Active shooter preparedness basics are the actions, plans, training, building controls, communications, and medical resources that help people survive an active attack. The immediate individual framework is Run, Hide, Fight: evacuate when a safe path exists, secure and silence yourself when it does not, and resist only when facing imminent harm.
Key Facts at a Glance
The FBI recorded 48 active shooter incidents in the United States in 2023, with 105 people killed and 139 wounded.
Run, Hide, Fight is a decision framework, not a rigid three-step sequence that applies identically in every room.
A locked door, a clear evacuation route, a reliable alert, and rapid bleeding control address different points of the survival chain.
Organizations should use plain-language alerts, redundant communication channels, accessible procedures, and recurring practice.
A preparedness plan must cover employees, visitors, contractors, children, people with disabilities, and people who do not speak the dominant local language.
Fire exits must remain usable. Security measures that obstruct evacuation or violate fire codes create a separate life-safety hazard.
What Do Active Shooter Preparedness Basics Cover?
Active shooter preparedness combines individual behavior, emergency management, physical security, communication, medical response, and recovery planning. The strongest plans do not depend on one product or one slogan because an attack can begin inside a controlled building, during a crowded event, or when normal communications fail.
The U.S. Department of Homeland Security defines an active shooter as “an individual actively engaged in killing or attempting to kill people in a confined and populated area.” The FBI uses a substantially similar definition and notes that victims may be selected randomly or without a discernible pattern. The term describes behavior, not a diagnosis, identity, or motive.
Preparedness is different from prediction. Threat assessment and reporting systems may identify concerning behavior, but they cannot guarantee prevention. Response planning accepts uncertainty and gives people usable choices during the minutes before police intervention.
Why does preparedness use multiple layers?
Each layer solves a different failure. Training helps a person recognize danger and decide; a locked door can delay entry; an emergency notification can warn people outside the immediate scene; and a trauma kit can reduce blood loss while responders travel.
A practical plan therefore connects:
- People: trained staff, floor wardens, reception personnel, and designated coordinators.
- Place: doors, exits, sightlines, access zones, assembly areas, and shelter locations.
- Process: alerts, evacuation, accountability, reunification, medical care, and recovery.
- Partnerships: law enforcement, fire services, emergency medical services, building owners, and mental-health providers.
What Should You Do During an Active Attack?
During an active attack, first move away from the threat if a reasonably safe route is available. If evacuation is not feasible, secure a room, silence devices, and remain out of sight; if escape and hiding are impossible and a person faces immediate violence, taking decisive action may be the final survival option.
The Department of Homeland Security and FBI popularized the Run, Hide, Fight framework, but the framework is not a promise that every incident follows a predictable order. A person may need to hide first, move later, or leave a building through a route that was not the normal evacuation path.
Step 1: Run when a safe route exists
Leave immediately when the route moves away from the threat and does not require crossing the danger area. Use the nearest safe exit, a window when appropriate and safe, or another route identified by changing conditions.
- Leave bags, laptops, coats, and other belongings.
- Encourage nearby people to move, but do not delay for people who refuse.
- Warn people you encounter not to enter the danger area.
- Keep moving until you reach a secure location well away from the building.
- Keep empty hands visible, follow police commands, and avoid sudden movements.
- Do not gather at the front entrance, where arriving responders may need access.
- Call 911 when safe, providing location, direction of travel, descriptions, injuries, and weapons information if known.
Running toward an alarm without confirming its source can be dangerous. A fire alarm may indicate fire, violence, or a deliberately confusing event, so use available information and avoid routes leading toward gunfire, shouting, smoke, or fleeing crowds.
Step 2: Hide when evacuation is unsafe
Choose a room or area that places substantial barriers between people and the threat. Lock the door, reinforce it only when doing so does not trap occupants, turn off lights, silence phones completely, and remain quiet and out of sight.
Cover may reduce the chance of injury by stopping or deflecting projectiles. Concealment only hides a person from view. A concrete structural wall may provide more protection than a drywall partition, while a desk or curtain may conceal but not stop bullets.
Do not open the door because someone knocks or claims to be police. Police procedures vary, and a person inside may not be able to verify identity. Follow official instructions when they are communicated through a reliable channel, and leave only when the route is safer than remaining in place.
People with mobility limitations need alternatives established before an emergency. Plans should identify refuge areas, evacuation chairs where appropriate, buddy systems chosen with consent, accessible exits, and a method for communicating a person’s location without making unsupported assumptions about what assistance they want.
Step 3: Fight only as a last resort
Fighting is a last-resort response when a person is in immediate physical danger and cannot safely run or hide. The objective is survival and interruption of the attack, not pursuit, confrontation for its own sake, or attempts to capture a fleeing person.
