Understanding the stages of mass shootings is important for keeping people safe in schools, workplaces, houses of worship, healthcare settings, and public spaces. These events can seem sudden and hard to predict, but the risk often builds over time.
For security leaders, administrators, and community partners, that timeline matters. The sooner a concern is noticed, reported, assessed, and addressed, the greater the chance of preventing harm before someone arrives with a weapon.
This article walks through the stages that can lead up to, occur during, and follow a mass shooting, with a focus on where intervention is possible. It shows how people, processes, and technology can work together to improve prevention and response. Rather than creating fear, it gives organizations a practical, realistic framework for spotting risks sooner, acting faster, and supporting recovery when a crisis does happen
Key Takeaways
- Most mass shooters go through identifiable stages over weeks, months or even years before the violence occurs, so prevention is possible.
- Many attackers show concerning behaviors before an attack, and some communicate threats, intent, or plans beforehand — known as “leakage.”
- Many active shooter incidents unfold within minutes and may end before law enforcement arrives, making prevention, early detection, and rapid reporting critical.
- Multi-layered prevention strategies that combine behavioral intervention, environmental design, training and technology help reduce risk across all stages.
- Understanding the stages of mass shootings as a process rather than random events helps with intervention before the first shot is fired.
Why the Stages of Mass Shootings Matter
High-profile mass shootings in the U.S., including Columbine, Sandy Hook, Las Vegas, and Uvalde, vary widely in motive, setting, and circumstances. But research points to a common thread: many attackers show concerning behaviors before they act.
Instead of treating these tragedies as sudden or unpredictable, threat assessment experts often describe targeted violence as a progression, sometimes called a “pathway to violence.” That progression can include ideation, planning, preparation, approach, attack, and aftermath. The process is not always clean or linear, but the pattern appears across many cases.
At the same time, there is no single agreed-upon definition of a “mass shooting,” which makes it harder to collect data, compare incidents, or shape policy. Researchers and organizations use different criteria. Some count the number of people shot, while others focus only on fatalities, public locations, or whether the violence was tied to another crime. In a review by NIJ, the most common definition was an incident in which four or more victims were killed with a firearm in a public place, but even that appeared in less than half of the studies they examined.
Despite these differences, federal agencies and researchers consistently identify recurring warning signs and escalation patterns. Just seeing mass violence as something that can be deterred can help organizations catch issues sooner. It also encourages reporting, careful threat evaluation, and early action.
Stage 1: Grievance and Violent Ideation
Early ideation often starts with a complaint or feeling mistreated. As anger grows, it can turn into resentment or thoughts of revenge. Many attackers have histories of bullying, work conflicts, breakups, ideological anger, or other situations they see as unfair. Research from The Violence Project also shows that 98% of public mass shooters are men. That same research reports that many public mass shooters were “insiders” in the places they targeted, which can intensify feelings of betrayal or resentment.
Studies from the FBI, Secret Service, and The Violence Project show pre-attack patterns appear repeatedly. These include a growing grievance, violent fantasies (as found in Eric Harris’s writings before Columbine), leakage of intent, fixation on previous attackers, and noticeable changes in behavior. Elliot Rodger posted videos and left a manifesto expressing misogyny, rejection, and revenge before the 2014 Isla Vista attack. Many others had gone through trauma, loss, or a major personal crisis before the attack.
These patterns are why threat assessment teams in schools, workplaces, and communities pay close attention to early warning behaviors, clear reporting pathways, and timely intervention — long before someone’s grievances have a chance to harden into preparation or action.
Common warning signs at this stage include:
- Fixation on prior mass shooters: Spending time researching prior attacks, collecting related memorabilia, or expressing admiration
- Violent fantasies: Writings, drawings, or social posts that show mass violence or harm
- Sudden weapon obsession: A new or strong interest in firearms, tactical gear, or explosives
- Leakage of intent: Comments such as “you’ll all be sorry” or “everyone will know my name”
- Social withdrawal and anger: Pulling away from others while showing growing hostility toward specific people or groups
“Leakage” is when someone hints at or directly shares violent thoughts, plans, or intentions, either on purpose or without realizing what they’re saying. This creates an opportunity for someone to notice and help.
Offering anonymous reporting systems, teaching people to spot questionable behavior and making mental health support easy to access can help improve prevention strategies. When people know the signs to look out for and feel safe speaking up, it can be much easier to get help before things get worse.
