Based on DHS and FBI 'Run. Hide. Fight.' protocols. Covers situational awareness, barricading techniques, and interacting with tactical law enforcement. Critical for modern corporate risk management.
The term "Active Shooter" has evolved into a broader "Active Threat" landscape. In 2026, tactical analysis of mass casualty events shows that the average duration of these incidents is between 5 and 10 minutes—often ending before law enforcement arrives on the scene. This reality places the burden of initial survival entirely on the individuals present during the first moments of the attack. Understanding the "Active Shooter" definition—an individual actively engaged in killing or attempting to kill people in a confined and populated area—is critical because it dictates a response that is fundamentally different from a robbery or a hostage situation. In an active threat, the primary objective of the attacker is mass casualties, not negotiation or theft.
The 2026 survival paradigm is built on the OODA Loop (Observe, Orient, Decide, Act), a tactical decision-making framework developed by military strategist John Boyd. When an attack begins, the attacker is already in the "Act" phase, while the victims are usually in a state of "Normalcy Bias," where the brain tries to rationalize gunshots as fireworks or construction noise. To survive, you must break this bias immediately. The faster you can orient yourself to the reality of the threat, the faster you can move into an action that saves your life. Seconds are the currency of survival in these environments; a head start of just 15 seconds can be the difference between being in the "kill zone" and being behind a locked door.
This course utilizes the FBI and DHS-endorsed "Run, Hide, Fight" model, but with significantly more tactical depth than standard corporate training. We will move beyond the basics to explore the "why" behind these actions. Why does "Running" fail in certain architectural layouts? Why is "Hiding" ineffective without "Hardening"? How do you "Fight" an armed attacker as a group of unarmed civilians? By the end of this curriculum, you will have a mental "Crisis Blueprint" that allows you to bypass the paralyzing effects of fear and move directly into a survival-oriented state of mind.
Evacuation (Running) is always your primary and most effective survival option, provided there is an accessible escape path. However, in 2026, tactical "Running" is defined as a purposeful movement toward cover, not a blind panic. When you choose to run, you must leave all non-essential belongings behind. Trying to grab a laptop or a bag wastes precious seconds and encumbers your movement. If you are in a group, encourage others to come with you, but do not wait for them if they are paralyzed by shock or insist on staying. Your survival depends on your individual movement.
Strategic evacuation involves understanding Linear vs. Non-Linear Movement. If you are in a long hallway, do not run down the center; stay close to the walls and look for "lateral" escapes—side doors, windows, or stairwells. If you are outside and being fired upon, move in a way that puts physical obstacles (cars, brick walls, trees) between you and the threat. Understand the difference between Concealment (something that hides you, like a bush) and Cover (something that stops a bullet, like an engine block or a concrete planter). Always move toward cover.
Once you have successfully evacuated the immediate danger zone, you must prevent others from entering the area. This is a critical community responsibility. As you reach a safe perimeter, do not stop; continue moving until you are significantly far away from the building. Do not huddle in large groups in the parking lot, as these can become secondary targets. Only when you are at a safe distance should you call 911. Be prepared to provide the "Five Critical Facts": Your location, the shooter’s location, number of shooters, physical description/weapons, and an estimate of victims.
If evacuation is not possible, your objective shifts from movement to Hardening. Hiding is not merely sitting under a desk; it is the process of turning a soft target (an office or classroom) into a hard target that the attacker will likely bypass in favor of easier targets. The first step is to lock the door. In 2026, many attackers will test a door handle and, if it is locked, move on to the next room to maintain their momentum. However, a lock is only the first layer of defense. You must immediately begin Barricading.
Effective barricading requires a tactical understanding of door mechanics. If the door opens inward, you should stack the heaviest furniture available (desks, filing cabinets, tables) against it. The goal is to create a physical mass that is difficult to push through. If the door opens outward, furniture is ineffective. In this case, you must secure the door handle to a fixed object (like a heavy table or a floor-mounted bracket) using a belt, a power cord, or a dedicated door-securing device. If no tether is available, a simple door wedge driven hard under the door can provide significant resistance.
Once the door is secured, you must "silence" the room. This means turning off the lights, closing any blinds or curtains, and silencing all cell phones—including vibration mode. A vibrating phone in a quiet room can alert an attacker to your presence. Move away from the door and any windows; stay low to the floor and spread out. Do not huddle in a single corner, as this makes it easier for a shooter to hit multiple people if they fire through the door. Maintain absolute silence and prepare for the possibility that the attacker may try to lure you out by pretending to be the police or an injured victim.
Fighting is your absolute last resort, to be used only when your life is in imminent danger and all other options have failed. In 2026, the mindset has shifted from "Fighting" to "Countering." This is not a fair fight; it is an aggressive, coordinated attempt to disrupt and incapacitate the attacker. If you are in a room with others, you must commit to a team-based defense. A single attacker, even one with a firearm, can be overwhelmed by a group of people acting with total aggression and speed. Decisiveness is your greatest weapon.
Tactical countering involves Distraction and Disruption. The human brain can only focus on one thing at a time. By throwing items (books, staplers, fire extinguishers) at the attacker’s face as they enter the room, you force them to flinch or blink, disrupting their "OODA Loop" and preventing them from aiming effectively. While they are distracted, "low-and-high" tackles should be initiated. One person targets the weapon, while others target the attacker’s limbs and head. Use your body weight to take them to the ground and do not stop until they are completely neutralized and the weapon is secured.
Improvised weapons are everywhere. A fire extinguisher can be sprayed to blind and choke the attacker before being used as a blunt instrument. A pair of scissors, a heavy trophy, or even a chair can be used to cause significant injury. When you commit to the fight, you must do so with absolute aggression. Do not hesitate. Yell loudly to disorient the shooter and provide yourself with a boost of adrenaline. This is a life-or-death struggle, and your only goal is to stop the attacker from hurting anyone else. Once the weapon is secured, place it in a trash can or away from you so arriving police do not mistake you for the shooter.
Situational Awareness is the practice of consciously observing your environment to identify potential threats before they materialize. In 2026, we utilize the "baseline" method: when you enter a space, quickly establish what is "normal" for that environment. What is the noise level? How are people behaving? Once the baseline is established, you look for Anomalies—individuals who are dressed inappropriately for the weather (e.g., a heavy coat in summer), people showing signs of extreme agitation, or individuals lingering in secure areas. Awareness is not paranoia; it is the skill of not being surprised.
Most active threats are not spontaneous; they are preceded by Pre-Attack Indicators or "Leakage." Leakage is the communication of intent to harm a third party, often through social media posts, diary entries, or verbal threats. Other red flags include a sudden, intense fascination with past mass shootings, the "stockpiling" of weapons, or a withdrawal from social groups combined with expressions of hopelessness or extreme anger. In the workplace, these indicators often follow a "grievance" such as a termination or a perceived injustice. Recognizing these signs early is the only way to prevent an attack before the first shot is fired.
The "See Something, Say Something" protocol is only effective if there is a clear, confidential reporting structure. 2026 standards mandate that organizations have a Threat Assessment Team (TAT) that can evaluate red flags objectively. Reporting concerning behavior is an act of safety, not an act of betrayal. By identifying a person in crisis early, the organization may be able to provide the necessary mental health interventions or security measures to de-escalate the threat. Awareness extends to the physical environment as well: notice propped-open doors, broken locks, or unauthorized individuals "tailgating" through secure entrances.
The arrival of law enforcement is the most dangerous and chaotic phase of an active threat. In 2026, police doctrine is "Immediate Entry," meaning the first officers on the scene will not wait for a SWAT team or a supervisor; they will move directly toward the sound of gunfire. Their sole objective is to neutralize the shooter. This means they will move past injured people, they will not stop to comfort victims, and they may be shouting loud, aggressive commands. You must understand that in the initial minutes, the police do not know who the shooter is—they must treat everyone as a potential threat until proven otherwise.
Your behavior during this interaction is critical for your safety. Keep your hands visible and empty at all times. As officers approach, raise your hands above your head with fingers spread wide. Do not carry anything in your hands—not even a cell phone, as the silhouette of a black object in a high-stress environment can be mistaken for a weapon. Do not make sudden movements toward the officers or attempt to grab them for help. Do not point at the shooter or scream directions unless specifically asked. Follow every command immediately and without question. If you are told to get on the floor or be handcuffed, comply instantly.
Once the immediate threat is neutralized, rescue teams and paramedics will enter. You will likely be moved to a secure "assembly area." Do not leave this area until law enforcement has officially identified you and taken your statement. Arriving officers need specific information: the last known location of the shooter, their physical description, the type of weapons used (long gun vs. handgun), and the location of any victims who need immediate medical attention. Be concise and factual. Remember that the scene is still a crime scene, and your cooperation is vital for the ensuing investigation.
In an active shooter event, the window between injury and death from blood loss is measured in minutes. Because the scene may not be "safe" for paramedics to enter for a significant amount of time, civilians must be prepared to provide Tactical Medicine (TECC). The primary cause of death in these events is uncontrolled extremity hemorrhage. If you or someone near you is shot in an arm or leg, you must apply a Tourniquet immediately. Apply it "High and Tight" on the limb, over the clothing, and tighten it until the bleeding stops. In a tactical environment, you do not have the luxury of precise placement; the goal is total occlusion of the artery.
Gunshot wounds to the torso (chest, back, or abdomen) are a different clinical challenge because tourniquets cannot be used. For a chest wound, there is a high risk of a "Tension Pneumothorax," where air enters the chest cavity and collapses the lung. The 2026 standard is to use a Vented Chest Seal. This is a specialized adhesive dressing that allows air to escape the chest but prevents it from entering. If a chest seal is not available, a piece of plastic secured on three sides can act as an improvised valve. For wounds in the groin or armpit (junctional areas), you must perform aggressive Wound Packing, stuffing gauze deep into the cavity and applying heavy direct pressure.