If forced to act, commit to protecting life, use available objects to create distance or disruption, and coordinate with others when coordination is possible. Do not retrieve a weapon, leave cover, or search for the attacker when escape or secure hiding remains available.
The FBI’s public guidance summarizes the response as “Run. Hide. Fight.” The phrase is useful because it is memorable, but organizations should teach the conditions behind each choice rather than requiring employees to recite a slogan under stress.
How Should an Organization Build a Response Plan?
An organization should begin with a site-specific emergency action plan, a named owner, a hazard assessment, and coordination with local responders. The plan should state who may issue an alert, how people evacuate or shelter, how visitors are accounted for, and how the organization resumes operations after the incident.
A federal workplace plan commonly includes emergency reporting, evacuation procedures, accountability, medical assistance, employee contacts, training, and plan review. OSHA’s workplace violence guidance also emphasizes management commitment, worksite analysis, hazard prevention, training, and recordkeeping.
What belongs in the written plan?
| Plan element | Minimum specification | Review trigger |
|---|---|---|
| Emergency notification | SMS, email, public address, desktop alert, and website status page | Annual test or vendor change |
| Evacuation | Two routes per occupied zone and an exterior assembly area | Construction or occupancy change |
| Shelter | Lockable rooms, door hardware, occupancy limits, and accessibility review | Furniture or access-control change |
| Accountability | Visitor log, employee roster, contractor list, and last-known-location process | Quarterly roster update |
| Medical response | AED locations, bleeding-control kits, trained staff, and EMS access point | After every drill or incident |
| Command roles | Incident lead, communications lead, facilities contact, and liaison to responders | Staff turnover |
| Recovery | Family notification, counseling referral, continuity plan, and evidence preservation | After an incident or major exercise |
A plan should use ordinary language. “Shelter in place in Room 204” is more actionable than an internal code that new employees, visitors, or emergency dispatchers may not recognize.
How often should plans and training be reviewed?
Review the plan at least annually and after construction, a change in occupancy, a new access system, a serious threat report, or an actual emergency. Provide orientation for new workers and short refreshers at least annually, with additional practice for reception staff, supervisors, security personnel, and floor coordinators.
Training should progress from discussion to guided walk-through and then to a controlled exercise. Unannounced simulated gunfire can traumatize participants, trigger emergency calls, and teach unsafe habits when the exercise lacks professional design.
Which Security Measures Provide the Most Value?
The best first investments are usually clear procedures, reliable communication, functioning locks, visible exits, and bleeding-control capability. Expensive glazing or biometric access control can help in selected locations, but neither substitutes for a staffed response plan or a door that occupants can actually secure.
| Measure | Typical cost | Typical deployment | Primary benefit | Main limitation |
|---|---|---|---|---|
| Online awareness training | $15-$50 per user | 1-3 hours | Rapid baseline instruction | Skills decay without refreshers |
| Instructor-led exercise | $2,000-$7,500 per session | 2-4 weeks planning | Tests decisions and communications | Poor design can cause harm |
| Mass notification system | $2-$8 per user annually | 1-2 months | Reaches people beyond the scene | Requires current contact data |
| Bleeding-control kit | $60-$120 per station | Same day to 2 weeks | Supports hemorrhage response | Requires training and inspection |
| Security window film | $10-$22 per square foot | 1-2 weeks | Delays glass breach | Does not stop all projectiles |
| Electronic access control | $2,500-$6,000 per door | 3-6 weeks | Controls movement between zones | Power, fire-code, and privacy issues |
What is the difference between security and safety?
Security delays unauthorized movement, while life safety preserves evacuation, fire protection, and emergency access. A door that locks from the inside may protect occupants during an attack, but it must not prevent lawful egress or create a dead-end hazard.
Security film is frequently misunderstood. Typical security film can help hold broken glass together and delay forced entry, but it is not equivalent to bullet-resistant glazing and should not be described as ballistic protection without a tested assembly and rating.
Access control also has an internal-threat limitation. A credentialed person, employee, contractor, or visitor may already be inside the protected perimeter, so organizations need reporting channels, behavioral threat assessment, and response training alongside electronic locks.
Training or Hardening: Which Should Come First?
