Run, Hide, Fight, and What Comes Before It

By the Active Shooter Prevention Project™ (ASPP™) · Prevention. Response. Options.

Published July 18, 2026

Run, Hide, Fight is the most recognized active shooter guidance in the country, and it earned that place honestly. The U.S. Department of Homeland Security and the FBI built it to give ordinary people three clear choices in the worst moment of their lives, and it did that job well; it is simple enough to remember under fear, and it has saved lives in real events. We credit it fully, and nothing in this article asks you to set it aside.

What we do ask is a harder question, and it is the question a prevention company exists to answer: what happens in the time before Run, Hide, Fight ever applies? Every word of that guidance assumes the shooting has already begun, which means it lives entirely on the side of public safety that arrives after the danger is already in the room. The other side, the one that closes the gap before a trigger is pulled, is prevention, and it is larger, earlier, and more within your control than most organizations realize. If you want the fuller version of that idea, we made the whole case for it in the other side of public safety.

What does Run, Hide, Fight actually do, and where does it stop?

Run, Hide, Fight is a response model, and a good one. Its job begins at the sound of the first shot, and inside that window the guidance is sound: put distance between yourself and the threat, deny the attacker access to your space, and as a genuine last resort, disrupt the attacker with whatever you have. For what it was designed to do, in the seconds and minutes after violence begins, it works, and we would never tell a family, a teacher, or an employee to forget it.

The FBI’s own Run, Hide, Fight guidance. Sound response training, and exactly the layer that begins at the first shot. Prevention is the work that comes before it.

Here is the ceiling, and it is not a flaw in the model so much as a definition of what a response model is. A response, by its own nature, cannot act until there is something to respond to. The design assumes the worst moment has already arrived, so every choice it offers is a choice about surviving a danger that is already present. That is valuable, and it is also incomplete, because the most important decisions about an attack were available long before the attack began.

Read that timeline slowly, because it is the whole argument in two numbers. If the danger typically resolves in about eight minutes and help typically arrives in twelve to fifteen, then the people inside are on their own for the part that matters most, and a response model, however well taught, is being asked to carry a weight it was never built to hold. No response guidance can reach backward in time to the weeks when the outcome was still open, and that is exactly where prevention lives.

Why pay for active shooter training when Run, Hide, Fight is free?

The FBI’s Run, Hide, Fight is free, it is everywhere, and we want every American to know it. We are not here to say we are better than the FBI. We are here to say the two things do different jobs.

Free national training is built for the general public. Its job is a baseline the whole country can share and a report that shows the country is doing something. That is a real job and somebody has to do it. It is not the same job as keeping the people in your building alive on the one day it matters, and it was never designed to be. Even the government’s own count of how these attacks end is argued over by outside researchers. We do not take a side in that argument. We are not motivated by either side. We are motivated by the people who walk through your doors.

Run, Hide, Fight begins when the shooting begins. Prevention begins months earlier, when someone shows a grievance, leaks intent, or rehearses, and the people around them know what they are looking at and where to take it. That is the layer free material cannot give you, because it has to fit everyone. The P.R.O. Model™, Prevention, Response, Options, was built to fit you. It was selected by the U.S. Department of Justice as “A” national standard for the Assistant United States Attorneys and across the Department, and it is in use at some installations and commands across the Department of Defense.

Nobody in your building should lose hope, and nobody should be trained to. There is a better solution than waiting for the worst day and hoping the drill holds. It already exists, it is proven, and we do it together.

Why does every response model carry the same ceiling?

This is not unique to Run, Hide, Fight, and naming the ceiling is not a criticism of any one program. Avoid, Deny, Defend carries it; ALICE carries it; every framework that organizes what to do once a threat is moving shares the same starting line, because they all begin at the same place, which is the moment the danger becomes visible. They are response models, and response is a partner in the work, not a rival to it.

