Time is the Critical Element in Active Assailant Preparation

When security professionals turn their attention to the issue of active assailants, the dialog rightly focuses first on prevention. While the total number of active assailant incidents avoided is unknowable, it is likely a critical security success story. 

However, no matter how good their preventative measures, organizations will never be able to bring the chance of an active assailant down to zero. And because the stakes of such incidents are so high—literally life and death—prevention can’t be the only focus of security professionals. Some emphasis must be placed on how to act should such a situation arise, and this is where time becomes so important. Time equals lives.

That is one of the seminal conclusions of the 2024 Active Assailant Preparedness research study completed in late 2024.

Once an incident begins, security decision makers need to confirm that an incident is happening and make the decision to activate response. That response, when possible, will include notifying staff or constituents, locking down affected areas, dispatching security personnel if appropriate, and notifying law enforcement. It’s also critical to be able to clearly communicate with first responders, giving them as much access as possible as quickly as possible while knowing how to direct them to affected areas. Each step of this process is critical, and seconds of delays at any point prolong the life-threatening incident.

In the research, nearly 4 in 10 security professionals (39 percent) reported that their organization did not have a comprehensive response plan for active assailant incidents. The low probability of a mass casualty event occurring at an organization perhaps leads them to prioritize other security priorities. However, the sheer destructiveness of mass casualty incidents could prove catastrophic to these organizations. Organizations relying on general security readiness to manage, for example, an active shooter incident, will waste precious seconds and minutes compared to organizations that have thought through and practiced a response. Active assailant situations are extremely chaotic, which heightens the need for preplanning.

One key factor is the time it takes for an organization to notify staff, students, or other constituents that an active assailant incident was in progress. Less than one-quarter (23 percent) said it would only take a few seconds while 54 percent said it would take at least a few minutes. Other respondents either didn’t have the capability to send such a notification, would take longer than a few minutes, or did not know.

“The early notification systems are absolutely critical,” says Gene Petrino, a security consultant with Survival Response, LLC, with extensive experience helping clients plan for active assailant incidents. “They work incredibly well, and they are absolutely critical to reducing casualties and increasing apprehensions.”

Overall, 68 percent of security professionals in the survey said they had a technology solution for sending a notification of an active assailant, leaving one-third without the capability. However, having the capability is just the beginning.

“It’s critical that the people who are responsible for sending that lockdown communication know and understand their role,” says Drew Neckar, CPP, principal consultant at COSECURE. He says that too often, organizations have not established clear processes for incident response. He shares the time he was working with a university, and the leaders said it was the police dispatcher who was responsible for sending an alert. When he asked the dispatcher, the dispatcher told him he knew they had the system, but he wouldn’t feel comfortable using it without the chief’s approval.

“That’s a system that doesn’t work at 3:00 a.m.,” Neckar observes.

The survey asked security professionals to select what they thought the biggest challenges would be if their organization’s faced an active assailant issue. The top three selections were all related to the speed of communication at the onset of an incident, including 44 percent who selected “Quick, decisive lockdown or evacuation decision.” The top selection was “Getting real-time updates as the situation unfolded,” which half of respondents selected; “Sending alerts and communications to people in the building or campus” was second with 46 percent.

One of the keys for making quick lockdown or alert decisions, as well as ensuring that communication pathways are open during a chaotic incident, is practicing. Two-thirds of security professionals reported that their organizations had undertaken active assailant training for staff. However, only 10 percent reported they were highly confident their staff would know what to do in the event of an active assailant incident. Another 32 percent said they were mostly confident, leaving well over half (58 percent) who fell somewhere between a medium level of confidence and not at all confident.

Training is also key to ensuring the next time-sensitive element of an active assailant situation goes as smoothly as possible: working with first responders. Only one-third of security professionals said this was one of the primary challenges they would face, yet fewer than half (46 percent) were highly or mostly confident that they could provide a detailed situational awareness report to first responders.

Petrino says it is understandable for security professionals to be hedging their bets when it comes to how prepared they feel they are in various aspects of active assailant preparedness. However, he says there is no excuse to be getting this one wrong.

Law enforcement is eager to work with organizations, Petrino explains. First of all, having a relationship with the authorities is also critical in the all-important side of preventing active assailant incidents. In addition to aiding prevention efforts, however, he says law enforcement needs both situational awareness when they arrive on the scene of an incident as well as a ready means to access areas in a facility.

“For any midsize organization—a hospital, a school, whoever—if they don’t already have a relationship with local law enforcement, then they’re already almost too late,” Petrino says.

The survey asked another one of those confidence questions, the big one: How confident are you that your organization is as prepared as it can be for an active assailant incident? Neckar scoffs at the 11 percent who said they were highly confident, and he isn’t too sure about the 26 percent who were mostly confident either.

“I’m not sure those people understand just how incredibly chaotic and disruptive an active shooter is,” he says.

Organizations that do everything right: They have an alert system that can send notification in seconds. They have developed solid procedures to ensure the system will be used effectively. They trained staff and—even more importantly—trained internal crisis teams on what their responsibilities during an incident would be. And they built a relationship with local law enforcement and have a good idea how they can provide first responders with the information and access they will need.

“Even those organizations will find it’s impossible to feel fully prepared in the unfortunate case that they have to deal with an attack,” Neckar says.

However, preparing to face an active assailant is far from superfluous. It is, in fact, the opposite. Active assailant attacks are not going to suddenly cease happening, he notes, and preparing for them saves lives.

The full report on the research findings, Active Assailant Preparedness: Risks and Recommendations, sponsored by Everbridge, is available on the ASIS website.

Scott Briscoe is the content development director at ASIS International. He led the Active Assailant Preparedness report research project.