An Introduction to Active Shooter Protocols

Within the first 60 seconds of an active shooter incident, decisions made by those present can mean the difference between life and death. 

Since the late 1990s, schools, workplaces, hospitals and public venues have shifted from a reactive “wait for police and shelter” mindset to proactive and options-based strategies that empower individuals to respond before law enforcement arrives. What are the active shooter protocols used today? Run, Hide, Fight; ALICE; Avoid, Deny, Defend; the Standard Response Protocol; and ASPP PRO have all been widely adopted.

This article breaks down these major protocols and active shooter trainings and explains how they differ, how to adapt them in different environments, and how technologies like AI gun detection and mass notification systems now complement human response. The focus is practical and response-focused, helping organizations build layered, realistic plans rather than theoretical checklists.

Key Takeaways

• Active shooter situations evolve quickly. Options-based protocols are often chosen over lockdown-only approaches because they empower individuals to react based on real-time conditions.
• Technology can support procedures by helping to find threats early, giving emergency protocols a crucial head start, and keeping people safe.
• A layered approach to active shooter prevention and response is essential. Including risk assessments, protocols, training, physical security tools and tech can help organizations feel confident and ready to deal with crisis situations.

A Brief Evolution of Active Shooter Response in the United States 

Early Attacks

The use of the phrase “active shooter incident” is fairly new. The majority of the 20th century had relatively few mass gun violence events, notably the 1966 University of Texas Tower shooting, the 1975 Easter Sunday Massacre, the 1984 Palm Sunday massacre, or the 1984 San Ysidro McDonald’s massacre. Because of their rarity at this time, there were fewer terms used to describe them. Often they were referred to as “mass killings.” 

The Shift Away from Lockdown-Only Procedures

The 1999 Columbine High School shooting, which left 13 victims killed and over 20 others injured, is often referred to as a pivotal turning point in American gun violence history. In this shooting, responding officers established a perimeter first rather than entering immediately, creating controversy about the potential limitations of wait-for-SWAT tactics (which were promoted following the aforementioned UT Austin Tower shooting). Following the incident, agencies all over the country switched from traditional containment to rapid entry models, which drastically altered how officers handle active threats. The phrase “active shooter” also became widely used.

Around the same time, security awareness after 9/11 expanded mass-attack preparedness into offices, transportation hubs and critical infrastructure (not just schools). The creation of the Department of Homeland Security in the Fall of 2002/Spring of 2023 made frameworks official, and this period also saw the creation of a common language and command structures for responses involving more than one agency.

New Technologies and Standardized Protocols Develop

From 2007 onward, each major incident drove new protocols and technologies:

• Virginia Tech (2007): Revealed failures in campus-wide notifications and lockdown coordination. 
• Sandy Hook Elementary (2012): Highlighted K-12 lockdown limitations when the secured areas are breached. 
• Pulse Nightclub attack (2016): Showed the need for options other than hiding in restricted spaces. 
• Las Vegas Route 91 Festival shooting (2017): One of the deadliest in modern US history, it demonstrated how firing against a crowd with limited exits can cause disaster.

Over these years, both an evolution of active shooter response protocols and a widespread emphasis on technology (including emergency/mass notification systems and weapons detection tools) emerged. 

Additionally, soon after the Sandy Hook shooting, the Investigative Assistance for Violent Crimes Act was passed, which led to the formal FBI definition of an “active shooter” being adopted: “One or more individuals actively engaged in killing or attempting to kill people in a populated area.” 

The Gap Between Policy and Response Brought to Light

In 2022, Uvalde served as a sobering reminder that procedures by themselves may not be enough. Twenty-one victims died while law enforcement delayed entry for over 70 minutes, prompting federal investigations and renewed focus on rapid intervention, communication failures and the gap between written policies and actual deployment.

Reflections Today

All of these events shaped a clear evolution: from rigid “lockdown-only” approaches that confined potential victims in place to civilian empowerment through multi-option strategies. Many organizations today are combining real-time communication tools, camera networks, early detection systems, structured protocols and prevention strategies to build a comprehensive prevention effort against active shooter incidents. The philosophy shifted from passive waiting to active decision-making, giving individuals guidance to determine their best course of action as conditions evolve.

