Are You

First, a bit of background on lone perpetrator active threat events...


Hover or tap these for additional information
No specific character trait can predict the potential perpetrator of an active threat event.  Signs of the potential perpetrator’s instability usually exist prior to an event occurring and can include, but are not limited to, repeated interactions with law enforcement, threats communicated to others within or outside of the community, outbursts of emotional distress, physical violence against others, obsession with other active threat perpetrators, and/or the collection of weapons. Individually, these behaviors may not be alarming, but when multiple behaviors are exhibited, communities have the opportunity to take action.
By putting plans and measures in place for individuals to be empowered to report suspicious activities, communities can create intelligence networks that may alert public safety and others prior to an active threat.
Threats of violence are often communicated by perpetrators to individuals in their social and professional networks. After a threat of violence takes place, communities and organizations can take action to verify the credibility of the threat.  If credible, actions can be taken to mitigate the active threat event from occurring, including increasing protective measures, legal action, or counseling.  Putting plans in place to counter threats of violence may halt or reveal potential active threat events from occurring.
A security assessment is the ability to identify threats and incorporate this the information gathered into planning processes.
To conduct a security assessment, each location will need to identify internal stakeholders to be part of a security assessment team. By developing a security assessment team, communities have the opportunity to understand possible threats and hazards and prepare for such events. These teams can identify standards and guidelines for how to conduct security assessments and ultimately develop, implement, and update an actionable security assessment plan with short, medium, and long-term objectives.
Empowering members of a community to take action during an active threat event may save lives.  Training and exercising civilian responses such as Get Out, Lock Out, Take Out can help everyone out when seconds matter between life and death.
The immediate response to an active threat event will lie in the hands of True First Responders—the individuals who are immediately affected by an active threat event. True First Responders will be required to do what is necessary to survive.
Rapid deployment is relatively a new tactic used by law enforcement arriving on scene. This approach advocates that the first officer on the scene of an active threat should enter the area or building as fast as possible with the sole objective of neutralizing the perpetrator.
Additional priorities include protecting the lives of those in proximity of the potential perpetrator and the safety of fellow officers, as well as containment of the inner and outer perimeter. Officials will still work with SWAT and other special operations teams when they arrive on scene, but many jurisdictions have decided that they can no longer wait for a full team to arrive before going in to neutralize an active threat.
Professional first responders may take minutes to arrive at the scene.  It is imperative that individuals of an organization understand the power and control they have and the actions they must take in those beginning moments of an active threat event.
Complex Incident Management is the principle of evolving command in the immediate moments of an active threat event, where individuals are empowered to make quick, clear, and concise decisions in order to survive and save others before police, fire, and emergency medical personnel arrive.  As public safety partners arrive to the scene of the active threat event, command of the incident transfers authority a number of times as more senior responders arrive on scene until a formal incident command can be established.
Having plans in place and testing emergency alert messages on a regular basis is crucial for any organization’s preparedness. Training 911 Dispatchers on how to communicate with victims of an active threat event may increase the response time while protecting those caught in the active threat event.
In the immediate moments of an active threat event, it is crucial to let others in the immediate vicinity know that an active threat event is occurring, and to take action to save lives. As civilians in the immediate vicinity are taking action as True First Responders, 911 Dispatchers are going to be taking action to get the Professional First Responders – Police and Fire – to the scene as quickly as possible.
Once public safety partners arrive on scene to an active threat event, command and control of the response shifts from a single individual (usually a police officer) to a more rigid structure, known as Unified Command.  Part of the incident command system (ICS) concept, Unified Command allows agencies with different legal, geographic, and functional authorities and responsibilities to work together effectively without affecting individual agency authority, responsibility, or accountability.
As multiple agencies including law enforcement, fire, EMS, medical examiners, emergency managers, and volunteer organizations respond to an active threat event, Unified Command allows effective management of an active threat event as it unfolds.
The fast dissemination of content through media can inform the public of ongoing incidents almost as quickly as responders are informed. As a result, organizations can make sure the public is safely diverted from hazards and that information about situational developments is accurately disseminated to on-site personnel, visitors, or members. People must be immediately provided with as much information as possible, prompting them to take action. They need to know what is going on, where it is happening, and instructions they should follow if safe to do so (e.g., shelter in place, avoid a certain area).
The role of social media is redefining how information is gathered and shared with the general public.  Organizations and communities need to plan and train for how they will communicate with the general public, as well as use social media for rumor control and gathering intelligence as the active threat event unfolds.
A Rescue Task Force (RTF) is defined as a group of law enforcement, fire, and EMS personnel working together in the warm zone to deliver emergency medical care to victims. This is a method that is starting to be taught and adopted by organizations across the country. Law Enforcement establish a perimeter provides fire and EMS personnel a specific area in which they can operate without disruptions.
For most practitioners, zones are defined as:

