Skip to content
Chess pieces arranged in strategic positions.  What is situational awareness?

Illustration by Security Managment; iStock

How to Improve Your Situational Awareness 

Often oversimplified as “See Something, Say Something,” situational awareness (SA) is a consequence of the mental process of collecting an observation, using expertise to orient or understand what was observed, and then, if needed, making a prediction of potential outcome to inform a response.

These predictions may be imperfect, but they can offer potentially life-saving glimpses into the future. As with most skill sets, experience makes all the difference, and SA can be honed. One way to improve SA is through understanding its core elements. SA applies to nearly every aspect of life, but its value is perhaps most apparent in the moments prior to an active shooter attack. Situational awareness can provide the forewarning needed to save lives.

Imagine being a security officer outside of a high school. The human eye is drawn to movement, so you observe a vehicle arriving. Nothing suspicious, just a change to the normal or baseline traffic pattern. You notice an Uber sign on the car as a student-aged male exits. You realize it is odd for students to arrive via Uber, especially near the end of the school day. The student moves away from the car, and you observe he is carrying a large black nylon case. As you orient or assess the situation, you realize it might be a rifle case. Highly focused, you recognize the person is an expelled student. The survival aspects of SA kick in, and you predict the situation is dangerous. You decide to act, implementing a campuswide lockdown and calling for police. This is an example of how SA could provide forewarning and save lives.

The ultimate function of SA is to enhance survival by predicting dangerousness. This requires recognition and analysis. The more effective the analysis, the more accurate the subsequent prediction. Occasionally, this process happens so rapidly it can be described as intuition.

Breaking the Law of Least Effort

“Intuition is recognition. Nothing more, nothing less,” said Nobel laureate, economist, and psychiatrist Daniel Kahneman.

chart-observe-orient-decide-act.gifPeople are hardwired for survival, but the programming is incomplete—it needs additional data, especially when dealing with modern environments and hazards. Our brains eagerly complete the coding by cataloging potential dangers in mental file folders called schema.

Each schema contains information about an experience, and while they are not limited to dangerous incidents, this type of schema seems to be more easily created and more readily accessible to help protect us from future hazards. For instance, touching a hot stove once is usually sufficient to form a schema that lasts a lifetime.

Schema also help with more complicated processes, and the more comprehensive and accurate the file folders on a specific topic, the greater the person’s expertise. This allows the person to orient more effectively and decide the best possible response faster. (This series of actions—observe, orient, decide, act—is known as the OODA loop, which is widely used but was first coined by U.S. miltary strategist Colonel John Boyd.) In time-critical situations, these mental file folders create tactical shortcuts. These rapid conclusions are often referred to as intuition.

Intuition is not innate, but as expertise is developed, people can rapidly access their library of knowledge to apply case-based reasoning to solve novel or new problems. When a new problem is presented, it is compared with all the cases in the library, and the case that matches most closely is used to solve the new problem. A toddler walking toward a busy street can observe the moving cars, but he or she does not have the expertise to appropriately predict danger. A 5-year-old, on the other hand, can use case-based reasoning to refrain from walking in front of something that is harmful, even if he or she has not seen the hazard before—applying knowledge about the danger of moving cars to trains or other vehicles.

[ Stay Aware of Threats. SM7 Newsletter: Sign Up ]

The mind’s ability to recall and apply lessons learned is astounding; but also, imperfect. In his best-selling book Thinking, Fast and Slow, Kahneman explains how our brains process information. The mind has two systems, he says: system one handles reflexive tasks, like 2 + 2, and system two takes over when the task calls for deliberate thought, like 17 x 34. Whenever possible, the brain will default to system one to save energy. Kahneman calls this the law of least effort. 

Intuition, which is sometimes described as rapid recognition or “knowing without knowing why,” is reflexive and resides in system one. Problems arise when the situation requires more analysis than system one can handle. This is not to suggest intuition is always wrong—it is certainly not. Intuition is typically right in two ways: it acts in response to something, and it acts in your best interest. However, intuition is fallible and should be questioned, especially when making high-stakes predictions.

For an example, answer this basic math problem in your mind as fast as possible:

A baseball bat and ball cost $1.10. The bat costs $1.00 more than the ball. How much does the ball cost? 

