What to Do in an Active Shooter Situation: Escape, Deny, Attack Back

What should you do in an active shooter situation? Move away from the threat when you have a viable escape route. If escape is unavailable, deny the attacker access to you. If you face an immediate, life-threatening attack and cannot escape or deny access, attack back to stop the threat.

The right response depends on your location, the threat's proximity, your surroundings, and the options available to you. Those options can change.

That is why I teach active shooter response as a triangle: Escape, Deny, Attack Back. You do not have to attempt each option in order. You need to recognize what you can do and act on it.

My purpose in teaching this subject is to help people enjoy life safely. Preparation should give you practical choices and greater confidence, rather than leave you afraid to go to work, attend worship, shop, or take your family out.

What is an active shooter situation?

The FBI describes an active shooter as someone engaged in killing or attempting to kill people in a populated area. Its public guidance identifies three response options: Run, Hide, Fight.

You may also encounter terms such as active threat, active assailant, or armed intruder. The labels matter less to someone facing an emergency than recognizing a serious threat and taking protective action.

This article focuses on civilian response. An employee, teacher, visitor, or parent needs practical options for getting through the emergency. An organization's broader plan also needs to address prevention, communications, coordination with responders, and recovery.

How does Escape, Deny, Attack Back relate to Run, Hide, Fight?

Run, Hide, Fight is familiar language. The Escape, Deny, Attack Back framework helps me explain the purpose behind the actions:

• Escape: Get away from the threat and reach safety.
• Deny: Prevent or impede the attacker's access to you.
• Attack Back: Act to stop an immediate threat when you cannot escape or deny access.

You may hear the third option called Defend in training or on some of my graphics. I use the two interchangeably. I like using Attack Back to emphasize decisive action when a life-threatening confrontation makes it necessary.

In my teaching, the triangle connects these response concepts to decisions people must make in their own surroundings.

The distinction I emphasize is that these are options, not a mandatory sequence. Physical resistance remains a last resort. But last resort does not mean you must first try two actions that are unavailable to you.

Why active shooter response is a triangle

Imagine three people in different parts of the same building.

One is beside an exit with a clear route away from the attack. Another is inside an office that can be secured, with the threat between that office and the exit. A third faces an immediate attack at close range, with no available escape or secure barrier.

The same instruction cannot fit all three situations equally well.

The first person may be able to escape. The second may need to deny access. The third may have to attack back to survive.

These are illustrative situations, not predictions about a particular incident. They show why location and opportunity matter. A response that makes sense for someone across the building may be unavailable to the person beside you.

Your options can also change. A route may become unsafe. A secured space may no longer protect you. An opportunity to escape may become available. Training should help you recognize those changes rather than cling to a decision after its conditions have changed.

Escape when you have a viable route to safety

Escape means getting away from the danger. It requires thinking about where your movement will take you.

Knowing an exit exists is useful. Knowing whether you can reach it without moving toward the threat is more useful. Your normal entrance may be the least suitable way out during an emergency.

Before an incident, consider:

• Where are the other exits?
• What spaces connect to those exits?
• Where does each exit lead?
• What alternatives exist for someone with limited mobility?
• Where could you continue moving after leaving the building?

Do not assume that reaching the doorway ends the problem. Think about the area beyond it, including other people, obstacles, and the possibility of continued danger.

The FBI's escape guidance includes leaving belongings behind, helping others when possible, and calling 911 from safety. A purse, laptop, or coat should not become the reason you delay protective action.

In organizational training, I want people to connect escape concepts to the actual facility. A diagram becomes more useful when staff understand the routes it represents and the limitations those routes may have.

Deny access when escape is unavailable

Deny means making it harder for the attacker to reach you. Depending on the setting, that can involve securing a room and using available barriers.

The FBI advises getting out of view, securing or blocking entry, quieting your phone, and remaining quiet when hiding.

The word Deny helps focus attention on a practical question: What can we do to prevent the attacker from reaching us?

That question should be explored before an emergency. Does the room have an appropriate lock? Can the people using it operate that lock? Does the door open inward or outward? Is there another entrance? Does an apparent safe space have features that undermine its usefulness?

Cover and concealment also deserve attention. Concealment hides you from view; cover provides protection from gunfire. A visual barrier does not automatically provide ballistic protection, and ordinary furnishings should not be assumed to stop bullets.

These details are reasons to assess a facility and practice suitable procedures. Finding out during an emergency that staff do not understand a door's hardware is a preventable preparation problem.

Attack back when an immediate threat leaves no safer option

Physical resistance is a last resort when your life is in immediate danger. Its purpose is to stop the threat and create an opportunity to survive.

