Active shooter preparedness for a business rests on three pillars: a rehearsed emergency action plan built around the DHS/CISA Run-Hide-Fight framework, coordination with local law enforcement established before an incident rather than during one, and — most overlooked — a behavioral threat assessment capability that identifies and manages risk long before it reaches the point of an attack. Businesses that treat active shooter readiness as a single annual fire-drill-style exercise miss most of the value; the strongest programs combine physical preparedness with the upstream prevention work that keeps an attack from happening in the first place.
No business is immune to this risk, and no single tactic — a lockdown policy, a single training video, a sign on the wall — constitutes preparedness on its own. What follows is a practical framework for building genuine readiness, drawn from DHS/CISA guidance, FBI behavioral research on pre-attack indicators, and the operational experience of planning and staffing protective coverage for organizations that take this risk seriously.
Understanding the Active Shooter Threat Landscape
The FBI publishes an annual report on active shooter incidents in the United States, tracking incident counts, locations, and outcomes across commerce, education, and other settings. That ongoing data collection is itself instructive: active shooter incidents are tracked as a distinct, recurring category of violence precisely because they occur across a wide range of business types and sizes, not only in the high-profile settings that make national news. Separately, the FBI’s behavioral analysis of pre-attack indicators found that in the large majority of cases studied, the attacker displayed multiple concerning behaviors observable to others before the attack — behaviors that were, in most cases, never reported through a formal channel. That single finding reframes active shooter preparedness: physical response planning matters, but the highest-leverage intervention point is often earlier, when a threat is still a set of observable warning signs rather than an active event.
The DHS/CISA Run-Hide-Fight Protocol
The Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency (CISA) promote Run-Hide-Fight as the standard individual response protocol for an active shooter event, and it should form the backbone of employee training:
- Run: if there is an accessible escape path, evacuate immediately, leaving belongings behind, helping others where possible without slowing your own escape, and keeping hands visible when encountering law enforcement.
- Hide: if evacuation is not possible, find a place out of the shooter’s view, lock and barricade doors, silence phones, and remain quiet until law enforcement provides an all-clear.
- Fight: as an absolute last resort, when life is in imminent danger and neither running nor hiding is possible, act with aggression and commit fully, using whatever is available to disrupt or incapacitate the attacker.
The protocol is intentionally sequential and situational rather than a rigid script — the correct response depends on the shooter’s location relative to the employee, the building layout, and the moment-to-moment situation, which is precisely why training needs to go beyond a slideshow and include scenario-based discussion of the specific facility employees actually work in.
Building an Emergency Action Plan
A written, facility-specific emergency action plan is the foundation everything else builds on. At minimum, it should document:
- Facility mapping: primary and secondary evacuation routes from every regularly occupied area, identified rally points a safe distance from the building, and areas suitable for sheltering where evacuation is not possible.
- Notification systems: how an active threat is communicated internally (mass notification, intercom code words, mobile alert system) the moment it is identified, and how that notification reaches every area of the facility, including areas without line of sight to the initial incident.
- Access control and lockdown capability: the ability to lock down specific zones or the entire facility quickly, including doors that can be secured from the inside during a hide scenario.
- Roles and responsibilities: who initiates a lockdown, who contacts law enforcement, who accounts for personnel after an evacuation, and who communicates with families and media — decided in advance, not improvised during the event.
- Post-incident reunification plan: a designated location, away from the immediate scene, where evacuated employees can be accounted for and reunited with family members.
- Accommodation for employees with disabilities: specific plans for employees who cannot use standard evacuation routes, developed individually rather than assumed to be covered by a generic plan.
The plan should be a living document, reviewed at least annually and after any change in facility layout, staffing, or a real incident that tests part of the plan.
Conducting Effective Drills and Training
A written plan that has never been rehearsed is not a capability. Effective active shooter drills share a few characteristics that distinguish them from a box-checking exercise:
- Advance notice and appropriate framing. Employees should know a drill is scheduled and understand its purpose; unannounced high-realism drills involving simulated gunfire or unsuspecting employees carry real psychological risk and have caused documented harm at other organizations — this is not the way to build genuine readiness.
- Scenario variety. Practicing evacuation from a single starting point teaches one scenario; a mature program walks through multiple starting locations and building areas so employees internalize the decision process (assess, then run, hide, or fight) rather than memorizing one specific path.
- Law enforcement involvement where feasible. Local police or sheriff’s department participation in tabletop exercises or live drills builds the coordination relationship before it is needed for real and gives officers facility familiarity that speeds response.
- After-action review. Every drill should end with a debrief that captures what worked, what did not, and what changes the plan needs — and those changes should actually be made, not simply noted.
Training frequency should be at least annual for general staff, with more frequent refreshers for employees in roles responsible for initiating lockdown, notification, or evacuation coordination.
Coordination with Law Enforcement
Businesses that have an established relationship with local law enforcement before an incident consistently fare better during and after one. Practical steps include inviting local patrol officers to walk the facility and become familiar with its layout, sharing floor plans and camera system access information with the department in advance where policy allows, establishing a point of contact for both routine security matters and crisis response, and involving law enforcement in tabletop exercises rather than meeting them for the first time during an actual emergency. This coordination also matters directly for the threat assessment side of prevention: a documented behavioral concern about a specific individual — a former employee, a customer, or a person exhibiting concerning behavior near the facility — is far more actionable when law enforcement already has context and an established communication channel with the business.