What Active Shooter Protocols are Used Today?

There is no single “official” protocol mandated across all environments. Instead, there are several models that share foundations but differ in complexity and flexibility. Organizations typically select or adapt a framework based on their environment, population and training capacity. The following subsections explain each protocol.

Lockdown-Only Protocols

Traditional lockdown procedures, which dominated the early 2000s, are simple and predictable: lock doors, turn off lights, move out of sight, stay silent and wait for an “all clear” from authorities. Because of their simplicity and straightforward instructions, which make them easy for children to follow, many K-12 schools still use lockdown-only procedures today. 

The approach aligns with physical classroom layouts where doors lock from the inside, and windows have blinds. Constraints emerge in open spaces, like hallways, cafeterias and outdoor areas, where lockdowns aren’t feasible. If a shooter is already inside a classroom or adjacent room, immobility increases vulnerability. 

Many districts now blend lockdown with options-based elements, creating hybrid plans that maintain simplicity for younger students while giving older students and staff more flexibility.

Run, Hide, Fight (Department of Homeland Security)

Run, Hide, Fight was promoted by the DHS in the years following the Virginia Tech shooting and became widely adopted across universities, corporations and public facilities. Its strength lies in simplicity: three clear options that most people can remember under stress.

• Run means immediate evacuation when a safe path exists. Leave belongings behind, help others if it doesn’t slow your escape, and put as much distance between yourself and the threat as possible. Once outside, keep your hands visible and follow instructions from responding officers.
• Hide applies when evacuation isn’t possible. Find a location out of the shooter’s view, lock or barricade the door, turn off lights, silence devices and stay low and quiet. Position yourself behind solid objects that could stop or slow bullets. Avoid hiding in groups near the door.
• Fight is the last resort when confronted directly. Use available objects as improvised weapons (like fire extinguishers, chairs, or scissors) and commit to aggressive action to disrupt or disarm the attacker. This is not about winning a fight; it’s about creating an opportunity to escape or survive.

Consider an office scenario: an employee hears gunfire in the hallway. With a clear path to a stairwell, they run, guiding a colleague toward the exit. If they find the stairwell is blocked, they duck into a conference room, lock the door, push a table against it and turn off the lights. If the attacker breaches the room, they grab a heavy laptop and prepare to fight.

Run, Hide, Fight works because it can be taught quickly through short training sessions or videos, and it allows individuals to take action. However, it requires quick decision-making in stressful situations, and not everyone can take these steps equally (especially very young children, elderly people and those with disabilities).

ALICE (Alert, Lockdown, Inform, Counter, Evacuate)

The ALICE Protocol is a structured, options-based protocol increasingly adopted by K-12 districts, higher education institutions, workplaces, houses of worship and other organizations since the mid-2000s. Unlike linear models, ALICE emphasizes active decision-making based on proximity to the threat.

• Alert is the first recognition of danger. This could include actually seeing a gun, hearing a gunshot, receiving a text message from someone who has, witnessing others running away from something, or hearing a PA announcement. 
• Lockdown involves securing and reinforcing rooms: locking doors and windows, barricading with furniture, positioning occupants away from entry points or in closets, and creating a silent environment.
• Inform focuses on sharing real-time information (shooter location, direction of movement, description) so others can make informed decisions about running or sheltering. This step can also involve law enforcement.
• Counter is the most debated component. It means disrupting the shooter’s ability to aim or move effectively through noise, movement and thrown objects. Counter is more about distraction and disruption and less about attacking. In most cases, this step is not taught to younger children.
• Evacuate occurs when it’s safe to leave, ideally through a route away from the threat. 

A high school might train students to scatter and throw objects if confronted, while an elementary school focuses on lockdown and evacuation with simplified instructions, like “stay quiet, listen to your teacher, follow the safe path.” ALICE typically requires more training time and coordination with local law enforcement.

