An active shooter vulnerability assessment is the professional walk-through, sensor audit, procedural review, and behavioral-signal analysis that reveals the exact seams an attacker would exploit, and turns that picture into a fundable prevention plan. It is the foundation of every serious prevention program we build. If your organization has never had one, you are choosing a response posture by default. If your organization has had one but it lived in a binder, we can help you turn it into the operating manual it was meant to be.

The Active Shooter Prevention Project™ (ASPP™) was founded in 2010 to build the prevention side of the timeline for every American organization that hires us, from a two-person church office to a Fortune 1 enterprise. Our founder, Chris Grollnek, a Former U.S. Marine and retired police detective corporal, was selected by the U.S. Department of Justice twice: first for 2022 through 2025 alongside Chuck Savickis, and again for 2026 through 2030, the second selection anchoring a four-part federal training series. That federal recognition is why the P.R.O. Model™ (Prevention. Response. Options.) is described as “A” national standard, and it is the framework that every ASPP™ assessment is built around.

What an active shooter vulnerability assessment actually is

The term is used loosely across the market, so we want to be clear about what we mean by it and what a serious assessment produces. An active shooter vulnerability assessment is a four-layer examination of the environment, people, procedures, and signals within a specific facility. Every layer is scored, prioritized, and translated into a plain-language plan the organization can actually fund and implement.

The four layers

Layer one is the physical environment. We walk the site the way an attacker walks a target. Entry points, blind corners, sight lines, camera coverage, weapon-detection gaps, safe-room integrity, egress paths, and every seam where the design of the building meets the reality of how the people inside use it. We look at what the floor plan promises and where it lies.

Layer two is the sensor and technology ecosystem. Access control, walk-through weapon detection, visual gun detection, camera analytics, gunshot detection, indoor mapping, safe-room integrity monitoring, and on-site protective services all live at this layer. Most facilities have some of these components in place. Very few have them integrated into a single operational picture that a prepared leader can read in real time.

Layer three is procedural. Written policy is only useful if the people responsible for executing it know what to do. We audit the policy, then the practice, and tell you where the two disagree. If your lockdown procedure has never been run under simulated pressure, we will say so. If your visitor-management policy has an obvious workaround at the front desk, we will document it and rank the fix.

Layer four is behavioral. The FBI’s studies of active shooters have shown that attackers exhibit roughly four to five observable warning behaviors in the weeks and months before an attack, and those signals are most often seen by family, teachers, coworkers, and classmates rather than responders. If your organization does not have a threat-assessment team and a channel for those signals to reach the right person quickly, that is the highest-leverage gap in the assessment.

What the assessment produces

The output is not a binder. It is a scored, prioritized, budget-linked action plan that maps directly to the P.R.O. Model™. Prevention items come first because that is where the highest number of lives are saved. Response items come second because they matter, and they must be current. Options items sit under both, protecting human judgment when the plan meets a real day.

The seams attackers look for

Attackers are not looking for the front door. They are looking for the seam. The seam is the gap between what the policy says, what the technology can see, and what the people on shift can actually do in the moment. Every assessment we perform is designed to find those seams before an attacker does.

Common seams we identify on a first walk-through: propped-open service doors, expired access badges that still work, visitor logs that nobody reviews, camera zones that show a clean picture until the moment someone actually enters them, safe-room doors that lock but do not latch, weapon-detection lanes that funnel around the sensor rather than through it, and the classic seam that costs organizations more than any other, the assumption that “somebody would have noticed.” Somebody would not have, and we can prove it.

Most incidents end in roughly eight minutes, which is typically shorter than the time it takes for a first responder to arrive. That fact is not a criticism of responders; it is a reality of the timeline. It tells us where the leverage sits. The leverage is upstream, at the seam, before the attack becomes an incident. A vulnerability assessment is the tool that finds the seam while there is still time to close it.

CISA self-assessment versus a professional assessment

The Cybersecurity and Infrastructure Security Agency (CISA) publishes an excellent set of self-assessment tools that any organization can download and use. Houses of Worship Security Self-Assessment. K-12 School Security Assessment Tool. Active Shooter Preparedness Guide. We recommend every client run the CISA self-assessment before we arrive. It is free, it is credible, and it is a solid first pass that will help your leadership team speak the same language when we walk the site together. A professional active shooter vulnerability assessment does what a self-assessment cannot.

We bring an outside perspective that has walked hundreds of sites across every sector. Our assessors see the seams your team has stopped seeing because they walk past them every day. We benchmark your environment against the P.R.O. Model™ and against comparable organizations we have assessed. We produce a report that a grant reviewer, an insurance carrier, a board of directors, and a regulator can all read and understand. The relationship between the two is complementary. Use the CISA self-assessment for the annual internal check-in and for staff education.

Use a professional assessment when you are about to spend real money on prevention infrastructure, when you are applying for a federal or state grant, when your insurance carrier is asking questions, or when a leadership transition means the person who “always handled security” is no longer in the seat.

