The Balancing Act: How Soft Targets Can Attract Guests While Discouraging Attacks
Those tasked with managing and protecting soft targets are often in a tough position—searching for balance between attracting members of the public and ensuring that among those seeking leisure or recreation there is not someone intent on causing harm or death.
For example, the 2023 mass shooting in Lewiston, Maine, occurred when a shooter walked into Just-In-Time Recreation, a bowling alley, during a youth league event and killed seven people. The shooter then traveled to a local restaurant and killed another eight people. Because restaurants and bowling alleys want to be welcoming and attract customers, they rarely have access control or other measures that could deter or delay an attacker.
Unlike hard targets—like government buildings, military bases, airports, and other sites linked to critical infrastructure—the foundation of a soft target does not include security. And because it is not a primary goal for the site, allocating resources for security is typically a later concern.
Within areas and businesses identified as soft targets, there is an especially vulnerable subcategory of open-air events and settings, like parks, streets for parades, arenas, and festival grounds. The 2017 Las Vegas shooting at an outdoor country music festival remains the deadliest mass shooting in U.S. history, with more than 58 fatalities and injuries to at least 413 people.
For these environments, there is not only the concern of a motivated attacker, but also personal disputes that turn deadly and cause damage when a crowd panics.
“Keeping on top of what’s happening with threat actors and the different ways that they’re looking to attack us is important,” says Jennifer Hesterman, (ret) U.S. Air Force colonel and author of Soft Target Hardening: Protecting People from Attack.
Soft Target Trends
When discussing site hardening with clients, Hesterman often draws on recent examples of attacks on similar facilities in other countries, including planning, tactics, motivations, and how the attack was conducted.
“If it’s something that’s been attacked overseas by a group that threatens us here at home, then that should raise your radar,” she says.
While overseas conflicts might seem distant to those in the United States, U.S. sites are not immune to the same kinds of attacks—whether it’s a strike on a daycare or a hospital. Conflicts are increasingly drawing in civilian sites instead of containing skirmishes to a designated battlefield. Hesterman adds that a failure to protect civilians can stem from an inability or unwillingness to think like attackers or other bad actors.
Mark Herrera, director of safety and security for the International Association of Venue Managers (IAVM), says we are living in an ever-evolving threat landscape, and that environment is not going to change anytime soon.
“When you talk about global conflicts and incidents, they have a significant impact on facilities and venues of all types. …It’s important that anywhere there’s mass gatherings, we know that there’s a heightened level of vulnerability,” Herrera adds.
Regardless of their political, ideological, or other motivations, attackers hoping to instigate violence are either calculating or opportunistic.
A calculating attacker will typically deliberately target an event, site, or person, according to Hesterman. The specific reason for planning an attack can vary, whether the motivation is a political, ideological, religious, environmental, or other cause.
For example, potential attackers who live relatively close to an event will likely take advantage of that proximity and conduct surveillance on a site prior to an attack, Herrera adds.
“They’re looking for how weak is your security posture, so they’ll frequent the facility on a regular basis,” Herrera says.
Meanwhile, an opportunistic attacker will be less discerning and instead aim for vulnerable sites or people.
“He’s going to pick the most vulnerable place, probably with the most people—if the statement that he wants to make is to kill as many people as possible,” Hesterman says.
In the United States, firearms are an increasingly popular weaponry choice for both calculating and opportunistic attackers. Mass shootings in the United States increased from 647 incidents in 2022 to 656 in 2023. By 6 March, there were already 71 mass shootings in the United States in 2024, according to the Gun Violence Archive. The archive defines mass shootings as incidents where four or more people—not including the shooter—are shot or killed.
But these incidents do not only arise from attackers with larger agendas and hopes of bringing media attention to the cause of the deaths. Sometimes several people are injured or killed because of a personal dispute between two or more individuals.
Such was the case in October 2023 in Tampa, Florida, when a fight between two groups of people broke out. The fight escalated into gun violence as hundreds of people began crowding the street in the Ybor City district, leaving bars and nightclubs just before closing. The shooting killed two people—a 14-year-old boy and a 22-year-old man—and injured 16 others.
More recently on 14 February, shots were fired during the victory parade for Super Bowl LVIII football champions, the Kansas City Chiefs. The sports victory parade attracted an estimated 1 million fans and supporters, including whole families since schools in the area canceled classes in favor of the event. According to authorities, at least four people were allegedly involved in an argument that by the end of the parade rally resulted in a shooting. The incident left one woman dead and injured another 22 people.
Technology solutions that security practitioners might adopt to increase soft target security might also be used by attackers to inflict harm. While some facilities or organizations might want to use uncrewed aerial vehicles (UAVs) for surveillance or entertainment, attackers might be planning to use them as a delivery mechanism for an explosive device or other damaging efforts. For example, in May 2023, Russia used UAVs to target civilian areas of Kyiv, Ukraine.
“The problem is you can 3D print drones now…,” Hesterman says. “They can be just this basic, crude drone that you can pack with some C4 or put a gun on it and fly it. It’s off the radar, so to speak.”
And she adds that extremist groups like the Islamic State (ISIS) have already been using UAVs or drones in war efforts and other endeavors for more than a decade.