Unless you have seen this problem before, your intuition probably came up with 10 cents, which is wrong. System one thinking made a quick calculation of subtracting one dollar from the total and assumed the balance of 10 cents was the answer. The correct answer is the ball costs 5 cents, meaning the bat costs $1.05—bringing the total to $1.10.


While intuition is imperfect, the life-saving value of rapid recognition should not be discounted. The book Left of Bang, which is based on the U.S. Marine Corps Combat Hunter Program, provides the following example. In the summer of 2004 in Mosul, Iraq, Sgt. First Class Edward Tierney was with his squad on patrol when the group observed a car parked on the sidewalk. Inside were two boys staring at the soldiers. The car was not aligned with traffic, the windows were up, and it was extremely hot. One soldier asked if he could provide the boys with water. Tierney observed, rapidly oriented, and correctly predicted danger. He ordered his men to fall back, and the vehicle exploded. No soldiers were killed or seriously injured.

People are the only creatures that willingly ignore warning signs. When a gazelle in the wild perceives danger, it will flee. It will not try to convince itself to be braver or less paranoid. However, humans are also the only creature capable of questioning intuition. System one thinking is excellent at observation, but its strength is not orientation. Whenever time allows, break the law of least effort and fully orient before moving towards danger.

Color-Coding Awareness

Like most abilities, there are varying levels of SA. Jeff Cooper, a U.S. Marine and innovator of tactical training, pioneered the concept of color-coding awareness levels, and his system—Cooper’s Color Code—has been used to train military and law enforcement for decades. There is often overlap between levels, but the code helps to organize SA into useful categories.


White is the lowest level of SA, but it is absolutely necessary. Being asleep is at the extreme end of this level, but no one can maintain SA during all waking hours. As the mind relaxes, it loses both system one and system two abilities.

Yellow is the goal for most situations. It represents being both prepared and relaxed. This state allows both systems one and two to function, bringing intuition and complex problem-solving abilities to the table.

Orange is a state of focus and alertness to possible danger. The downside is it can create focus lock, which occurs when the mind is focused on a single thing. Sometimes focus lock is needed. For instance, if a police officer is told be on the lookout for a red SUV, he or she will often experience focus lock. Officers will be somewhat oblivious to other criminal activity to maintain a heightened ability to observe a red SUV. Sometimes focus lock is the result of a distraction, like looking at a social media feed on a smartphone. There are times when focus lock is acceptable, or even desirable—just choose those times intentionally.

The orange state is mentally taxing and cannot be sustained for long periods. Neither can red—action mode, where all focus is on the emergency at hand. Black is panic mode, which is a breakdown in physical and mental abilities. Panic is a stress response often associated with fear, and it has no survival value.

These levels have varying shades, and the mind can easily transition from level to the next. Bypassing levels under stress is difficult, though, and surprises tend to make people skip over different levels. We have all experienced being startled awake by a simple phone call that poses no threat. If the startle out of white mode—whether the person was asleep or just zoned out—came from imminent danger, panic is more likely to set in. Actively choosing when you are in the white or unfocused level of SA will help to mitigate the risk of such surprise escalations.

White should be reserved for places that you reasonably believe you are safe, such as your home. If you need to relax or focus on your phone in an unfamiliar area, take a moment to familiarize yourself with the nearest entrances and exits. This way, if an emergency startles you out of white mode, you can orient your escape faster. Mobility is survivability.

Yellow should be the goal when in public or at work. Being prepared, alert, and relaxed allows access to both systems of thinking, and it is sustainable for long periods. When something is observed that requires greater focus, it is easy to transition from yellow to orange. In the rare instances the situation requires an emergency action, progression from orange to red is efficient. Typically, a de-escalation from orange back to yellow is easy.

Pattern Detection

For most people, safety is the norm, and most of our patterns of life are routine. Recognizing these normal patterns as the baseline makes changes, or anomalies, more obvious. This also reduces what we have to observe. It does, however, require you to be alert.

Developing good habits and practicing them are critical to sustaining SA. And, because people are almost always the greatest risk, a system of observing people is vital. Sam Walton, the founder of Walmart, is credited with instructing employees to make eye contact and greet every customer they meet. Many major luxury hotel chains used this concept to create the 10/5 rule for guest interactions.