Stage 2: Planning and Target Selection
This point in the stages of mass shootings is one of the most critical. It’s when violent thoughts can shift into action. If a person decides to act, this is when planning begins. They might pick a target and place, decide when to strike, and think about how to cause the most harm. Targets may be personal, symbolic, ideological, or familiar. Planning does not always happen in isolation. According to Secret Service research, in 81% of targeted school attacks, at least one person knew about the plan beforehand. That makes clear reporting pathways, trusted adults, anonymous reporting options, and threat assessment teams especially important during this stage.
Some attackers choose locations that amplify a grievance or send a message. Dylann Roof targeted Emanuel African Methodist Episcopal Church in Charleston in 2015, killing nine people at one of the nation’s most historically significant Black churches. A federal appeals court later noted that Roof chose Mother Emanuel because of its historic relevance. In 2019, Patrick Crusius drove from the Dallas area to El Paso and attacked a Walmart, killing 23 people in a hate crime targeting people he perceived to be Hispanic immigrants. In cases like these, the locations were not random; they reflected the attackers’ ideology, grievance, and intended message.
Typical planning behaviors include:
- Researching building layouts and entry points
- Studying law enforcement response times and protocols
- Reading manifestos from previous attackers
- Timing attacks for maximum casualties or media coverage
- Scouting locations in person
Digital clues can hint that someone is becoming more extreme, but it’s not always obvious. One alarming post or search does not mean they plan to act. That’s why any monitoring of online behavior needs to be guided by clear policies, legal advice, and defined escalation procedures that respect privacy and civil liberties.
A strong prevention strategy usually includes a multidisciplinary threat assessment team—bringing together security, HR, legal, mental health professionals, and, when appropriate, law enforcement liaisons. Their job is to evaluate concerns, determine whether a threat is credible, and coordinate early intervention while there’s still time to redirect someone and disrupt a potential attack.
Working with local law enforcement and the FBI can be especially helpful when there are credible threats or legal questions. These partnerships help organizations respond quickly and make sure serious issues are handled by the right experts.
Stage 3: Preparation and Weapon Acquisition
Once plans are set, many mass shooters start preparation. This could include getting weapons, gear and transportation, as well as rehearsing or checking the location. This stage creates another intervention opportunity where vigilance, awareness, policies and layered security planning can help block the steps toward violence.
Acquiring weapons is often a key part of this stage of mass shootings. Research from the Gun Violence Archive and academic studies shows that while most mass shooters use handguns, the highest casualty attacks often involve semiautomatic rifles. In the 2012 Aurora theater attack, the shooter used an AR-15-style rifle with high-capacity ammunition feeding devices. The Pulse nightclub attacker in 2016 also carried a semiautomatic rifle. And in Las Vegas in 2017, the attacker used several semiautomatic rifles, some equipped with bump stocks.
Other cases reveal the same kinds of gaps in prevention systems, where warning signs were overlooked and individuals with disqualifying histories were still able to get through. The Sutherland Springs shooter in 2017 passed background checks because the Air Force failed to report his domestic violence conviction. The shooter in Uvalde bought two rifles legally just days after turning 18, despite having concerning behavior online before the purchase. These cases show gaps in how laws are enforced and reported. They point to different breakdowns like missed reports of disqualifying records, limits in firearm eligibility laws, and missed opportunities to recognize and act on warning signs.
Observable behaviors during preparation include:
- Large ammunition purchases (1,000+ rounds)
- Buying multiple firearms in a short time frame
- Practicing with tactical gear
- Sudden interest in body armor or combat equipment
Background checks, red flag laws, waiting periods, and safe-storage requirements can create opportunities to step in before someone can act on violent intent. Red flag laws, now in place in 22 states, have already led to hundreds of firearm removals from individuals who were considered a credible threat.
On the organizational side, safety works best when it’s layered. That means keeping exterior doors secured, using access control systems, ensuring parking lots and entrances are well-covered by cameras, training staff to report concerns and having clear procedures in place for reporting weapon-related warning signs.
Stage 4: Approach and Pre-Attack Behavior
In the minutes or hours before an attack, a shooter may travel to the location with weapons or show other visible signs of impending violence. This “approach phase” is often the last chance to interrupt the attack before shots are fired.
Approach phase indicators include:
- Wearing tactical clothing or body armor in everyday settings
- Carrying long cases or trying to hide a rifle
- Loitering near entrances or pacing in parking lots
- Arriving with multiple weapons or visible ammunition
- Making final texts, posts or videos
In the 2022 Buffalo supermarket shooting, the attacker arrived wearing body armor and carrying a Bushmaster XM-15 rifle with multiple loaded magazines. In the 2019 El Paso Walmart attack, the shooter wore ear protection and used a semi-automatic rifle. These kinds of cues can create a small but critical window for a bystander, security officer, or patrol unit to recognize danger and act.