The assessment as a prevention foundation

Every element of the P.R.O. Model™ rests on the assessment. Prevention requires a defensible picture of what is currently vulnerable, what would remove that vulnerability, and the priority order. Without the assessment, prevention is a slogan. With the assessment, prevention becomes a project plan with owners, budgets, and dates. We start with prevention because prevention is where lives are saved in volume. Behavioral threat assessment, environmental hardening, staff training, community-level signal channels, tabletop leadership drills, and the layered detection ecosystem all live on the prevention side.

The assessment prioritizes them for the specific facility, in the specific budget, on the specific timeline the organization can support. Response items still matter and need to be current. Our own methodology at the individual level is React, Escape, Survive, and every response plan we help build teaches that default so a person under pressure has a simple, actionable framework. But response training does not, by itself, close a physical seam or repair a broken procedure. That is why the assessment feeds the plan and the plan feeds the training, in that order.

Options come last because they preserve human judgment when the plan meets reality. A vulnerability assessment that produces rigid, one-size-fits-all fixes has failed. A good assessment gives leaders the picture they need to make the right call in the moment, whether the moment is a swatting call, a suspicious person at the loading dock, or a real incident.

The assessment as a fundable grant application

An assessment is not only about how prevention becomes operational. It is also how prevention becomes fundable. The federal Nonprofit Security Grant Program (NSGP), state-level equivalents, and most private-sector grant programs require a documented risk basis for the funds they award. Under NSGP specifically, that assessment is the one cost the program does not reimburse. The FY 2026 Notice of Funding Opportunity lists initiatives that fund risk or vulnerability security assessments under Program-Specific Unallowable Costs. A professional vulnerability assessment produces exactly the documentation these programs need.

NSGP funding for fiscal year 2026 sits at $300 million total, split between the urban-area and state allocations, with up to $200,000 per site and up to $600,000 per organization across three sites. That is real money. Most eligible nonprofits, houses of worship, and community organizations never claim it because they lack the assessment that anchors the application. We help our clients close that loop. Our full breakdown of the funding path is on our companion page, Active Shooter Prevention Funding. State and municipal grants follow the same logic. So does insurance. Carriers including Beazley, McGowan, Tokio Marine HCC, and PGU price measurable preparedness into active shooter and workplace violence coverage. A documented, professional assessment is one of the strongest evidence packages a carrier can review, and it directly supports premium-reduction conversations. Residual risk never reaches zero, and we hold the #NEVERHERE™ ceiling on every quote, but a real assessment moves the number in the right direction.

What we assess, layer by layer

Our assessment is intentionally comprehensive, so the plan it produces is defensible before any audience. Each of the elements below is examined in relation to the environment, the population, and the operational realities of the facility we are in.

The ten elements

• Perimeter and entry. Fencing, bollards, lighting, signage, main-entry design, secondary-entry control, delivery-dock protocols, and after-hours entry paths.
• Access control. Badge and credential systems, tailgating risk, visitor management, contractor management, and integration with the identity system.
• Weapon detection. Walk-through screening lanes, visual gun-detection benchmarking against public datasets, and the operational reality of who watches the sensor and how quickly they can act on a hit.
• Camera and analytics coverage. Field of view, blind zones, analytics logic, storage, retrieval, and the escalation path from a camera hit to a human decision.
• Gunshot detection and response linkage. Coverage, false-positive posture, and the connection between a hit and both the internal command team and external first responders.
• Indoor mapping and situational awareness. Whether the responding force can navigate the building in real time, whether the leader inside can see the sensor picture, and whether both pictures agree.
• Safe-room and shelter integrity. Door locking, latching, ballistic ratings where applicable, and the drills that ensure the room is used correctly under real pressure.
• Behavioral threat assessment. Whether the organization has a functioning team, whether the community knows how to report signals, and whether reports actually reach a person who can act.
• Policy, procedure, and drill discipline. Whether the written plan matches the practiced plan, and whether the practiced plan matches the plan people would actually follow under pressure.
• Community and communication. Emergency notification systems, family reunification plans, media and law-enforcement liaison protocols, and the internal channels leaders use before, during, and after an event.

How the scoring works

Every element is scored on a common scale, prioritized against the budget, and cross-referenced with grant eligibility and insurance carrier criteria. The client walks away with a picture they can act on, not a stack of paper they have to interpret.

Full-market breadth, from a small church to a Fortune 1 enterprise

Affordability is part of the definition of “A” national standard. We deliver the same assessment discipline across the entire market because a small church deserves the same quality of vulnerability picture that a Fortune 1 enterprise receives. What changes are the scope, the timeline, and the price, not the standard.

Houses of worship and nonprofits

Houses of worship and small nonprofits typically receive our most compressed assessment engagement. We walk the site, run the four-layer examination, produce the scored plan, and hand off a grant-ready package the organization can use to fund the improvements. Faith communities and nonprofits receive our lowest rates because their missions require it. Prevention has to be affordable, not just admirable.

Schools, universities and hospital systems

K-12 school districts, universities, and hospital systems get a multi-site engagement with district-level and per-site scoring, so district leadership can see the whole portfolio and each site leader can see the specific action list for their facility. Behavioral AI deployed in roughly 700 schools across 26 states already informs how we assess K-12 signal flow, and our SHSU CARES Institute partnership shapes how we tie the assessment to leadership decision training.