Avoid, Deny, Defend (Citizen Response Model)

Avoid, Deny, Defend originated from Texas State University’s ALERRT program and is often promoted for workplaces and public facilities. The language differs from Run, Hide, Fight, but the actions are similar.

• Avoid means proactively moving away from the sound of gunfire or a reported threat. Use situational awareness and don’t wait for official confirmation. Pay attention to signs and behaviors that suggest danger.
• Deny focuses on blocking access: lock or barricade doors, create barriers with furniture and deny the attacker a line of sight and entry. Make the room look unoccupied if possible.
• Defend applies when confronted directly, usually if you cannot hide or get away. Commit to protecting life using any available means, coordinating with others when possible. Fight as a last resort.

Some organizations find “Avoid, Deny, Defend” resonates better with adult employees than “Run, Hide, Fight.” Others who use Run, Hide, Fight can incorporate ideas from this model without changing their entire protocol.

SRP (Standard Response Protocol)

The Standard Response Protocol, or SRP, was developed by the I Love U Guys Foundation for use in schools, higher ed, businesses and municipal governments. It is considered a “crisis protocol” and can be used for other incidents as well as active-shooter situations. The protocol follows a pattern:

• Hold directs individuals to stay “In Your Room or Area.” This means clearing hallways and communal areas, locking room doors and waiting for confirmation that the threat is clear. 
• Secure instructs people to “Get Inside. Lock Outside Doors.” Anyone outside should return to the nearest building with increased situational awareness, and all external doors should be locked.
• Lockdown tells building occupants, “Locks, Lights, Out of Sight.” Everyone inside the space should stay quiet, ensure doors are locked and move out of any lines of sight. Those who are able should prepare to defend themselves with whatever they have available.
• Evacuate is when everyone is called to go to an announced location. People should leave their belongings if they will slow them down or put them in danger. When applicable, leaders should account for everybody present and identify if anyone is missing or injured.
• Shelter using the appropriate hazard and safety strategy for the situation.

A variety of guides exist for different settings, providing clear information based on role (i.e., students vs. adults, occupants vs. staff). SRP’s strength comes from this action-based role designation; while other protocols have the same instructions for everyone, SRP understands that people respond to crises in different ways.

ASPP PRO (Prevention, Response, Options)

The Active Shooter Prevention Project’s PRO model goes beyond the actual shooting to encompass mitigation efforts and incident planning. It involves three key steps:

• Prevention is about identifying warnings early and responding to them before they can escalate. This includes conducting threat assessments, intervening with at-risk individuals, providing de-escalation training and creating anonymous reporting channels.
• Response focuses on preparing for the actions taken during an active shooting incident, which should be planned for and practiced regularly. These actions could include emergency response and first aid training for community members, establishing crisis management plans, initiating relations with police and improving crisis communication methods. 
• Options is the stage where organizations take the steps to understand what prevention and response options they currently have available and how they can be improved. This includes considerations of policies, security tech, plans, personnel and budget.

When considering that almost half of all mass shooters (and up to 94% of school attackers) share their plans with someone before committing the act of violence, the role of prevention is extremely important. ASPP PRO’s focus on this and preparation is unique compared to other active shooter protocols, but it can be strengthened even further when paired with a protocol like ALICE or Avoid, Deny, Defend.

Comparing Protocols and Choosing the Right Fit

Which active shooter protocol is the best? All major protocols share common principles. They understand that in the moment, rapid decision-making is necessary, so having a clear plan for action beforehand is important. When possible, individuals should always move away from danger, secure their space and resist as a last resort. Their key differences lie in complexity and flexibility.

Ease of Learning

Lockdown-only protocols are very easy to learn and are probably the most well-known active shooter protocols. This means they can be the easiest to implement when there is a diverse, transient group who aren’t trained in a particular response (for example, at a shopping mall). However, their simplicity can also be to their detriment and can leave people feeling helpless. Run, Hide, Fight and Avoid, Deny, Defend protocols can also be learned fairly quickly, as they only consist of three actionable items and can be used in a variety of settings. 