Physical Security and Access Control Measures
Physical controls reduce both the likelihood and severity of an incident and support the Run-Hide-Fight response once one begins. Relevant measures include controlled building entry (badge access, visitor sign-in, monitored reception), interior door hardware that allows rooms to be locked from the inside during a hide scenario, camera coverage that gives security or law enforcement situational awareness during an event, mass notification systems capable of reaching every area of the facility, and, where the risk assessment warrants it, a licensed security presence at entry points. These controls should be selected based on an actual facility risk assessment rather than applied generically, and should be integrated with the emergency action plan rather than existing as a separate, disconnected system.
Recovery and Business Continuity After an Incident
Preparedness does not end with the immediate response. Organizations need a plan for the hours, days, and weeks following an incident, including: coordinating with law enforcement on when and how the facility can reopen, providing immediate and ongoing mental health support to employees and their families, managing media and public communications through a single designated spokesperson, supporting any employees who were injured, and conducting a thorough after-action review that feeds back into the emergency action plan and the organization’s broader threat assessment program. Recovery planning is frequently the most neglected part of active shooter preparedness, even though the organizational and human impact in the aftermath of an incident often extends far longer than the event itself. Employee assistance resources, extended time off where needed, and ongoing check-ins over the weeks and months following an incident are not optional extras — they materially affect how well a workforce recovers and whether the organization retains employees who might otherwise leave following a traumatic event at their workplace.
How Professional Threat Assessment Reduces Risk Before an Attack
The physical preparedness measures above all address what happens once an attack is already underway. The most effective prevention happens earlier, in the window when a person of concern is still exhibiting the observable warning signs the FBI’s research identifies in the majority of studied cases: explicit or veiled threats, a fixation on grievance, leakage of intent to a third party, escalating disciplinary or interpersonal conflict, and unusual interest in weapons or in prior attacks. A standing behavioral threat assessment capability — a defined reporting channel, a cross-functional team trained to evaluate reports using a structured framework, and a documented case management process — gives an organization the ability to intervene during that window, whether through HR action, a security-planned high-risk termination, protective coverage for a targeted individual, or coordination with law enforcement before the situation escalates to violence. Physical preparedness and behavioral threat assessment are not competing investments; they are complementary layers, and the organizations best positioned to prevent an active shooter event are the ones that build both rather than treating readiness as a single drill checked off once a year.
Common Mistakes in Active Shooter Planning
Several patterns recur across organizations whose preparedness efforts look solid on paper but fail in practice:
- A single, one-size-fits-all evacuation route. Plans built around one primary path from one part of the building leave employees elsewhere with no rehearsed option if that route is blocked or dangerous during the actual event.
- Treating the plan as an IT or facilities document rather than a leadership responsibility. Emergency action plans that are never reviewed by executive leadership, never budgeted for, and never tied to accountable owners tend to go stale within a year or two.
- No plan for visitors, contractors, or customers on-site. Employee-only training misses the population most likely to be unfamiliar with the building layout during an actual event.
- Unannounced high-realism drills. Simulated gunfire, unsuspecting participants, or surprise lockdowns designed to maximize “realism” have caused documented psychological harm at other organizations and often produce panic rather than learning; effective training builds competence through repetition and clear framing, not shock value.
- No connection between the physical security plan and the behavioral threat assessment program. Organizations that build an excellent evacuation plan but have no mechanism to flag and manage a specific person of concern are only addressing the reactive half of preparedness.
- Assuming a plan built once is a plan that stays current. Facility renovations, staffing changes, new entry points, and lessons from drills all require updates; a plan that has not been revisited in several years should be treated as unverified.
Insurance, Liability, and the Standard of Care
Beyond the moral and operational case for preparedness, there is a straightforward liability dimension. Following a workplace violence incident, courts and regulators frequently examine whether an employer took reasonable, foreseeable precautions given the information available to it — the same recognized-hazard analysis that underlies OSHA’s General Duty Clause. A business that can demonstrate a documented, regularly updated emergency action plan, completed training records, evidence of coordination with law enforcement, and an active behavioral threat assessment process is in a materially different position than one that cannot produce any of that documentation after the fact. Many commercial insurance carriers now factor documented workplace violence and active shooter preparedness programs into underwriting for general liability coverage, which gives organizations both a safety and a financial reason to treat this as an ongoing program rather than a one-time compliance exercise.
Putting It Together: A Practical Preparedness Checklist
- A written, facility-specific emergency action plan reviewed at least annually.
- Annual Run-Hide-Fight training for all employees, with more frequent training for personnel responsible for lockdown and notification.
- At least one drill or tabletop exercise per year, with advance notice and a documented after-action review.
- An established relationship and communication channel with local law enforcement, including facility familiarization.
- Physical security measures — access control, lockable interior doors, camera coverage, mass notification — selected based on an actual facility risk assessment.
- A documented recovery and business continuity plan covering reopening, employee support, and communications.
- A standing behavioral threat assessment team with a known, trusted reporting channel and a structured case management process for concerning individuals before they escalate to violence.
About Honeybadger Solutions LLC
Honeybadger Solutions LLC is a licensed, bonded, and insured Arizona security and investigations firm founded and led by veterans and former law enforcement professionals. Our in-house threat assessment, investigative, and executive protection teams work with organizations nationwide to build active shooter emergency action plans, run drills and tabletop exercises, coordinate with local law enforcement, and stand up the behavioral threat assessment capability that reduces risk before an attack, while our armed guard services operate from our Casa Grande headquarters and offices in Phoenix and Oro Valley, Arizona. To build or stress-test your organization’s active shooter preparedness plan, call us directly at 602-725-2818.