Corporate, enterprise and critical infrastructure

Corporate and enterprise clients receive an assessment that maps to their duty-of-care posture, insurance program, and operational continuity plan. We work alongside internal security teams, physical security integrators, and executive protection details to produce a single, coherent picture the CEO and the board can read without translation.

Critical infrastructure clients receive an assessment scoped to their specific regulatory framework, their multi-agency response coordination, and the technology-integration realities of their environment.

In every one of these settings, the P.R.O. Model™ is the framework, the Community of Experts is the bench behind the assessor, and “A” national standard is the destination.

Chris Grollnek on the field at Super Bowl LVIII, Allegiant Stadium, as the NFL’s Active Shooter Prevention Coordinator. This is the top of the market for active-shooter vulnerability assessments.

The insurance thesis inside the assessment

A vulnerability assessment does more than support a grant application. It supports an insurance conversation. Carriers pricing active shooter and workplace violence coverage want to see measurable preparedness, verifiable technology deployment, and a documented plan that maps to the risk profile of the specific site. Beazley, McGowan, Tokio Marine HCC, and PGU are actively pricing this evidence into their programs, and our assessments are designed to give underwriters exactly the picture they need. Our risk-reduction calculator translates the assessment output into the language carriers speak.

The calculator holds the #NEVERHERE™ ceiling as a hard floor: residual risk never reaches zero, and we do not sell a story that says otherwise. What we do sell is measurable movement in the right direction, and carriers reward measurable movement with premium reduction. That is how prevention becomes cost-recoverable rather than a line-item hit.

The Community of Experts inside every assessment

A vulnerability assessment is a person walking the site, and a network standing behind that person. The ASPP™ Community of Experts is our bench, a curated group of practitioners across prevention doctrine, behavioral science, law enforcement, military special operations, corporate security, physical security engineering, technology, insurance, faith community leadership, and legal expertise. Subject-matter experts across 21 states plus the United States, Canada, Mexico, and Poland, with more than 800 combined years of experience in international and domestic terrorism. When our lead assessor walks your site, they carry that bench with them.

If your environment raises a question that requires a subject-matter expert we do not have on-site, we bring the right voice into the room within the same engagement. That is what “A” national standard delivers at ground level, and it is what a solo consultant cannot match. The definition of the person behind the assessment matters too. If you want the pillar page on what an active shooter expert should be, our founder wrote it: chrisgrollnek.com/the-active-shooter-expert. The definition sits under every assessment we deliver.

How to hire us for an active shooter vulnerability assessment

The intake begins with a conversation. Tell us who you are, what population you serve, what environment you operate in, and what budget you have to work with. We align the scope with the mission and propose an assessment engagement that fits your timeline. Most engagements move in three phases. Phase one is the pre-assessment intake and documentation review, which we can run remotely. The second phase is the site visit, where the walk-through, sensor audit, procedural review, and behavioral-signal analysis take place in person.

The third phase is the report, the debrief with leadership, and the plan hand-off, followed by a scheduled follow-up so the plan does not sit in a binder. For clients who want the assessment to be the front door to a longer prevention engagement, we bundle it with tabletop leadership drills, staff training, technology procurement guidance, grant application support, and insurance-carrier liaison. For clients who want a one-time picture with a clean hand-off, we deliver that too.

Frequently asked questions

Sources and further reading

1. Cybersecurity and Infrastructure Security Agency. “Active Shooter Preparedness.” https://www.cisa.gov/topics/physical-security/active-shooter-preparedness.
2. Cybersecurity and Infrastructure Security Agency. “Houses of Worship Security Self-Assessment.” https://www.cisa.gov/houses-worship-security-self-assessment.
3. Federal Bureau of Investigation. A Study of the Pre-Attack Behaviors of Active Shooters in the United States Between 2000 and 2013. https://www.fbi.gov/file-repository/pre-attack-behaviors-of-active-shooters-in-us-2000-2013.pdf.
4. Federal Emergency Management Agency. “Nonprofit Security Grant Program.” https://www.fema.gov/grants/preparedness/nonprofit-security.
5. Active Shooter Prevention Project, LLC. “Active Shooter Prevention Funding.” https://aspppro.com/active-shooter-prevention-funding/.
6. Active Shooter Prevention Project, LLC. “Active Shooter Prevention Training Guide.” https://aspppro.com/active-shooter-prevention-training-guide/.
7. Active Shooter Prevention Project, LLC. “P.R.O. Model™ Workshops.” https://aspppro.com/p-r-o-model-workshops/.
8. Active Shooter Prevention Project, LLC. “Community of Experts.” https://aspppro.com/experts-behind-every-solution/.
9. Chris Grollnek. “The Active Shooter Expert.” https://chrisgrollnek.com/the-active-shooter-expert/.

P.R.O. Model™, #NEVERHERE™, Destination #NEVERHERE™, and ASPP™ are trademarks of the Active Shooter Prevention Project, LLC. Founded in 2010.

Most organizations work through the same handful of questions before an assessment is scoped, and those are written out in the ASPP™ services FAQ.