Active shooters have been around for a long time. During the 1980s and ‘90s, several shootings took place at post offices, giving rise to the term “going postal.”

At the time, however, shootings were rare. That’s no longer the case. According to the most recent active shooter report from the FBI, there were 24 active shooter incidents in 2024. That’s a decrease from 2023’s 48 incidents, but the number of active shooter incidents have been rising steadily over the last 20 years, from one incident in 2000 to 14 in 2007 to 48 in 2023. The fact is, shootings are becoming increasingly likely to happen.

Despite the prevalence of shootings, organizations are usually underprepared or not prepared at all. Corporations may think it can’t happen to them. Workplace shootings may not be on the board’s radar at all, or company leaders may feel that their security won’t allow a shooter inside. But that’s not the case. Active shooters are dangerous precisely because they already have access.

Assume the worst will happen

One of the most alarming things about an active shooter situation, from the standpoint of a company, is that active shooter incidents are almost impossible to prevent within current cultures and protection measures. Why is that?

Shooters tend to be current or former employees, or people who have relationships with employees or the organization. It’s difficult to keep these shooters out because they often have badges, or are supposed to be in the building. Human resources cannot monitor the mental health of all your employees, and even if they could, it’s not possible to be aware of the mental states of your customers, vendors, partners, or your employees’ families and friends.

In this case, you must assume that an active shooter will target your business at some point, and focus on response and recovery.

Responding to a shooter

There are two responses every company must prepare for an active shooter, an employee response and an emergency team response.

Your employee response plan covers how your personnel will react if a shooter enters the building.

Most civilian active shooter training include a combination of the following steps:

• Alerting employees to the presence of a shooter

• Getting employees out of harm’s way, either by evacuating or locking down

• Making sure employees engage don’t a shooter unless absolutely necessary

• Ensuring employees know they can fight back if they have no other choice

There are several systems and trainings that can help keep your employees safe, such as ALICE or ADD. You might choose a preexisting system or elect to develop one that suits your organization’s needs. It doesn’t matter what you choose as long as you commit to training your employees so that they are prepared in the case of an incident.

Your emergency team response covers how you work with local officials during an incident. This may seem straightforward — if a shooter enters your property, someone should call the police — but in the case of a shooter, you’ll want the authorities to be your partners.

To prepare for a shooter, contact law enforcement ahead of time. Invite them to meet with you and participate in a tabletop exercise that will help you understand what should be done if a shooter targets your business.

This relationship with law enforcement will help both your security team and the authorities respond to threats more effectively. They will know how many people are on the premises, where the exits are, and who their contacts are. You will have a better understanding of how they respond to active shooters.

You’ll also be able to brainstorm different ways of handling threats.

Recovering from a shooting incident

An active shooter creates chaos, not just during the incident, but in the hours and days afterward. Concerned friends and family will call, looking for updates, the press will want statements, and your place of business may be unable to open because it’s a crime scene. To manage these and other effects, it’s important to have a recovery plan in place so that your organization can make decisions quickly and easily during a time of incredible stress.

The first step in setting up your recovery plan is to create an incident command center. This doesn’t have to look like incident command centers do on television – you simply need a designated conference room and have the capability to bring in phones, computers, equipment and clearly labeled tables for each major department when the incident command center is activated.

The point of the command center is to get all the organization’s leaders into one room so they can work together and take action as a group.

They must also be able to speak with one voice. After a shooting, news organizations scramble to cover the event, and employees may post partial information about the attack to their social media accounts from lockdown. Speculation and assumptions can jeopardize a business; so to combat misinformation, make sure you’ve appointed a spokesperson who will deliver one clear message to the media. It may also help to develop a relationship with your local media outlet ahead of any incidents.

Lastly, your organization will need to respond to panic from employees’ loved ones. Set up a hotline so that family members and friends can check on the well-being of your employees.

You can’t always prevent an active shooter, but you can prepare for one

Often, company leaders shy away from planning for active shooters. Security is expensive, and it can be difficult to get company leaders into one room for a tabletop exercise with first responders and community members for a situation that simply can’t be prevented.

It can seem easier to say “it will never happen here” than to sit down and talk about the possibility of an active shooter targeting your company. However, like any other emergency — a fire, flood, or earthquake — active shooters must be prepared for. You may never face one, but you’ll mitigate the damage they can do if you have a well-thought-out plan in place.

The right preparation can save lives, reduce chaos, and help your organization recover faster. That preparation starts with understanding your vulnerabilities, training your team, and building strong relationships with law enforcement and emergency responders.

At Circadian Risk, we help organizations assess their risks and build customized response and recovery plans for real-world threats, including active shooter scenarios. From vulnerability assessments to tabletop exercises, we’ll work with you to identify gaps, strengthen your response, and make sure your people are ready when it matters most.

Want more educational content about your organizational risk?

Sign up for our free email course.