Hot Zone: A dynamic environment where a current active threat is known, or believed to be present. This area is typically occupied by Law Enforcement and Tactical Emergency Medical Service units only.

Warm Zone: Area is which EMS personnel may operate as long as they are working in conjunction with a law enforcement protection element.

Cold Zone: An area in which command is established, equipment and personnel are staged while awaiting assignment and medical triage, treatment and transport operations take place.
The scene after an active threat event occurs is already a dynamic and unstable environment. After the perpetrator is neutralized, response shifts to accounting for and reunifying victims and bystanders with their loved ones.  This can be a difficult and overwhelming process, as organizations understood who and how they need to account for their employees, customers, guests, patients, and students.  Identifying a suitable location and ensuring that loved ones can be effective and quickly reunited begins the recovery process.
Organizations should develop reunification annexes as part of their larger emergency operation plan.  They should also train employees on how to run a reunification center and exercise their plan.
Organizations such as major crime task forces should be identified in the planning process of communities to ensure that investigators can be made available quickly.
An active threat becomes a crime scene, where victims and bystanders become potential witnesses to a criminal act.  The investigation of an active threat event can be a long process, from gathering evidence, to taken reports from witnesses, to trials and the commissioning of official reports.
One way to combat acute stress disorder and other emotional responses to active threat events is to provide short-term educational and psychological support services to individuals impacted by an active threat event through the use of “psychological first aid." Psychological first aid engages people and encourages them to talk about their experiences and teaches ways to manage stress.
After an active threat event, the road to recovery is a long one for impacted persons. Active threat events commonly precipitate psychological crisis reactions. Events like these will often induce a psychiatric disorder called acute stress disorder. Acute stress disorder’s onset usually occurs during or shortly after a traumatic incident and features symptoms including, but not limited to, dissociation, anxiety, avoidance, and recurrent thoughts related to the incident.
Communities and organizations need to think about how the reconstitute themselves following an active threat, including identifying a temporary facility to continue day-to-day operations of the school, house of workshop, or business that was impacted. As locations of active threat events are crime scenes, they will be inaccessible after an event while the law enforcement investigation takes place.
Organizations and communities affected by an active threat event need to have a plan to return to some degree of normalcy.  Identifying essential functions and the path towards normal operations can be a challenging process, especially when considering temporary facilities, roles that are essential, and the psychological, social, and economic impacts from an active threat event.


Whether you are part of an organization or a leader of a community wondering how you can prepare for an active threat or complex coordinated attack, there are several components to consider in order to have a robust and integrated active threat plan that spans from prevention to response and recovery. We call this the Life Cycle of an Active Threat Event.
Know what it takes to be





Hagerty is here to help. Our experts in active threat preparedness can assist your organization or community in developing plans, training opportunities, and exercises. We’ve helped organizations and communities across the country enhance their preparedness in a meaningful way.  Want to know more? Complete the form below and you will be contacted by a member of our active threat preparedness planning team.

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form

The first step to understanding how to strengthen your organization's active threat preparedness is knowing how threat ready your organization is.  Click below to download our "Are you Threat Ready" assessment tool to learn what actions to take when building a robust, comprehensive active threat program.


For more information, visit: