Active Shooter Response: Why AVOID, DENY, DEFEND Replaces Run-Hide-Fight

The Run, Hide, Fight protocol has dominated active shooter response training since the Department of Homeland Security introduced it in 2012. It has been taught to millions of employees, students, and staff across the country. But many security professionals have moved away from it, and the reasons are worth understanding.

The Problem With "Hide"

Run, Hide, Fight teaches employees to hide when evacuation is not possible. The instruction is often read as finding a concealed location and waiting. In practice, passive hiding places people in confined spaces. Those spaces are easily searched, restrict the ability to react if discovered, and offer little protection.

The critical insight missing from passive hiding is that concealment and cover are different things. Concealment means you cannot be seen. Cover means you cannot be shot through whatever is between you and the threat. A cubicle partition offers concealment. A concrete wall offers cover. Teaching people to "hide" without this distinction leaves them believing they are protected when they may not be.

What AVOID, DENY, DEFEND Teaches Instead

The AVOID, DENY, DEFEND protocol was developed as a more actionable alternative. Each step has a clear, active meaning.

AVOID. Remove yourself from the threat environment as quickly and safely as possible. Evacuation along a known safe route is always the first priority. This corresponds to "run" but emphasizes pre-planned routes, awareness of exit locations, and not assuming all exits are equally dangerous because a threat exists in one part of a building.

DENY. Prevent the threat from accessing your location. This includes:

• Closing and locking doors
• Barricading with heavy furniture
• Turning off lights
• Silencing phones
• Moving away from the door
• Eliminating any line of sight through windows

"Deny" is more proactive than "hide." You are making access difficult, not simply hoping not to be found.

DEFEND. If the threat enters your location, you must act with aggression to stop it. This corresponds to "fight" but recognizes that defense begins before the threat reaches you, not after.

Facility-Specific Planning

Generic protocol training has a basic limitation. It teaches responses without reference to the specific environment where those responses will need to be executed. An employee in a school who has practiced evacuation through routes they have never walked is less prepared than one who has rehearsed the actual exits, the actual locking hardware, and the actual sightlines in their classroom.

Effective active shooter training is built around your facility. That work includes:

• Mapping evacuation routes and identifying which routes are viable under different threat scenarios
• Identifying rooms that can be effectively denied versus those that cannot
• Understanding the building's communication and notification systems
• Practicing so that responses become instinctual rather than cognitively demanding under stress

First Aid and Medical Response

Active shooter training that ends with the immediate threat response is incomplete. Stopping the bleed is a critical component. The period between the end of the threat and the arrival of EMS is when preventable deaths occur. Tourniquets, wound packing, and basic hemorrhage control techniques save lives.

Organizations that invest in training should ensure their employees are trained in basic first aid response. The facility should also have the necessary supplies staged in accessible locations.

Who Needs Active Shooter Training

Every organization that brings employees or the public into a physical space should have active shooter protocols and trained personnel. Schools, healthcare facilities, houses of worship, office buildings, retail locations, and event venues are all environments where preparedness matters. A plan developed in advance performs better than a spontaneous response.

Pre-Incident Indicators and the Role of Threat Assessment

Recent active shooter research shows that most attackers do not simply snap. Post-incident reviews from the FBI, the Secret Service National Threat Assessment Center, and independent researchers consistently show that attackers telegraph their intentions in the weeks and months before an event. These observable behaviors include:

• Grievance fixation
• Leakage of violent intent to peers or online audiences
• Acquisition of weapons and tactical gear inconsistent with their prior pattern of life
• Practice behaviors such as range visits or reconnaissance of a target location
• A stated or implied end-point decision where the individual signals they have resolved their situation through violence

Training employees, managers, and educators to recognize these indicators converts a workforce from passive potential victims into an early warning network. HR teams, school counselors, and front-line supervisors are often the first to notice concerning communications or changes in behavior. Without a clear reporting structure, those observations rarely reach anyone who can act on them.

A mature organizational response pairs AVOID, DENY, DEFEND instruction with a documented behavioral threat assessment process and a designated point of contact who can evaluate reports and escalate appropriately. For schools dealing with transfer students or families with unclear histories, our out-of-district investigations provide context that internal staff often lack.

Communication During the Event

The decisions that determine outcomes during an active shooter event are made in seconds. They depend almost entirely on the quality of the information available to the people making them. Too many organizations operate with notification systems designed for fire drills. Those systems fail in the specific circumstances of a targeted violence event. A PA announcement instructing everyone to evacuate to the parking lot may be correct for a fire and catastrophic for a shooting.

Effective communication planning addresses three questions:

• How does the first person to observe a threat alert everyone else, including employees or students in parts of the facility where the threat is not yet visible?
• What information is broadcast, and how is it worded so recipients understand the nature, location, and direction of movement of the threat?
• How do leaders maintain two-way communication with dispersed personnel once the event is underway so evacuation and lockdown decisions can be updated as the situation develops?

Modern systems pair mass notification platforms with discreet panic activation, integrated access control, and direct links to law enforcement. The design of these systems is a core component of the physical security assessments our security consulting team conducts.

Legal Exposure and the Duty of Care

Organizations increasingly face civil liability after violent incidents. Claims rest on theories of negligent security, inadequate training, and failure to act on foreseeable warning signs. Plaintiffs' counsel now routinely request training records, threat assessment policies, prior incident reports, and communications showing what leadership knew about a specific individual before an attack. Organizations that cannot produce documented, industry-aligned preparedness often find themselves defending decisions that were never formally made.

A well-documented program is itself a form of risk management. Written emergency action plans, records of training sessions and participant attendance, annual facility reviews, and documented threat assessment outcomes show that the organization took reasonable steps consistent with prevailing standards. Law firms representing institutional defendants regularly engage investigators to reconstruct what was known and when. We work with law firm clients on both pre-incident program reviews and post-incident forensic timelines.

For employers navigating situations where a current or former employee is the subject of concern, a properly scoped background investigation and targeted surveillance can clarify the threat picture before decisions are made about termination, restraining orders, or enhanced protective measures.

Training Cadence and Building Muscle Memory

A single training session does not produce reliable performance under acute stress, no matter how well it is delivered. Human physiology works against retention in exactly the situations where retention matters most. Under the heart rate elevation and cognitive narrowing that accompany a genuine threat, people fall back on whatever response has been practiced to the point of automaticity. If lockdown procedures have been rehearsed twice in five years, they will not be executed cleanly when they are needed.

A defensible training cadence involves:

• New-hire orientation that establishes baseline knowledge
• Annual refresher training that revisits protocol and incorporates lessons from recent incidents
• Unannounced drills that test the actual behavior of occupants rather than their recall of a slide deck
• Scenario-based exercises for leadership and response teams that stress decision-making rather than simple execution

The goal is not to frighten employees. It is to normalize response so the cognitive load during an actual event is as low as possible.

Integrating Training Into a Broader Security Posture

Active shooter preparedness does not exist in isolation. It sits inside a larger framework of physical security, access control, workplace violence prevention, and behavioral health resources. Organizations that treat active shooter training as a standalone compliance exercise miss the opportunity to integrate it with measures that actually reduce risk of an incident occurring in the first place. Those measures include visitor management, controlled entry points, CPTED-informed site design, clear HR processes for handling grievances and terminations, and a culture that encourages reporting of concerning behavior without stigma.

Our training team develops custom active shooter response programs using the AVOID, DENY, DEFEND protocol, tailored to your specific facility and staff. Corporate clients pair training with facility-specific security consulting: CPTED reviews, physical security assessments, and emergency action plans, so the response protocol is matched to the actual environment. Contact us to schedule a training consultation.