Traditional security measures rely heavily on human attention. A single security officer might be responsible for watching dozens of camera feeds at the same time, and important details can be missed. Automated visual detection tools, like AI gun detection, can help fill that gap by scanning those same feeds for threats in real time and alerting security when something concerning appears, like someone brandishing a visible firearm.
Strong coordination with local police is important. Having designated contacts, clear verification steps, and a plan for sharing video helps ensure a faster, more effective response.
Stage 5: Active Shooter Attack
The active-shooter phase begins as soon as an attacker starts firing and is actively trying to kill or harm people in a crowded area. FBI data shows this continues to be a constant threat: there were 50 active-shooter incidents in 2022, 48 in 2023, and 24 in 2024. The numbers rise and fall from year to year, but the pattern is unmistakable: these events keep happening and organizations can’t afford to treat them as rare or unpredictable.
Common features of the active-shooting phase include:
- Chaos and panic: people running, hiding, or unsure what to do
- Confusing 911 reports: callers give conflicting details about the shooter
- Fast-changing conditions: the attacker moves quickly, making the situation hard to follow
- Hard to locate the threat: even trained responders may struggle in the first moments
During an active-shooter incident, situational awareness is often scattered and incomplete. People may be hiding, running, injured, or hearing bits and pieces of information from others who are just as frightened as they are. In that kind of chaos, it’s incredibly hard for bystanders to give law enforcement clear, accurate details about what’s happening or where the threat is. The 2018 Parkland shooting illustrated this challenge. The attacker moved through the building for several minutes while 911 callers reported confusion and conflicting information about his location.
Civilian response guidance commonly follows the government-endorsed “Run, Hide, Fight” framework. Effective response depends on fast, accurate situational awareness: where the shooter is, which areas are safe to evacuate, and where people should lock down. Real-time information from cameras, access-control systems, gun-detection technology, 911 calls, and on-scene reports can help emergency teams verify what’s happening and guide law enforcement toward the attacker.
During this stage, emergency and mass notification systems become essential. They help organizations get clear, consistent instructions out quickly through every channel people actually use, like text, email, voice calls, desktop alerts, mobile push notifications, digital signage, alarms, and other connected systems. In an active shooter situation, these tools can guide people on what to do in the moment, whether that’s evacuating, sheltering in place, avoiding certain areas, or following lockdown procedures. And when these systems are tied into access control, video feeds, gun detection technology, and law-enforcement notification workflows, they help cut down delays and keep everyone’s actions coordinated as the situation evolves.
Active shooter incidents can end in several different ways. An attacker may run, be arrested, die by suicide, be stopped by police or security, or be confronted by civilians. Because these situations are highly unpredictable and can change within seconds, responders need fast, accurate information about the attacker’s location, movement, and status. That real-time awareness can help law enforcement act more quickly, guide people away from danger, and reduce harm.
Once officers arrive, their focus is clear: stop the killing, prevent the attacker from reaching more victims, relay critical threat information to dispatch and incoming units, and begin basic life-saving measures when it’s safe to do so. Their actions in those first minutes can shape the entire outcome of the event.
Stage 6: Response, Reunification and Long-Term Recovery
Once the attacker is stopped, the situation quickly moves into a response and recovery phase. This stage could last for days, months, or even years. Right away, first responders must make sure the threat is over, secure the area, find victims and begin medical care as soon as it’s safe.
The “golden hour” principle is important here: getting trauma care in the first 60 minutes can increase survival chances by around 90%. For that reason, plans should account for how responders coordinate with local police, federal agencies and medical teams to evaluate, treat and transport the injured.
Reunification is another important step. Choosing a familiar place in advance makes it clear where everyone should meet, so they know what to expect. This step is especially critical when children are involved.
The broader recovery phase also includes accounting for victims and survivors, sharing verified information with families, reuniting loved ones, and supporting everyone affected by long-term trauma.
Victim assistance includes:
- State victim compensation programs
- Federal resources after major mass killings
- Mental health services for survivors, witnesses and first responders
- Long-term counseling
The impact of a mass shooting doesn’t end when the scene is cleared. Communities may deal with closures, repairs, painful anniversaries, media attention, trials, policy debates, and years of emotional healing. Research shows there could be long-term effects on students after experiencing a shooting incident, including more absences, lower graduation rates, and reduced employment and earnings later on.
Because recovery takes time, organizations should plan for reunification and communication, practice them during drills, and use mass-notification systems that can share consistent, verified updates.