The reason the ceiling matters is that organizations quietly treat these models as the whole plan. A district adopts a response program, runs a drill, checks the box, and believes it has addressed the threat, when what it has actually done is prepare for the last eight minutes and leave the preceding weeks unmanaged. The preparation is real and worth having; the belief that it is complete is the dangerous part, because it retires the harder and more productive work before that work is ever started.

Prevention does not compete with response for that reason. It sits in front of it in time. When we talk about putting prevention first, we are not ranking one above the other in importance during a crisis; we are pointing out that the earliest, cheapest, and most reversible decisions all live before the crisis, and that a serious program has to occupy that ground rather than concede it.

What is the warning window almost nobody is trained to watch?

The FBI has found that active shooters typically show four to five observable warning behaviors in the weeks and months before an attack. That is not a hopeful estimate or a talking point; it is a pattern documented across a large body of case studies, and it changes everything about where the leverage in this problem actually sits. Attacks are rarely the sudden, unforeseeable events they appear to be after the fact. They are usually the visible end of a longer path, and that path leaves signs.

The reason those signs so often go unaddressed is not that they are invisible. It is that the people who see them have never been told that seeing them is part of their job. Warning behaviors are almost never observed by responders, because responders are not present in the weeks before an attack; the signs are seen by family, by classmates, by coworkers, by teachers, and by friends. The information that could stop an attack is already inside the community, held by ordinary people who have not been given a framework for what to do with it.

This is the window prevention is designed to use, and it is why prevention is a program rather than a poster. Noticing has to be trained, reporting has to be safe and simple, and the reports have to reach a behavioral threat assessment process that can tell the difference between a bad day and a real trajectory. When that system exists, the community stops being a passive set of potential victims and becomes the earliest and most capable sensor an organization has. When it does not, the same signs pass through the same hallways and no one is positioned to catch them.

Who actually sees the warning signs before an attack?

The answer reframes the entire responsibility, so it is worth stating plainly: the people best positioned to prevent an attack are almost never the professionals we usually associate with security. They are the person who sits beside the individual at work, the parent who notices a change at home, the teacher who reads a troubling assignment, and the friend who hears something that does not sit right. Prevention succeeds or fails on whether those people know what to do, which means prevention is fundamentally about training a population rather than posting a guard.

We have written elsewhere about why that early, layered attention is the highest-value work an organization can invest in, and the case for it only gets stronger the closer you look; why assessments matter walks through how a professional assessment turns scattered observations into a defensible plan. The point we want to land here is simpler. The intelligence that prevents attacks is already distributed across your people; the job is to build the system that collects it, protects the person who reports it, and acts on it before the eight minutes ever begin.

Have we not already proven that prevention works?

We have, and the proof is so familiar that most people have stopped seeing it. For nearly seventy years, not a single American child has died in a school fire. That is not luck, and it did not come from teaching children to run faster from flames. It came from building a prevention system and committing to it across generations: fire codes written into law, alarms and sprinklers installed as a matter of course, drills practiced until they became automatic, inspections that carried real consequences, and a public that came to treat fire safety as everyone’s responsibility rather than the fire department’s alone.

Notice what that system did. It did not make firefighters better at arriving, though they did improve; it engineered the emergency out of the building before it could start, so that the response layer was rarely needed in the first place. The fire department is still essential, and no one argues that a good response is a waste; the argument is that prevention did the heavy lifting, and the result is a statistic so complete it sounds impossible. Nearly seventy years, and not one child lost to the thing that once killed them in numbers.

This is why we return to the fire analogy so often, and why it is more than a rhetorical device. It is an existence proof. A society that decided to measure a threat, to build standards around it, and to hold itself accountable to those standards drove a category of death nearly to zero, and it did so through prevention rather than heroics. The human threat is harder in some ways and easier in others, but the shape of the solution is already written, and we do not have to invent it so much as commit to it.

What does active shooter prevention look like as a program?

Prevention is often imagined as a single product or a one-time event, and that image is exactly what keeps organizations stuck on the response side. A prevention program is a layered, ongoing system, and its parts reinforce one another the way fire codes, alarms, and drills do. It begins with an honest assessment of where an organization is actually vulnerable, moves through hardening the physical and procedural pathways an attacker would have to use, and rests on a trained population that knows how to notice and report what it sees.

