By Chris Grollnek, Active Shooter Expert, creator of the P.R.O. Model™ | Active Shooter Prevention Project, LLC (ASPP™)

If your organization runs ALICE Training today, this article is not going to tell you to stop. ALICE, operated by Navigate360, is one of the most widely adopted civilian response programs in the country. It earned that reach by doing something important: it moved American schools and workplaces past the old lockdown only doctrine. Before options based training, the standing instruction in too many buildings was to lock the door, turn off the lights, and wait. There are incidents on the record where waiting was the most dangerous available choice. ALICE gave people permission to act, and a framework for acting, and we credit that fully and by name. This piece, part of our series on the other side of public safety, is about a different question: what is your plan for the months before the Alert?

This is the fourth post in a series that takes the response curricula one at a time and asks each of them the same question: what happens in the window before the curriculum activates? We have already walked Run, Hide, Fight and Avoid, Deny, Defend. ALICE is next.

What does ALICE actually teach?

ALICE is an acronym and a sequence: Alert, Lockdown, Inform, Counter, Evacuate. Notice of a threat starts the clock, lockdown secures people who cannot move, information flows so people can make decisions, counter is the last resort disruption of an attacker. Evacuation gets people out of the danger area. Taught well, the model replaces a single scripted reaction with a set of options matched to where a person is and what the threat is doing. That flexibility is its genuine contribution. Navigate360 delivers it at scale through e-learning, instructor certification, and drill frameworks. That is why districts and corporations with dozens of buildings adopt it. It standardizes the response so that everyone in the organization is working from the same playbook when minutes matter.

Read that description again, though, and notice what every element has in common. Alert assumes a threat exists. Lockdown assumes it is close. Inform assumes it is moving. Counter assumes it is in the room. Evacuate assumes it is somewhere behind you. The entire model, by its own honest design, operates after the deadliest variable in the event, whether an attack happens at all, has already been decided. That is not a criticism of ALICE; it is the definition of response training. A response protocol is responsible for the job it claims, and ALICE claims the minutes after the Alert.

What happens before the Alert?

The FBI’s behavioral research answers this in detail, and the answer is the strongest argument for prevention that exists. In its study of pre-attack behaviors, the FBI found the average active shooter displayed four to five observable concerning behaviors in the weeks and months before the attack. The behaviors: leakage of intent, fixation on grievance, concerning communications, marked behavioral change, and patterns around acquiring the means to act. These signals were seen in real time. They were seen almost entirely by ordinary people, family members, classmates, and coworkers, not by police and not by security staff. The warning window is long, it is observable, and it belongs to the public.

Here is the uncomfortable arithmetic for any organization whose entire plan is a response protocol. The FBI has documented 528 active shooter incidents in the United States between 2000 and 2024. Behind nearly every one was a stretch of weeks when someone saw something and had no training to recognize it. There was no trusted channel to report it, and no team on the receiving end prepared to assess and act. An organization that drills ALICE twice a year and has none of that infrastructure has trained for the last 8 minutes of the event. The preceding months sit completely unworked. The drill is not wasted; it is simply not the whole plan. Treating it as the whole plan is the single most common gap we find in site assessments across every sector.

Prevention and response are not competitors; they are a sequence

The question buyers ask us most is some version of “ALICE or you?” and our honest answer is that the question is built wrong. Response protocols and prevention programs do different jobs at different points on the threat timeline, and a mature organization runs both, in order. Prevention works the warning window: honest site assessment, training the community to recognize the FBI’s documented behaviors, a protected reporting path, and a behavioral threat assessment process that turns scattered observations into decisions. Response covers the minutes prevention could not reach. The P.R.O. Model™ encodes exactly that order, Prevention, Response, Options, and its response layer, React, Escape, Survive, was built alongside federal doctrine rather than against it. Nothing in the model requires an organization to abandon a response protocol its people already know. The same holds for CRASE training, which we looked at next in this series, and for A.L.I.V.E. training. Choosing well between the two is the practical test of any active shooter expert an organization brings in.

What the model does require is honesty about coverage. The P.R.O. Model™ was selected by the U.S. Department of Justice as “A” National Standard for active shooter prevention training, first for 2022 through 2025 and again for 2026 through 2030, the only organization selected twice. The recognition attached to precisely this proposition: prevention is a discipline of its own, with its own doctrine, its own training, and its own measurable outcomes. It belongs in front of every response protocol in the country. That is the standard we hold our own work to. It is the standard we would encourage you to hold any provider to, including us.

Frequently asked questions

Is ALICE Training worth it?

As a response protocol, ALICE is a credible, widely adopted option, and options based response is an improvement over lockdown only doctrine. The question worth adding is what covers the weeks before the Alert, because ALICE by design does not claim them.

What is the difference between ALICE and the P.R.O. Model™?

ALICE is a response protocol that begins at the Alert. The P.R.O. Model™ is a prevention first program, selected by the U.S. Department of Justice as “A” National Standard twice. It works the warning window before an attack and includes a response layer, React, Escape, Survive, for the minutes prevention cannot reach. They occupy different places on the threat timeline.

Can prevention training and ALICE run together?

Yes. Prevention is a layer, not a replacement. Organizations keep the response drills their people know and add assessment, warning sign recognition, reporting channels, and a threat assessment team in front of them. That combination is the complete plan.

Sources

FBI, Active Shooter Incidents in the United States (annual reports, 2000 to 2024): https://www.fbi.gov/how-we-can-help-you/active-shooter-safety-resources
FBI, A Study of Pre-Attack Behaviors of Active Shooters in the United States (2018): https://www.fbi.gov/file-repository/pre-attack-behaviors-of-active-shooters-in-us-2000-2013.pdf
Navigate360, ALICE Training: https://navigate360.com
ASPP™, DOJ Recognition: https://aspppro.com/doj-recognition/