How Organizations Can Use the Stage Model to Reduce Risk
When organizations understand the stages of mass shootings as a process, the threat becomes easier to evaluate, plan for, and interrupt. What feels like a random, unstoppable crisis turns into a framework with real, practical points where organizations can step in. Instead of feeling helpless, leaders can see exactly where their actions matter.
Stage-by-stage organizational checklist
Grievance / Ideation
- Anonymous reporting options
- Accessible mental health resources
- Training staff to recognize concerning behaviors
Planning
- A trained threat‑assessment team
- Strong partnerships with local law enforcement
- Clear, documented evaluation procedures
Preparation
- Compliance with background‑check requirements
- Awareness of red‑flag laws and how they work
- Training frontline staff to recognize and report credible behaviors
Approach
- Secure access control
- Reliable camera coverage
- Visual gun‑detection technology
- Clear protocols for calling 911
Attack
- Run‑Hide‑Fight or similar response training
- Real‑time communication and alerting systems
- Lockdown procedures that staff understand and can execute
Recovery
- Reunification plans for families, students, and staff
- Mass‑notification tools for verified updates
- Support resources for victims, survivors, and the broader community
Cross-functional threat assessment teams should include the key people responsible for safety, emergency response, legal guidance and mental health support. Federal guidance documents show that this type of team can help reduce threats when it has the right resources and authorization to act.
Regular audits against the stage framework reveal where organizations are purely reactive (focused only on the active shooter phase) versus proactive in addressing prevention. Many organizations find they have no formal processes for stages 1-2, where intervention is most effective.
Seeing gun violence as a preventable process is far more effective than treating mass shootings as random tragedies.
The key takeaway is simple: every stage before the first shot offers a chance to intervene, redirect someone in crisis, and ultimately save lives.
Conclusion
Mass shootings are often described as sudden tragedies, but understanding the stages of mass shootings shows that many attackers move through recognizable patterns before violence occurs. That does not mean every attack can be predicted, but it does mean organizations are not powerless.
By strengthening reporting pathways, threat assessment, emergency planning, communication, and detection capabilities, schools, workplaces, healthcare settings, houses of worship, and public spaces can create more opportunities to identify risk and act earlier.
Omnilert helps organizations strengthen that window with AI-powered visual gun detection on existing cameras, providing faster alerts and better situational awareness when a visible firearm appears — so teams can assess the threat, respond faster, and protect more people. Learn more
Frequently Asked Questions
What’s the difference between a mass shooting, mass killing, and mass murder?
The terms are often used interchangeably, but they don’t always mean the same thing. A mass shooting generally refers to an incident where multiple people are shot with a firearm, but there is no single U.S. legal definition. The Investigative Assistance for Violent Crimes Act of 2012 defines a mass killing as three or more people killed in a single incident, not including the perpetrator. The FBI has historically used mass murder to describe incidents where four or more people are killed, while many researchers and advocacy groups use definitions based on four or more people shot, whether or not they die. These differences matter because the definition a source uses can dramatically change the data.
What are the common warning signs before a mass shooting?
Common warning signs can include direct threats or “leakage,” fixation on past attackers, sudden interest in firearms or tactical gear, escalating anger around a grievance, social withdrawal, and suicidal or hopeless statements. In many cases, attackers communicate concerning thoughts, threats, or plans to peers, family members, coworkers, or online communities before they act. These signs should not be dismissed as “just venting.” Warning signs do not mean violence is inevitable, but they do mean someone may need attention, support, and assessment by trained professionals.
Can technology alone stop active shooter incidents?
No tool can stop violence on its own. Technology works best when it is part of a complete safety plan that includes assessing behavior, training staff, designing secure facilities, communicating effectively, and working with law enforcement.
What role do gun laws play in the mass-shooting stages?
Gun laws help create safeguards when people are buying weapons. Background checks, extreme-risk protection orders, waiting periods, and safe-storage rules can keep someone in crisis from acting violently. In the U.S., these policies are often debated as people balance Second Amendment rights with public-safety concerns. But no matter where someone stands on the policy side, organizations still need practical, stage-by-stage plans for prevention, detection, response, and recovery that fit their specific environment.
How do I start building a mass-shooting prevention plan for my business or school?
Start with a clear, honest risk assessment. Review your physical security, emergency plans, communication tools, camera coverage, access points, local crime trends, and any specific risks in your area. Then build or strengthen a threat-assessment team with people from across the organization. Give them clear authority, defined reporting channels, and consistent procedures for handling concerns.