This makes for excellent customer service, but with a little understanding of what makes people dangerous, it enhances SA by engaging system one thinking to identify potential threats. A slight modification to the rule is the 20/10 guide: At around 20 feet away, make eye contact and either smile at the person or maintain a neutral expression. Quickly glance at the person to notice their attire and any objects they are carrying. At around 10 feet away, offer a friendly greeting. This approach allows you to notice carried objects, body language, and facial expressions.

Facial expressions can be an effective way to estimate the emotion of someone near you. Research studies have shown people can identify six basic categories of emotions: happiness, surprise, sadness, anger, fear, and disgust. The emotional expressions of a dangerous person are most likely to be fear and anger, but a broader SA approach should consider other factors such as carried objects and body language, not just facial expressions. Another element to consider is if the facial expression aligns with the general mood of the situation. For instance, a person showing disgust at a political rally, when most other people are happy, could be a concern.

In almost all cases, the person most responsible for your safety is you. To quote retired special operations veteran and author Patrick McNamara, “You are the agent in charge of your own personal protection detail.” In crowded environments, pay attention to the general mood of the crowd. Is it relaxed, anxious, happy, volatile? If people sense danger or intend to inflict violence, their demeanours will change. If you are attuned to these moods or atmospherics, you can respond more quickly.

Atmospherics describes the collective attitudes or mood within an environment. Sometimes that is controlled by the space, such as a casino that wants you to stay longer, but other times atmospherics are driven by the people around you. If you have ever arrived at a friend’s home and interrupted a spousal quarrel, you understand. No one needed to tell you something was off.

Reading atmospherics helps in crowded public places because it is impossible to scan everyone. Universal indicators of imminent danger—like a person aiming a weapon, major anomalies, or changes to the baseline—are easily observed. But other indicators are more subtle. Rather than trying to observe everyone, there are groups of people that, absent an overt hostile act, can be statistically discounted as a threat. Outliers exist in any statistical groupings, but past attacks indicate that members of these groups do not pose a significant risk of an active shooter type attack.

Families. While family groups are usually uninvolved in mass violence events, this does not mean attackers cannot pose as a family to try and lessen their profile.

Children younger than 10. The 1998 Westside Middle School shooting was carried out by an 11-year-old and a 13-year-old. After triggering a fire alarm to force evacuation, the killers waited in the woods to ambush staff and students, killing five and wounding 10. However, young children have rarely been perpetrators of mass violence incidents.

Men older than 70. This age may increase. The killer in the Las Vegas Route 91 Harvest Music Festival shooting was 64, and the shooter in the 2010 U.S. Holocaust Museum shooting that killed a museum special police officer was 88 years old.

Groups of intended users. A group of five or more people who are using the location for its intended purpose are unlikely to pose a threat of mass violence, such as an active shooter. However, an attacker could attempt to piggyback or join intended users to soften his or her profile. Large groups may be a greater risk for assault, as being part of a group can lead to heightened emotional states that include excitement, anger, and hostility.

Know Your Battleground

Watching people is critical, but not enough. SA requires understanding your environment. An operational environment analysis (OEA) is the process of assessing a location as it pertains to your safety. Far less in depth than a security assessment, an OEA involves locating exits or paths of escape, defining intended users, and determining patterns of movement and typical behavior, which can include attire and carried objects. Understanding the environment enhances your ability to make decisions when it is time to act. Pay special attention to places where you spend the most time.

At home. Consider interior rooms that could provide a layer of safety from an intruder or severe weather. Ensure these areas have access to communication and tools for protection. Note all paths of escape, including windows. Practice opening them or place an object nearby to break and clear away glass.

At work. Consider areas that will provide protection—remember that thin walls or cubicles offer little to no cover from gunfire. Evading a human threat may be your best option. Locate objects that could provide cover along paths of escape. In a rapid evacuation, most people will attempt to flee via their same path of entry. This causes unacceptable risks and delays. At the 2003 fire at the Station nightclub in Rhode Island, the vast majority of the incident’s 100 victims became trapped at the main entrance, despite numerous other exits and ground floor windows.

Escaping a building via a window may be the best option in an emergency. Obviously lower windows are safer, but there is no way to guarantee safety.

Escaping from a ground floor window offers virtually no risk. From the second floor (10 feet), a jump is highly survivable if the person’s head is protected, but leg injuries are possible. From the third floor (20 feet), serious injuries should be expected, but the fall is survivable if the head is protected. Dropping from above 25 feet poses an extreme risk to life. The higher the distance, the lower the probability of survival.