Training should come first when an organization lacks a usable plan, has many uncontrolled entrances, or needs protection across several sites quickly. Physical hardening deserves priority when a risk assessment identifies a specific delay opportunity, such as an exposed reception area or an interior door that cannot be secured.
| Decision factor | Training-first approach | Hardening-first approach | Practical decision |
|---|---|---|---|
| Initial budget | $15-$50 per online learner | $2,500-$6,000 per controlled door | Start with training under $10,000 |
| Speed | Same day for online content | 3-6 weeks for door projects | Use training for immediate coverage |
| Portability | Applies across sites | Fixed to one building | Multi-site employers favor training |
| Failure mode | Forgetting or freezing | Misconfiguration or blocked egress | Audit both after installation |
| Internal threat | Helps all occupants respond | May not stop authorized access | Add reporting and assessment |
| Fire-code impact | Minimal when classroom-based | Requires professional review | Consult fire officials before work |
A counterintuitive practitioner rule is that a locked door has little value if employees do not know which doors lock, whether the hardware works, or where to go when the normal exit is unsafe. Test the behavior before expanding the hardware.
How Can Organizations Practice Without Creating Trauma?
Organizations can practice safely by using announced, progressively structured exercises that begin with education and end with a documented after-action review. A discussion-based exercise may take 30-60 minutes, while a multi-department walk-through often requires 2-4 weeks of planning and responder coordination.
Use these stages:
- Explain: Teach the framework, alert terms, exits, room security, accessibility options, and law-enforcement arrival procedures.
- Walk through: Inspect doors, routes, assembly points, communication channels, and medical equipment without simulated violence.
- Tabletop: Give leaders a fictional scenario and test decisions, notification, accountability, and family communication.
- Functional test: Send a clearly labeled test alert and verify delivery, translation, screen-reader access, and acknowledgment.
- Review: Record failures, assign owners, set deadlines, and retest the corrected process.
Never use realistic weapons, blanks, fake blood, surprise physical contact, or unexplained lockdowns in routine workplace training. Schools and healthcare facilities should involve mental-health professionals, parents or guardians where appropriate, unions, disability representatives, and local responders before conducting exercises.
What Should Emergency Alerts Say?
Emergency alerts should identify the hazard, location, action, and update source in plain language. The message should avoid unverified descriptions, coded terms, and unnecessary details that could direct people toward the threat.
A useful initial message contains:
- Hazard: “Active threat reported.”
- Location: “North entrance and first-floor lobby.”
- Action: “Avoid the area. Run from danger or secure your room if evacuation is unsafe.”
- Status: “Call 911 when safe. Await verified updates from Security and Police.”
- Accessibility: Provide text, audio, visual, translated, and captioned formats where needed.
Notification systems should be tested through SMS, email, desktop alerts, public address, digital signage, and a website or hotline. A single channel can fail because of poor reception, overloaded networks, dead batteries, hearing loss, or people working away from desks.
What Medical Preparedness Is Needed?
Medical preparedness should place bleeding-control kits and automated external defibrillators where trained people can reach them without entering the danger area. A kit commonly includes pressure dressings, gauze, tourniquets, gloves, trauma shears, and a marker, with contents selected and inspected under qualified medical guidance.
The first medical priority during an ongoing attack is personal safety. People should not enter an unsecured area to treat casualties, and organizations should define the transition from police operations to fire and EMS access before an incident occurs.
Typical planning quantities depend on building size and hazard assessment. A small office might begin with one bleeding-control station near the AED and one near a major exit, while a campus or warehouse may need stations across zones, documented inspection dates, and trained staff on every shift.
What Common Planning Mistakes Reduce Survival?
The most damaging mistakes are usually operational rather than technological. Organizations often purchase alerts or locks before confirming that employees understand the messages, doors, routes, accountability process, and limits of each measure.
- Blocking exits with security equipment: Use only devices approved by facilities, fire officials, and the authority having jurisdiction.
- Using vague codes: State the hazard and action in plain language.
- Ignoring visitors: Include reception logs, contractors, delivery workers, customers, and event attendees.
- Planning only for an outsider: Include insider threats, domestic violence spillover, and credential misuse.
- Treating drills as performances: Measure alert delivery, time to secure rooms, route availability, and accountability.
- Neglecting recovery: Prearrange counseling referrals, family communication, payroll continuity, media coordination, and evidence preservation.
- Overpromising technology: Cameras and gun-detection systems can generate alerts, but people still need verified instructions and safe choices.
An honest limitation matters: no preparedness program can guarantee prevention or survival. Run, Hide, Fight cannot resolve every crowded-space geometry problem, and physical barriers cannot eliminate risk from someone already inside; layered planning reduces exposure without creating certainty.
How Should Preparedness Change by Setting?
Preparedness should match the setting’s occupants, layout, operating hours, and emergency-service access. A retail store needs customer direction and service-area routes, while a school needs classroom procedures, reunification, substitute-teacher orientation, and age-appropriate communication.
| Setting | First priority | Specific control | Special consideration |
|---|---|---|---|
| Office | Alerting and room security | Testable locks and zone maps | Hybrid workers and visitors |
| School | Classroom response and reunification | Interior locking procedures | Children, families, substitutes |
| Retail | Staff-led customer movement | Back-of-house exits | Crowds and unknown occupancy |
| Warehouse | Radio and shift coverage | Marked zones and access points | Noise, machinery, limited sightlines |
| Healthcare | Care continuity | Unit lockdown and patient movement | Patients unable to self-evacuate |
| Place of worship | Greeter awareness and alerts | Multiple exit assessments | Open doors and mixed-age groups |
Small organizations can appoint a plan owner, map two routes per occupied area, verify door operation, install a tested alert tree, place medical supplies, and conduct a 60-minute discussion exercise before purchasing complex systems.
Large organizations need governance. A security director may own physical controls, human resources may own training and support, facilities may own doors and routes, and an incident-management team should coordinate with police, fire, EMS, and building management.
What Is the Practical Preparedness Checklist?
A practical checklist converts policy into observable conditions. An organization is not ready because a document exists; it is closer to ready when people can find exits, receive an alert, secure an appropriate room, report their location, and access help without entering danger.
Before an incident
- Name an emergency-plan owner and backup.
- Map two exits and two shelter options for each occupied zone.
- Test door locks, panic hardware, lighting, and emergency power.
- Maintain employee, visitor, and contractor accountability methods.
- Configure multilingual, accessible, multi-channel alerts.
- Coordinate procedures with police, fire, EMS, and property management.
- Place and inspect AEDs and bleeding-control kits.
- Train new personnel and refresh existing staff annually.
- Include people with disabilities in planning and exercises.
- Establish confidential threat-reporting and behavioral-assessment procedures.
- Document family notification, reunification, counseling, and continuity plans.
During an incident
- Move away from danger when a safe route exists.
- Leave belongings and keep hands visible.
- Secure, lock, barricade, silence, and hide when evacuation is unsafe.
- Call 911 when safe and provide actionable location information.
- Do not open a secured door based only on an unverified voice.
- Follow police instructions and keep hands empty and visible.
- Provide medical aid only when the area is safe.
After the incident
- Account for people without exposing anyone to danger.
- Preserve evidence and avoid unnecessary movement through affected areas.
- Direct families and media to designated contacts.
- Offer trauma-informed support and practical assistance.
- Conduct an after-action review within a defined period.
- Correct failures, document owners, and retest the plan.
Frequently Asked Questions
Is Run, Hide, Fight appropriate for every emergency?
Run, Hide, Fight is designed for an active attacker, not every emergency. Fire, hazardous-material releases, severe weather, earthquakes, and suspicious packages require different actions, and an organization should avoid teaching one response as a universal substitute for its full emergency action plan.
How can a person prepare without carrying a weapon?
A person can prepare by noticing exits, keeping a charged phone, learning how to report an emergency, understanding workplace or venue alerts, and taking qualified bleeding-control training. Familiarity with routes and room-security options usually requires less equipment and creates fewer legal and safety complications than carrying a weapon.
Should employees receive active shooter training every year?
Annual refresher training is a reasonable baseline for most organizations, with shorter reminders after renovations, staff turnover, or plan changes. Receptionists, supervisors, security staff, and floor wardens may need more frequent practice because their decisions affect visitors, communications, and access to responders.
Can security doors violate fire codes?
Yes. A security door, barricade, or access-control system can violate fire and building requirements if it delays lawful egress, lacks approved hardware, or prevents emergency responders from entering. Facilities teams should obtain review from the authority having jurisdiction before installation and test the complete system afterward.
What should a school do about parent communication?
A school should separate emergency instructions from reunification instructions. The first message should tell families whether to avoid the campus and where verified updates will appear; later messages should provide an approved reunification location, identification requirements, transportation details, and a process for children whose guardians cannot arrive.
What is the first preparedness project for a small business?
The first project should be a site walk-through that identifies exits, lockable rooms, alert recipients, visitor records, medical supplies, and emergency contacts. A small business can then conduct staff training and a tabletop exercise before selecting hardware, because the exercise reveals which physical improvements deserve limited funds.
The Bottom Line
Active shooter preparedness basics begin with a site-specific plan and a simple individual rule: run from danger when a safe route exists, hide securely when it does not, and fight only as a last resort against imminent harm. Organizations should add accessible alerts, working doors, recurring training, medical supplies, responder coordination, and recovery support. The strongest program tests behavior, corrects failures, and treats physical security as one layer of a broader life-safety system.