The assessment comes first because everything else depends on it. A qualified assessment does not hand back a list of fears; it rates each recommendation by how much risk it actually reduces, so that a limited budget goes to the controls that matter most rather than the ones that are easiest to buy. Hardening follows, and it is rarely dramatic: controlled access, clear sightlines, communication that reaches the right people in seconds, and small procedural changes that remove the easy paths. None of it is exotic, and all of it compounds.

The layer that ties it together is people, and this is where prevention departs most sharply from response. A response model asks a population to perform under fire; a prevention program asks the same population to pay attention on an ordinary Tuesday, which is a far more achievable request and a far more powerful one. When a community is trained to see the early signs, when reporting is safe and simple, and when a behavioral threat assessment process stands ready to act on what comes in, the organization has built something a response drill can never produce, which is a chance to end the threat before it starts.

That combination, assessment and hardening and a trained community, is what we mean when we say prevention is a program rather than a purchase, and it is the reason our own work is organized around a standing group of specialists rather than a single service. The Community of Experts spans detection, access control, hardening, notification, and behavioral threat assessment, with more than 800 years of combined practitioner experience across 26 states and four countries, because no one discipline covers the whole pathway and prevention only holds when every layer is competent.

Where does the P.R.O. Model™ fit, and why does prevention come first?

The P.R.O. Model™ stands for Prevention, Response, and Options, and it puts prevention first in that order on purpose. The order is the argument. Prevention leads because the earliest decisions are the most powerful ones; response follows because a serious plan prepares for the day prevention is tested; and options remain because human judgment has to stay in the loop when a plan meets reality. Nothing in the model discards response, and everything in it insists that response should be the last resort rather than the entire plan.

What makes the P.R.O. Model™ more than a philosophy is that it has been independently recognized as a standard. The U.S. Department of Justice selected the P.R.O. Model™ as “A” National Standard for the Assistant United States Attorneys and across the Department, across two consecutive windows, 2022 through 2025 and again for 2026 through 2030, and it was filmed by the Justice Television Network and made available across the Department. We are careful with that language, and the care matters: it is “A” National Standard, an example the Department chose to elevate, not the only standard in the country. There is no single national standard for active shooter prevention, and the honest framing is stronger than the inflated one, because it is defensible in front of anyone who checks.

Prevention first is also why the P.R.O. Model™ organizes a Community of Experts rather than selling a single fix. Prevention touches detection, physical security, communication, and human behavior all at once, and it holds only when those layers are coordinated. The model is the frame that keeps them coordinated, and the DOJ recognition, detailed further in our DOJ recognition overview, is the outside confirmation that the frame does what we say it does.

What is React, Escape, Survive, and how is it different?

Prevention first does not mean prevention only, and we would be the last to pretend a program can guarantee an outcome. When prevention is tested, people still need to know what to do, and this is where the response layer of the P.R.O. Model™ lives. Our own response methodology is React, Escape, Survive, developed in collaboration with the FBI and DHS, and it exists precisely because a prevention-first company has an obligation to prepare for the moment its prevention did not hold.

The difference between naming a response layer and building a plan around it is the difference the whole article is about. React, Escape, Survive is the last resort inside a larger system, not the system itself, and that placement changes how an organization invests. Instead of pouring the entire budget into the eight minutes, a prevention-first organization spends most of its effort in the weeks before and keeps a trained, capable response ready for the case where the earlier layers are overwhelmed. Run, Hide, Fight tells people what to do in those eight minutes; prevention is the work that keeps those eight minutes from ever starting, and React, Escape, Survive is what stands ready in between.

How does an organization begin?

The honest starting point is an assessment, because you cannot harden a pathway you have not mapped or train a community you have not studied. A qualified assessment tells an organization where its real exposure sits, ranks the fixes by how much risk each one removes, and turns a vague sense of dread into a phased, affordable plan. From there the work is sequential and manageable: harden the highest-priority pathways, stand up a simple and protected way for people to report what they see, and connect those reports to a behavioral threat assessment process that can act early.