A 2005 French study, Prognostic factors in victims of falls from height, examined 287 victims of falls. Factors that determined survivability included height of fall, age, impact surface nature, and body part that first touches the ground. In this study, 100 percent of falls from higher than 30 meters (98 feet) were fatal. Knowing the approximate height of windows before an emergency helps prepare people to make decisions under stress.

Situational Action

“In a moment of decision, the best thing you can do is the right thing, the worst thing you can do is nothing,” said U.S. President Theodore Roosevelt. The predictive element of SA allows people to prepare for action. In a time-critical situation, you simply cannot allow perfect to be the enemy of good.

In the OODA loop, observe and orient are elements of situational awareness. Decide and act complete the cycle, and they represent situational action.

The amount of time you have to decide or formulate a plan is dependent upon a number of factors that are likely out of your control. When time is of the essence, it may be necessary to sacrifice perfection for timeliness. One philosophy is to aim for an 80 percent solution, meaning that the decision maker can move quickly to implement a plan that most likely addresses most of the problem. In an emergency, recognizing the extent of peril and rapidly developing an 80 percent solution can save lives compared to taking the time to attempt to develop a theoretically perfect response.


While the 80 percent approach has countless non-emergency applications, in an emergency, the priority must be saving lives. For instance, if an active shooter is in a crowded school hallway, an 80 percent solution could be ordering students to run away from the shooter to the nearest exit. Is this response perfect? No. There could be another shooter, and this rapid evacuation will make student accountability a challenge. However, the response will likely remove the most students from direct contact with a shooter as fast as possible. SA comes into play here as well—it helps people better predict danger and quickly develop a plan of action.

A key premise of the 80 percent solution is training. In an emergency, people do not rise to the occasion—they drop to their lowest level of training. If they are unprepared, fear will bring about panic and system two thinking will shut down and greatly reduce problem-solving abilities. It is imperative that organizations provide sufficient training so that 80 percent solutions are viable.

Proper training should instill the confidence to react under stress. An 80/20 solution accepts an imperfect plan and embraces change during execution. For instance, if a shooter is in a classroom, the priority must be to enter the classroom. There are numerous unknowns: Do I have adequate firepower? Where is the shooter in the room? Will students be in the way? A theoretically perfect plan may attempt to address these issues, but the cost is time. Sufficient training prepares an officer to move forward with an 80 percent solution that prioritizes entry.

The Probability of Courage

Fear and panic are connected. But in an emergency, fear is manageable; panic can be deadly.

Fear is generally classified as an emotion, whereas panic is defined as a physical response to stress. We can feel fear with panic, and we can panic without fear. When fear and panic are combined, the experience is more severe and can be termed extreme survival stress. This process starts with an observation that is perceived as threat to survival. Once the threat is perceived, absent a more logical survival plan, the brain’s amygdala sends an all-systems alert that triggers extreme survival stress or a severe level of black on Cooper’s Color Code.

Symptoms of extreme survival stress—none of which are conducive to surviving a modern-day emergency—include freezing, irrational decision making, submissive behavior, perception of slowed movement or time, high heart rate, shaking, or poor communication.

Surprise, when coupled with fear, can initiate panic and extreme survival stress. Often, SA can prevent or mitigate the surprise, preventing the subsequent stress response. If you have observed a person, oriented their movement, attire, body language and/or facial expression, and predicted that something is off, you are less likely to be surprised if the person is violent. Ideally, that prediction will prompt an 80 percent solution if things escalate. If you failed to observe the person until he or she is already in the process of an attack, panic is far more likely.

When properly honed, SA is your most valuable survival tool. It isn’t a mystical force, or a superpower limited to special operations. SA is a mental process that can be enhanced by comprehending how it works, observing people, understanding your environment, and continually improving your knowledge about the patterns of life.

Brad Spicer is a U.S. Army veteran and former law enforcement professional. Spicer has helped multiple U.S. states and school systems identify risks and develop all-hazards preparedness and response plans. Spicer is currently the national director of safety preparedness and emergency management for Navigate360.

© Brad Spicer, 2022

Editor's note: This article has been updated to include information attributing the OODA loop's development to Col. John Boyd.