Contextual Influences

ALICE, SRP and ASPP PRO are optimally used in more secure or “fixed” environments like K-12 schools, offices, government buildings, hospitals and houses of worship, where there are consistent groups of people who can be trained more in-depth on procedures, administrators can adequately prepare and coordination can be established early on. When considering technology use, like mass notification systems that can be used in a crisis, it is easier to get a regular community to opt in. 

Individual Agency

Hybrid and more flexible approaches, like ALICE and Run, Hide, Fight, can give people more choices and agency over their response. For example, someone with a higher risk tolerance or background in de-escalation may feel confident “countering” a shooter, while a child may prefer to find somewhere to hide.

Overall Considerations

When selecting a protocol, consider audience age, facility design (multi-story building, open campus, secure units), legal and policy requirements, and available training resources. Organizations should involve local law enforcement, legal counsel and mental health professionals when formalizing or updating protocols. 

The goal is to implement a plan that members can actually execute under stress, not a document that sits in a binder.

Tools That Strengthen Active Shooter Response

A layered safety system combines protocols, people, physical design and technology. Tools should accelerate three phases: detection of the threat, notification to those at risk and responders, and coordinated action. The following will look at specific technologies and what they can do.

Access Control

Access control involves everything that restricts and regulates access. Traditionally, this meant just locks and keys. Modern access control goes beyond this to include card readers, mobile credentials and electronic locks that are controlled centrally. 

With remote lockdown features, security can lock outside doors, certain inside areas, or even whole floors from a secure console or mobile device. Zoning makes it possible to respond in a specific way: protecting areas close to the threat while keeping escape routes open in other places. These features also help police see what the building is like when they get there by providing real-time door status and audit logs.

Panic Buttons and Mobile Safety Apps

When a shooter makes it past access control, fixed panic buttons at reception desks and mobile apps can allow staff to discreetly trigger an alert indicating an active threat. Location-aware apps can send precise incident locations (room number and floor) directly to security and 911.

Many apps also include one-touch dialing, incident reporting, tip lines and broadcast messaging. Training staff on when and how to use these tools is essential; document procedures and test them during drills. A teacher or receptionist using a panic button can potentially speed law enforcement notification by minutes, time that matters when every second counts.

Weapons Detection Systems

In recent years, advancements in weapons detection technologies have made them a reliable tool for helping prevent weapons from entering spaces and mitigating damage. There are three main categories of these systems: Concealed (metal detectors and weapons scanners), Visual (AI gun detection), and Audible (gunshot detection).

Weapons scanners and metal detectors can be used at key entrances to scan for concealed weapons brought in by individuals. These are used widely across different industries, from event venues and stadiums to schools and hospitals. However, they may have a negative impact on the climate and experience of a space, as they can cause lines, create staffing burdens and lead to a feeling of being policed.

Visual AI gun detection tech has a significantly lesser burden due to its virtual invisibility on already-installed CCTV cameras. It uses computer vision systems to analyze existing security camera feeds to detect visible firearms in real time. When a gun detection is verified by a trained professional, these systems can automate alerting security teams, 911 dispatch, or on-site responders. 

Gunshot detection systems can be an effective tool for guiding law enforcement after a gun goes off, but they do not prevent active shooting incidents. 

Mass and Emergency Notification Systems

Multi-channel alerting can be used to rapidly reach people through SMS, voice calls, email, desktop pop-ups, mobile apps, public address systems and digital signage. Two-way communication features allow recipients to confirm safety, report suspicious activity, or provide live updates. 

Using Tools Together for Best Results

The ideal sequence flows from detection to verification to automatic notification to smart lockdown to coordinated active shooter response. Integration reduces manual steps, minimizes confusion and enables faster, more consistent actions during critical first seconds.

Integrated dashboards give security teams a single view of cameras, doors, alerts and messaging tools. Pre-configured workflows can automatically activate multiple systems at once; For example, if an AI-enhanced camera detects a gun, mass notification systems can activate, and lockdown procedures can begin within seconds of verification. 

