefficiencies of the organization, as well as recommendations of where to assign or reassign resources based on the risk involved.

The intricate procedures and protocols followed should be designed with personnel safety always being the "mission". The introduced or modified procedures become the action plan of the organization; considering the assessment report, its evaluations, effectiveness checks, and recommendations. For a large organization, points to be evaluated may include facility access protocols, CCTV Surveillance Systems, and security checkpoints (to name a few).

Expounding on access – restricting access to only those who are authorized reduces the likelihood of an active shooter (or anybody, for that matter) illegitimately entering the premises (assuming they are not an employee with a valid key-card). Evaluate where one can gain access to a facility. Are employees required to display their ID at all times and badge-in at or near a main security checkpoint? More importantly, how diligent are the security personnel and employees at following procedures and enforcing an observed noncompliance? Training and accountability of actions is a critical node. All personnel must be accountable and held accountable. At the same time, actively monitoring all access points with CCTV-S provides a crucial early warning system to security personnel that a threat is attempting to gain access, or has gained access. This reduces delay, which will be discussed later.

Considering the level of violence involved, and the likely state of mind of the individual performing the act in the "real world" (by that we mean the event actually occurring) – and we’re going to speak candidly here so bear with us – if one wants to gain access to your place of business and they are determined, armed, and willing to kill, it is likely that they’ll attempt to do so by use of force. Meaning, they may decide to just shoot somebody at the front door and take their badge, or hold somebody at gunpoint and make threats in order to make entry. In the real world, our experience is that a determined criminal often defeats the deterrence element by sheer will. They've already decided what they're going to do and it would be futile to try to convince them otherwise. This is important to understand when constructing procedures for such an emergency, as it helps the organization appropriately assign resources and countermeasures with greater effectiveness. It does not mean, however, that the organization should forgo deterrence mechanisms altogether. It only stresses the significance of DETECTION, DEFENSE, and DEFEAT - the other three - and their role in mission success.

In the hypothetical scenario described above, evaluations performed should be done with a realistic mindset, “Would the incident take place unbeknownst to security personnel, who should be monitoring the CCTV-S at access points in real time? Is it even current protocol for them to constantly do this during business hours? If they would, in fact, observe this incident in real time what defense, alert systems and countermeasures are they trained to initiate?” E.g., would they initiate a facility lock-down protocol, immediately disabling the entire badge entry system leading from the exterior to the interior of every building, then broadcast an emergency alert to all employees describing what happened and where? Do they even have that ability? Are they immediately contacting law enforcement personnel? Can they dynamically engage and disengage these access protocols to not restrict movement of the ART or Law Enforcement Officers?

Identify roles and responsibilities, while designing redundancies in the event of a failed mechanism. Restricting access to law enforcement, while an active shooter maintains full access, will ultimately cost personnel safety. The capability of the system should be measured, evaluated, and periodically tried for effectiveness. Also important is the need to identify How, where, and when the incident might occur. The organization should fully understand their capability, and design their plan and training accordingly. "What are we capable of and how much time does it take to mount a response? What are the roles and responsibilities of everyone?”

Reducing response time is essential to saving lives. Response time is reduced by effective early detection and warning systems, and the action taken by those responsible for specific task (e.g. evacuations, personnel accountability, situational reports to inbound law enforcement regarding where the shooter is or their status - dispatched or still roaming the premises, triage, etc.). 

Continuing on – in the event defense mechanisms are defeated (defense mechanism are physical inhibitors or barriers), the course of action is to defeat the threat. This is the last piece of it

If the shooter has gained access by force, or because they are an employee with an access card, the severity and detrimental impact of the incident has been escalated greatly. The mission of personnel safety has legitimately been put at risk. If it does happen, the business should have proactively considered the fact that until law enforcement arrives, or somebody else takes it upon themselves to engage and dispatch the threat(s), the threat will roam freely and unchallenged.

If the business decides that they do not want to have an armed response team (ART), other methods can buy critical seconds, even minutes, to trapped personnel who could not egress. One effective way to do this, is to place Door Security Bars in every room that DOES NOT have any windows, where the doors open towards the interior of the room. Employees ought to be trained to know where these rooms are, and how to effectively use the DSB’s. DSB’s should be in place regardless of the business having an ART, however. It is important to train employees to know that hiding should be a secondary action ONLY when they cannot escape, and fighting should be a tertiary action if the first two options are taken off the table. This should be implicitly stated, bold, and underlined in any training material/sessions. We do not run to hide, we run to completely leave the area, facility, and property entirely. 


At an individual level, the same high-level approach should be taken – tactical procedures and protocols, with the safety of yourself and those around you being the mission.

In each environment you find yourself (whether at work, or at your local mall), apply these principles dynamically – RUN, HIDE, FIGHT. Your first action, if possible, should always be to egress off the X. Moreover, get as far away from it as possible. Run if you can. Hide if you cannot run. Fight if you cannot hide. Again, do not run to hide. Run to get as far away as possible.

Questions you might ask to proactively assess risk in your immediate environment are, “Where are exits relative to my current location? Are there others with me (kids, for example) who will need physical assistance to move quickly? Do I have a fair vantage point over the entire restaurant (early detection and warning)? How might a plan change if I was alone vs with family? Do others need my help to escape? Am I capable of fighting without becoming a liability?”

That last question is extremely important to consider and answer honestly. If you find yourself in such a situation, you must own your actions and their consequences. DO NOT become part of the problem. Understand that you will always be on the defensive end at first, and you are useless if you get yourself (or worse, others) killed by making poor decisions and using bad judgement.

There is absolutely no shame in realizing you have been ambushed, and outgunned; then having the sense to begin a retreat. In fact, this is preferred and not only gets you far from danger, it allows you to assess the magnitude of the situation at hand, and possibly be of use in the aftermath providing triage to the injured, or statements to the police. Again, you are responding to another’s actions, which is not ideal from a tactical perspective, but a response (even if that response is to move yourself or others to safety) is better than no response. Have a plan and execute it quickly.

Your own, personal, CI Management Plan should also be discussed with your family if you have one. Communicate as you move them to safety and/or get them out of the way so you can engage. Do not be reckless and start shooting back from across the restaurant while you and your kids are sitting conveniently next to an exit. Move. Assess. We do not advocate you ignorantly deciding to be the hero, when you have not gathered necessary information about the severity and full spectrum of the the incident unfolding before you. Personally, we might consider the following:

"How many gunmen are there? Can I truly confirm that number right now? What type of weapon is being used? Do I hear multiple weapons and/or cadences of fire? Are they wearing body armor? Do I have a tourniquet and triage kit on me in case I get shot? How many spare mags and ammo am I carrying right now to deal with the situation? In my response, can I introduce a dynamically changing engagement for the shooter, that they'd be forced into a disadvantageous position? Am I confident I can handle it before the police arrive on scene?"

In addition, my favorite – “when the cops show up and interrupt the engagement, how are they going to know that I’m not one of the bad guys?” If you are going to take it upon yourself to handle the situation, and you've done nothing to ensure they can ID you as a good guy, you had better cross your fingers that they give you a command when they arrive on the scene, see you, and act on the very limited information flooding into their radios by dispatch: “Active shooter at <location>, white male, brown hair, wearing blue jeans and a white T-Shirt”.

Depending on what you are truly dealing with, the collective answers to each of the questions above have the potential to get you killed in a hurry. Give it some quick thought. Take the course of action that makes the most sense.

RUN, HIDE, FIGHT. You might also say "Move", hide, fight. Mobility increases your chances of survival. Mobility = survivability.

Think before you act if you have time to do so. And if you are given the opportunity, do that thinking away from the chaos. It could save your life.

Back to the organization's responsibility - do that thinking before the chaos and it will save lives.