We say often that we will not stop doing this work, and the reason is in the numbers we opened with; the eight-minute reality is not going to change on its own, and the prevention window will keep closing on communities that were never taught to use it. If you want the deeper account of why we hold that line, it is laid out in why we will not stop. The shorter version is that prevention is proven, it is affordable relative to the loss it prevents, and it is sitting unused in most organizations that believe a response drill was enough.

None of this requires an organization to solve the whole problem in a week, and we would caution against any program that promised as much. Prevention is built in phases, each one standing on the last, so that a school, a company, or a house of worship can begin with an assessment, act on the highest-priority findings first, and add layers as budget and attention allow. The work is durable because it is sequential; every step reduces real risk on its own, and the community capability at the center of it only deepens with time. That is the opposite of a one-time drill, and it is why we treat prevention as a standing commitment rather than an event on a calendar.

Why do so many organizations stop at the response half?

The honest answer is that response is easier to see, easier to schedule, and easier to prove you did. A response drill produces a date on a calendar, a signed roster, and a photograph of people crouched behind desks, and all of that feels like progress because it is visible. Prevention, by contrast, produces an absence; when it works, nothing happens, and an organization rarely gets credit for the attack that never occurred. That asymmetry pushes budgets and attention toward the response side, not because leaders are careless but because the response side is the part they can point to.

There is also a comfort in the belief that violence is spontaneous, because if an attack cannot be foreseen then no one can be faulted for failing to prevent it. The FBI’s own findings dismantle that comfort, and we think that is a good thing rather than a burden. If active shooters typically show four to five observable warning behaviors beforehand, then the events are not bolts from a clear sky; they are the visible end of a path that other people watched form. That reframing is uncomfortable, and it is also empowering, because a path that can be watched can be interrupted.

The way past the response-only habit is not guilt, and we are careful never to sell fear. It is simply to make the prevention work as concrete and schedulable as the drill already is. An assessment has a date. A hardening plan has milestones. A community-training program has sessions and a reporting tool people can actually use. When prevention is broken into visible, ordinary steps, it competes on equal footing with the drill, and the organization stops treating the last eight minutes as the whole of its responsibility.

What makes prevention defensible rather than just hopeful?

A fair objection to any prevention pitch is that hope is not a plan, and we agree completely; a program that cannot show its work is not prevention, it is optimism with a logo. What makes the prevention half defensible is that every layer of it produces evidence. An assessment documents the specific exposures it found and ranks them. A hardening plan records which pathways were closed and why. A behavioral threat assessment process keeps a trail of what was reported, how it was evaluated, and what was done, so that the organization can demonstrate a reasonable, consistent standard of care rather than a reaction to the last headline.

That evidence matters far beyond the moral case, because organizations are increasingly asked to prove what they did before an incident, not just how they responded to one. A prevention program built on a professional assessment and a documented process is the difference between an organization that measured its risk and acted on it and one that hoped for the best; and that distinction, familiar to anyone who has watched how fire safety became an insurable science, is exactly the distinction that will define active shooter preparedness over the next decade. Prevention is not the soft option. It is the rigorous one, and it is the one that leaves a record you would be glad to stand behind.

Frequently Asked Questions

---

The Active Shooter Prevention Project™ (ASPP™) builds prevention programs on the P.R.O. Model™, the framework the U.S. Department of Justice selected as “A” National Standard for the Assistant United States Attorneys and across the Department, across two consecutive windows. The model was architected by Chris Grollnek, a Former U.S. Marine and retired police detective corporal who was personally present at an active shooter incident, and whose graduate work culminated in a capstone on the active shooter phenomenon. What that record required, and what the DOJ chose to elevate, is the same thing we bring to every organization we serve: the discipline to do the prevention work before it is ever needed. Learn more at chrisgrollnek.com.