Organizations must test integrations during drills and not just rely on paper procedures. When systems work together, the gap between threat and response can shrink dramatically.

How Can Active Shooter Procedures Be Applied in Different Situations?

Protocols only work when adapted to the physical layout, population and daily operations of a specific environment. A K-12 school operates differently from a hospital or stadium. The following sections will give clear examples of how to adapt in different situations.

K–12 Schools

With any active shooter protocol, age-appropriate training is essential. Elementary students need to receive easy-to-follow instructions. Middle and high school students can handle more detailed options-based training, including when to evacuate versus shelter. Mental health should be considered when organizing security drills. Overly realistic or traumatizing exercises should be avoided, especially for young children.

Physical controls are important, too. Schools need secured entry points with buzz-in systems, visitor check-in procedures and classroom doors that lock from the inside. Security cameras with AI gun detection installed can monitor key cameras at entrances, in hallways, cafeterias, auditoriums and outdoors. At higher-risk schools, metal detectors or weapons scanners can be used at main doors to help prevent firearms from entering schools. Coordination with local police can support joint drills and preplanned response routes to campus.

Parent communication in K-12 schools is essential. Parents should be aware of active shooter protocols, receive alerts during incidents and be informed about reunification plans with specific off-site locations. 

Higher Education Campuses

College and university campuses present unique challenges. Most campuses are open, meaning they have multiple access points, large outdoor common areas and mixed-use buildings shared by staff, students and the public. Weapons detection and mass notification integration become critical to the success of active shooter responses in these settings. 

AI gun detection technology can scan footage from cameras across the campus and automate ENS when a detection is verified. Decentralized populations (students in off-campus housing, commuters, or evening class attendees) may be more difficult to reach. Using various alert methods like SMS, email, app notifications, sirens and digital signs increases the chances that these groups receive important information. This helps them avoid dangerous situations on campus.

Faculty members need clear guidance on locking classroom doors, managing large lecture halls and leading students during an incident that may evolve quickly. Policies should address night and weekend events, research labs and residence halls, each posing distinct security challenges.

Office Buildings & Corporate Campuses

Access control systems, including badge-controlled doors, visitor management and reception protocols, serve both prevention and response functions in office buildings. These help to prevent unauthorized individuals from entering the building or office space. When they do, offices can pair active shooter protocols with visual AI gun detection and mobile safety apps that allow employees to trigger location-based alerts.

Clear signage and pre-identified safe rooms on each floor are essential, especially in multi-tenant high-rises where employees may not know the full building’s layout. Businesses should create continuity plans that address immediate life safety first, then recovery steps, like remote work protocols, site closures and employee assistance programs.

Having internal emergency teams can help guide evacuations, coordinate shelter-in-place orders and communicate with security.

Event Venues: Stadiums, Arenas and Concert Halls

High crowd density, limited exits and a potential for panic are all concerns for event venue security. Pre-event briefings for staff and security should cover things like evacuation routes, shelter areas and the chain of command for decisions.

Public address systems, video boards and staff with radios can direct crowds during an evolving threat. Coordination with law enforcement and fire/EMS agencies can help to establish pre-planned command posts and access routes for major events. 

Protocols at venues must account for people with mobility impairments, children and VIP areas that may have separate security considerations.

Commercial Centers: Malls and Retail Complexes

Multi-tenant dynamics create complexity as individual store policies may differ from building-wide protocols in the case of strip malls and shopping centers. Property management must provide consistent guidance and coordinate with private security, store managers and local law enforcement to manage drills and communication plans.

Suggested rewrite: During a crisis, open corridors, food courts and parking garages can make traditional lockdown procedures difficult. To stay safe, it is best for people to use methods like Run, Hide, Fight or ALICE. These methods allow individuals to choose whether to find an exit, duck into locked stores, or hide in storerooms.

Shared tools, like mall-wide intercoms, digital signage and centralized security offices monitoring cameras and alarms, can facilitate a more coordinated response. 