The FBI describes fighting as a last resort for imminent danger and emphasizes committing to the action.

In my instruction, Attack Back means responding decisively to that immediate confrontation. It does not mean searching the building for an attacker or leaving safety to become involved.

Reading a paragraph cannot provide the physical preparation that practical instruction can. Responsible training should explain the circumstances for resistance, develop realistic expectations, and adapt participation to people's abilities.

No technique can guarantee an outcome. The aim is to improve your ability to recognize an immediate threat, understand the options you actually have, and act with purpose.

What should you do when police arrive?

Responding officers must identify and stop the threat. Help them distinguish you from it.

The FBI advises emptying your hands, keeping them visible, following commands, and avoiding sudden movements toward officers. Initial officers may pass injured people while addressing the threat; rescue personnel follow.

This part of the response deserves a place in training. People need to understand that the emergency does not necessarily end at the moment they see an officer.

When contacting 911, explain where the emergency is and what you actually know. Separate direct observations from assumptions. Do not delay reaching safety to gather information.

How can you prepare before an active shooter incident?

Preparation starts with manageable actions. You do not need to spend your day imagining violence.

Know the places you regularly use. Notice exits, access points, and spaces that could offer protection. Make this a brief habit rather than a constant preoccupation.

Understand the emergency plan. At work, know how warnings are communicated, what procedures apply to your role, and how to report a concern. Ask about instructions you do not understand.

Report specific concerning behavior. Communicate threats and relevant observations through your organization's reporting process. Focus on behavior and facts rather than appearance, stereotypes, or amateur diagnosis.

Plan for the people present. Consider children, visitors, people with disabilities, and anyone who may need assistance. A plan built around an able-bodied employee alone in an office will not fit every setting.

Practice appropriately. Discuss decisions, review the building, and use planned exercises that match the participants and the environment. Training should build capability without unnecessary fear or surprise.

Preparation can be useful in other emergencies, too. Knowing an alternate exit and understanding how your workplace communicates urgent information have value beyond an active shooter incident.

What should active shooter response training include?

If you are selecting training for an organization, ask how the instructor will connect the material to your people and facility.

My recommendation is to look for instruction that addresses:

• Prevention, reporting concerns, and preparedness.
• Decisions about escape, denying access, and last-resort resistance.
• Facility features and practical response skills.
• Emergency communications and interaction with police.
• Individual abilities, role responsibilities, and realistic limitations.
• Planned practice, discussion, and follow-up review.

A healthcare facility must account for patients who cannot leave independently. A school must address staff and student needs. A church may have volunteers and visitors unfamiliar with the building. A municipality may operate public counters and multiple facilities.

Those differences belong in the training conversation. A familiar slogan can introduce the subject, but people also need to understand what it means where they work.

Frequently asked questions about active shooter response

Do I have to run, then hide, then fight?

You do not have to attempt actions that are unavailable. Evaluate your circumstances and use an available protective option. Physical resistance is a last resort when an immediate threat leaves no safer option.

Is hiding the same as denying access?

Hiding concerns whether the attacker can see you. Denying access concerns whether the attacker can reach you. A suitable response may involve both, depending on the space and circumstances.

Should everyone in a building respond the same way?

People in different locations may have different options. Organizational procedures should help people make appropriate decisions and account for their responsibilities, abilities, and surroundings.

Can a book or article replace active shooter response training?

Reading can introduce concepts and help you prepare questions. Practical instruction allows you to examine decisions, apply concepts to your setting, and practice skills with feedback. Both can contribute to preparation.

Is active shooter preparedness only for schools?

No. Businesses, healthcare facilities, houses of worship, municipalities, and community organizations also need to consider preparedness for their people and operations.

Build your ability to act

You cannot control every danger you may encounter. You can improve your preparation.

Start by identifying an alternate exit in a place you use regularly. If you manage a workplace, ask whether your employees understand their emergency procedures. If you are choosing training, ask how it will address the realities of your facility.

I provide Active Shooter Response Training for schools, healthcare facilities, businesses, houses of worship, municipalities, and other civilian organizations. Programs can be tailored to your audience and setting, with classroom instruction and practical exercises appropriate to the format.

Visit my training page to explore the options and request information for your organization.

For additional reading, my book, Survive a Shooting: Strategies to Survive Active Shooters and Terrorist Attacks, explores Escape, Deny, and Attack Back. You can find it on my Books and Videos page.

The purpose of preparation is to help you live with greater confidence and practical choices. Learn what you can do, prepare to use it, and enjoy life safely.