Beyond Running, Hiding, and Fighting

by Aric Mutchnick

The U.S. Department of Homeland Security’s “Run. Hide. Fight.©” model serves as the foundation for active shooter preparedness. However, it does not address the needs of those with liability and duty-of-care concerns who must manage an event and minimize casualties before police arrive. A new approach to active shooter training has identified an almost untouched aspect of active attacker response.

aric mutchnick headshotThere are ample statistics that demonstrate how pervasive the active attacker/workplace violence issue has become, both domestically and internationally. Thus far, the strategy for dealing with these events has been centered on the Run.Hide.Fight. model for the civilian population, which is a great methodology on an individual level. The overall strategy has focused on the needs of arriving law enforcement and emergency responders. However, the gap in this strategy is how to manage the time between the arrival of the attacker and the arrival of law enforcement.

Understanding Site-Specific Factors

Management and security staff in any facility, especially those who are unarmed, must consider whether to run, hide, or fight on an individual level, but this is only the first step. In some cases, law enforcement may not be able to arrive sooner than 10 to 15 minutes, or longer, so facility/site management staff must develop policies and procedures that best serve personnel on site. It is critical that these policies are site specific as every location is different. Even the type of attack may be dependent on the location. The issues of a school are not the issues of a hospital, are not the issues of a commercial building, and so on.

Additionally, those who have liability concerns in any facility must address the inevitable legal action that will be taken after any active attacker incident. Demonstrating additional duty of care by addressing the management of an active attack event can substantially affect the outcome of a settlement. Developing policies for managing an armed event also helps to support a culture of awareness in a facility that demonstrates increased duty of care.

The key elements to developing management procedures for an active attacker event include safety, communication, and control. Pertinent examples from actual active shooter drills are included after a description of each element.


It is important to determine how quickly management staff can move to a safe position. This differs from the Run.Hide.Fight. model, as the goal is to reach a safe destination where managers/security can still be operational. This could be a pre-identified command center or another area with limited accessibility to non-management staff. Every facility has unique aspects that must be considered.

Example: Many commercial buildings have fire control rooms. These are typically located close to the security/concierge desk. The rooms have no windows, lock from the inside, and have several forms of communication available. This includes a public address (PA) system that would allow facility managers or security personnel to provide instructions to building occupants.


This is, by far, the most critical aspect of managing an active attacker event. Once management staff and/or security have reached a safe area, there must be immediate communication to ALL personnel that there is an imminent threat in the facility. This may include multiple processes that require an understanding of all the communication tools available in the facility.

Example 1: During an active shooter drill at a Kenyan mining facility, there were 16 miners involved in a particular test. The moderator of the drill asked if they all had the number for the 24/7 security command center at base camp. All 16 miners raised their hands. The moderator asked one miner to call the number to see if the center would answer. The miner immediately indicated that he could not because he did not have minutes on his phone. The moderator asked how many of the 16 did not have minutes on their phone and 14 raised their hands. This became a critical issue with regard to communicating a potential threat at the mining facility. After a moment, one miner raised his hand and asked if he could make a suggestion. He brought up the fact that, if the security command center had a toll-free number, they would be able to call regardless of the number of minutes on their phones.

Example 2: Hospitals typically utilize “Code Silver” to describe that an active shooter (and sometimes hostage) is in or near the facility. The issue with coded language is that many people do not remember what the code means. Especially in the case of an imminent threat, there is little reason not to use plain text language so that all personnel can immediately understand that there is danger.


Any delay of an attacker’s movement allows more time for emergency responders to arrive on scene. A complete understanding of the mechanisms available to delay an attacker is critical.

Example: During an active shooter drill at a corporate headquarters, the conversation turned to potential control mechanisms in the facility. The moderator brought in the building engineer to discuss possible options to delay an attacker. After 30 minutes of discussion on lockdown processes, the moderator was about to wrap up the exercise when he noticed large openings near the elevator bank. The moderator was told that they were fire gates that could be immediately dropped to block the entire bank of elevators. When asked why the engineer did not mention this before, the engineer indicated that the gates were not for lockdown, but for fire response. This demonstrated the need to rethink approaches to lockdown procedures and how these processes can possibly delay an attacker.

Training Style Matters

Safety, communication, and control are the foundation of managing an active attack incident. There are many examples of how focusing on the management of an event rather than individual response can lead to incredible findings on minimizing potential casualties and demonstrating elevated duty of care. It is up to each facility management team to conduct the correct style of drill/training to help identify critical aspects of active shooter policy and procedures that go beyond running, hiding, and fighting.

Aric Mutchnick is the president of Experior Group Inc., the company that invented the groundbreaking Red Ball Drills® active shooter training program. He sits on the board of advisors for the Foundation for Innovation and Discovery (FINND) as well as the board of advisors for Global Source, an international business intelligence company. He also sits on the membership committee for the International Stability Operations Association (ISOA).