The "Stop the Bleed" mindset is essential for survival. You should know where the nearest "Bleeding Control Kit" is located in your building. These kits typically contain tourniquets, hemostatic gauze (which contains blood-clotting agents), and chest seals. If no kit is available, use improvised materials: a belt as a tourniquet (though less effective), or clean shirts for wound packing. Do not stop compressions or pressure until a medical professional explicitly takes over. Your goal is to "Buy Time" for the victim to reach a surgical suite.
Organizational leadership and HR are the architects of prevention. In 2026, the legal standard for "Workplace Safety" includes a robust Active Threat Emergency Action Plan (EAP). HR is responsible for establishing a zero-tolerance policy for workplace violence and bullying, ensuring that every report of a threat is investigated by a multi-disciplinary Threat Assessment Team. Management must ensure that employees are not just "aware" of the plan, but are actively trained through tabletop exercises and walkthrough drills. A plan that sits in a binder on a shelf is useless during the first 60 seconds of a crisis.
Termination protocols are a high-risk area for workplace violence. 2026 HR standards emphasize "Dignified Departure" strategies. When an employee is being fired, especially one with a history of conflict, the meeting should be handled with professional empathy to minimize the "humiliation trigger." Security should be present but discreet. Access to company systems (email, Slack, servers) and physical building access (keycards) must be revoked the moment the meeting begins. Following the termination, management should monitor for "leakage" or retaliatory social media posts from the former employee.
Physical security is the final layer of management responsibility. This includes ensuring that Access Control Systems are functional and that "tailgating" (allowing someone to enter behind you without swiping) is strictly prohibited. Managers should conduct regular "security sweeps" to ensure that fire exits are not propped open and that safe rooms are stocked with basic emergency supplies. By fostering a culture of "Collective Security," management empowers every employee to take ownership of the environment’s safety, significantly reducing the organization’s profile as a soft target.
The trauma of an active threat event does not end when the police leave. Survivors often experience a range of acute psychological responses, including flashbacks, hyper-vigilance, and "Survivor's Guilt." In 2026, we recognize Post-Traumatic Stress Disorder (PTSD) as a major long-term risk for those involved in mass casualty events. Organizations must be prepared to provide immediate and long-term mental health support through Employee Assistance Programs (EAPs) and specialized trauma counselors. Recovery is a marathon, and the "return to work" process must be handled with extreme sensitivity.
Psychological First Aid (PFA) should be implemented in the "Assembly Area" immediately following the event. PFA involves stabilizing survivors by ensuring their basic needs (safety, water, contact with family) are met and providing a calm, non-intrusive presence. You should avoid "Critical Incident Stress Debriefing" (CISD) in the first 24 hours—forcing survivors to retell their story too early can actually increase the risk of developing PTSD. Instead, allow survivors to share as much or as little as they wish, and focus on providing factual information to reduce the anxiety caused by uncertainty.
Community resilience is built through transparency and shared grieving. The physical space where the event occurred may need to be remodeled or repurposed, as visual triggers can cause severe setbacks for survivors. Anniversaries and media coverage of other shootings can also act as triggers. Leaders must remain visible and admit to their own struggles, which gives employees "permission" to seek help. By acknowledging the trauma and providing a structured, empathetic path toward a "new normal," the organization can begin the slow process of healing the psychological wounds of the attack.
Personal preparedness is the final link in the survival chain. In 2026, many professionals carry an Individual First Aid Kit (IFAK) in their vehicle or laptop bag. Unlike a standard "band-aid" first aid kit, an IFAK is a tactical kit designed specifically for trauma. It should contain four essential items: 1. A windlass-style Tourniquet (C-A-T or SOFT-W), 2. Hemostatic Gauze (QuikClot), 3. Vented Chest Seals (HyFin), and 4. Trauma Shears to cut through thick clothing. Having these tools available can turn a bystander into a life-saver during the critical minutes before EMS arrival.
Beyond physical tools, your "Kit" must include Mental Preparedness. This involves the practice of "Visualization Training." When you enter a new environment, play the "What If" game. "What if a shooter came through that door? Where is my nearest exit? Where is my nearest hard-cover?" By pre-programming these responses, you reduce your reaction time during a real crisis. This mental rehearsal creates "muscle memory" in the brain, allowing you to bypass the "Freeze" response and move directly into the "Run" or "Hide" phase of survival.
Finally, stay informed about local alert systems. Most modern cities and corporate campuses use Mass Notification Systems (MNS) that send text, email, and desktop alerts during an emergency. Ensure your contact information is updated and that you recognize the "Alert Tone." If your area has "Text to 911" capabilities, familiarize yourself with how to use them, as a text message may go through when a voice call fails due to tower congestion or the need for silence. Preparedness is a lifestyle of awareness; by carrying the right tools and maintaining the right mindset, you become a "Hard Target" and a guardian for those around you.
You've studied the material. The exam is free — pay only when you pass.
START FREE EXAM →