Healthcare Facilities and Hospitals

Unlike other locations, hospitals have a more specific set of challenges to consider when it comes to active shooter responses. Many individuals are immobile; there are several areas where quick movement is limited (like critical care units, operating rooms and behavioral health units), and hazardous materials, oxygen lines and equipment near MRI rooms add to the challenge. Because of this, active shooter protocols need to be integrated into existing hospital incident command systems, and emergency operations plans must be made with these factors in mind.

Secure units, like maternity, psychiatric and the ICU, require lockdowns that don’t compromise critical patient care. Differing staff roles (clinical staff, security, administration and support services) should be defined proactively, and each should receive tailored training on how to react and protect patients while coordinating with arriving officers.

Best Practices for Applying Protocols

While policies are an essential part of preparing and dealing with active shooters, they alone are not enough. Organizations need regular training, direct guidance and continuous improvement to embed protocols and tools into day-to-day operations.

Holding Regular Training and Drills

Annual or semiannual training for all staff is the baseline, but higher-risk environments like schools and hospitals benefit from more frequent refreshers. 

• Scenario-based drills should practice different responses, like evacuation, lockdowns, or shelter-in-place, rather than repeating a single script.
• Trauma-informed approaches are essential, especially for children and previously traumatized staff. Avoid hyper-realistic simulations that can cause harm. 
• When relevant, encourage law enforcement and emergency medical services to participate in at least some drills to test coordination.
• Document drill outcomes and lessons learned. 

Organizations that conduct quarterly drills can achieve higher compliance rates than those that train less frequently.

Coordinating Across Departments

Effective protocols require collaboration among security, facilities, HR, leadership, IT, legal and communications teams. 

• Form a safety or threat management committee that meets regularly to oversee policies, tools and training. After a regional incident, a cross-functional team might want to convene to review their own plans, identify gaps and update procedures before the next drill.
• Integrate active shooter preparedness with broader workplace violence prevention programs, like pre-incident threat assessment and intervention for individuals displaying concerning behaviors. 
• Ensure alignment between written policies and vendor capabilities… security providers should be able to support drills and actual responses.

Using Dependable Communication Platforms

Pre-approved message templates for different scenarios, like confirmed active shooter, unconfirmed report, all clear and reunification instructions, save precious time during an incident. 

• Use multiple redundant communication channels so a single failure doesn’t silence critical messages.
• Internal and external audiences, including employees, students, parents, visitors, media and community partners, each require tailored communication. 
• Use plain language instructions rather than codes that may confuse people under stress. 

Always test notification speed and clarity during drills to understand how long it takes for frontline staff to receive and act on messages.

Conducting Reviews and Improving Practices

Putting together reviews after drills, false alarms and real incidents can help to identify what worked and what didn’t, so they can be addressed for the next incident. Periodic audits can look at how physical security (locks, doors, cameras), tech integrations and protocol alignment with current best practices.

• Update training materials and protocols when new threats, building renovations, or organizational changes occur.
• Stay informed about emerging technologies, evolving law enforcement recommendations and changing regulatory requirements.

Leaders can use an annual checklist to evaluate readiness. Basic questions to consider include: Are protocols current? Have all staff been trained this year? Do detection and notification systems integrate properly? Were lessons from the last drill documented and addressed?

Reducing Harm with Preparedness and Protocols

Effective active shooter protocols combine clear guidance, practiced behaviors, supportive technology and cross-team coordination to minimize the harm of any situation. No single protocol or tool is enough; layered defenses and flexible options are essential across schools, workplaces and public venues to help ensure prevention, rapid detection, quick response and responsible care after incidents so that they don’t happen again.

Organizations should review current plans, identify gaps in both training and technology, and prioritize practical next steps within a specific timeframe—not “someday,” but as early as possible.

It’s important to always remember that preparedness is an ongoing process, not a one-time project. Threats evolve, facilities change and technology advances every day. Organizations that invest in both people and tools (training employees to respond, equipping them with modern detection and notification systems, and practicing coordination with law enforcement) are best positioned to protect lives.

To learn about how Omnilert can work with you to improve your organization’s threat detection and response capabilities, visit our website here.

Frequently Asked Questions (FAQs)