Herrera recommends that when organizations are training staff on identifying suspicious items or behaviors, they include information on whether the organization or an event is using drones, as well as recreational UAVs.
“You have to be able to identify that. A UAV, if it’s spotted, those need to be reported immediately,” Herrera says. He adds that prior to an event, all staff should be familiar with who to report security concerns to and how to best get a hold of a member of the security team. “…It’s just trying to identify what’s friendly and what’s not…. The best thing to do is report it. Hopefully, somebody can immediately identify that as something that’s being used as part of the event or it’s very unusual.”
Next Steps for Security Practitioners
Although security is not “baked in at the beginning” for soft targets, there are measures that can be taken to harden these sites without sacrificing overall public appeal, according to Hesterman.
Often, the first hurdle to overcome in site hardening is a mental one. “You have to first realize you’re a target,” Hesterman says. “For a lot of people, that’s a huge step forward. They don’t want to think about it—they’re in denial about it…. I think it can become overwhelming and to the point where people just don’t even want to talk about or address it.”
But once site leaders start to view their facility, event, or organization as a target, then they can begin to understand where they are vulnerable, whether it’s the back door left propped open or the likelihood of an insider threat.
From there, a risk assessment can help event organizers or site managers and their security teams determine potential vulnerabilities or threats. Factors to consider include the size of an event, its location, who the event will attract or feature, previous incidents, and potential targets.
“The venue, who attends, the local threat is huge,” Hesterman adds. There’s a notable difference in risk types between a cultural festival in the middle of a desert—like Burning Man—and a concert in downtown Chicago, surrounded by hotels that offer a shooter a perch overseeing an event, she explains.
After a risk assessment comes training, during which it can be beneficial to include multiple stakeholders, especially anyone who works at the site, according to Herrera.
When he conducts security training or education sessions as part of his work for IAVM, Herrera says he prefers to include everyone working in or adjacent to the event industry, even beyond a single facility.
“Because when you have a crisis, the economic impact is going to impact everyone—not just the venue or the facility. It’s going to affect other venues, other facilities, but it’s also going to affect your community,” Herrera says.
The training also serves to make non-security individuals aware of risks, allowing them to identify behavioral flags or hazardous items or conditions, and teaching them how to report the issue to security team members to respond to.
While some open-air arenas have both the infrastructure and funding to support and install surveillance systems and metal detectors, other areas—like parks, playgrounds, beaches, and more—might have to rely on fundraising efforts or reallocating funds from other areas.
This can make for a roadblock if a site’s organizer believes that the only effective security is an expensive system. Further frustrating the matter is the common impression that security measures will be an eyesore, especially in sites that encourage guests to enjoy the beauty of nature.
To mitigate this issue, Hesterman reminds clients that there are alternatives. “It doesn’t have to be expensive,” she says. “…There’s a lot of free stuff.” Hesterman points to guides, information, toolkits, and more from the U.S. Department of Homeland Security.
Hesterman knows that many will hear the word “security” and conjure a mental image of razor wire or gray, utilitarian bollards, and Jersey barriers. “You have to work with them to show that that’s not actually true. Show them examples, like case studies and pictures,” Hesterman says.
Hesterman shows her clients photos highlighting security measures from the Middle East, where she lived with her family when her husband was stationed in Doha, Qatar, while still serving in the U.S. Air Force.
“While I was there, I saw how they do security at churches and schools, museums, airports—it’s completely different than how we do security in the United States,” she adds.
For example, bollards can be presented as larger, colorful or stylish flowerpots along the perimeter of an area, preventing vehicles from ramming onto the grounds. Other barriers can include reinforced statues, art installations, and even benches, while natural elements can also provide protection, such as intentionally uneven ground, large trees, and large boulders.
Another element of security that she observed while abroad and in the military is a layered defense setup, where screening people approaching an event or area happens in tiers or rings outside of a target.
“One of my key things is security does not start at the front door. It’s in the parking lot, it’s beyond, it’s on the roads that are around the event,” Hesterman says. “…You have to push it out, especially when you have an event or a museum where you have people queuing in line, which makes another target.”
By screening someone approaching an event or area well-ahead of the actual site—where the most people might be concentrated—the security presence is also discouraging potential opportunistic attackers who see additional obstacles to accessing a soft target.
For example, if an event has an allocated area for parking, the only cars permitted are ones driven by individuals who have purchased a ticket to the event and a parking pass. Another additional measure implemented by several sports venues and arenas is a clear bag policy to deter people from bringing contraband or weapons into facilities, while facilitating faster screening.
While some event organizers might be initially hesitant to install additional layers of security for fear that it may discourage guests or customers, it can help security professionals to point out that a more secure area can attract people. In its most recent survey of spectators at sporting events, the National Center for Spectator Sports Safety and Security (NCS4) found that 69.3 percent of U.S. respondents considered safety and security measures when attending a sporting event, and 73 percent preferred visible security measures.
“When everybody goes through that security, once you get into the venue you can actually relax. You can actually enjoy yourself,” Hesterman says. “You have an amazing time.”
Sara Mosqueda is associate editor for Security Management. You can connect with her on LinkedIn or on X, @XimenaWrites.
