7.3 Violent Intruder & Edged-Weapon Response

Recognize an active attack

An active attacker is causing or attempting to cause serious harm in a populated area. The weapon may be a firearm, knife, vehicle, fire, or another means. Gunshots, screams, people fleeing, an explicit report, a visible assault, or a person moving with a weapon require immediate action; the guard does not wait to prove motive or decide whether the event is terrorism.

Call 911 as soon as safely possible. Give the exact site and internal location, attacker description, weapon, direction, number of attackers if known, injuries, and safest responder entrance. If speaking would reveal a hiding place, use an approved silent method or keep the line open when dispatch instructs. Activate the site's emergency warning under the plan. A plain message such as “Armed attacker reported in the west cafeteria; avoid the west wing; call 911” is more useful than an unexplained code.

Never broadcast an unverified all-clear. Correct wrong information promptly and label the source: direct view, camera, radio report, or witness. The attacker's location can change faster than a message travels.

Escape, deny access, defend life

Common public guidance uses Run, Hide, Fight; some workplace plans use similar words such as avoid, deny, defend. The choice depends on the person's location relative to danger, not a rigid sequence. Follow the site's current plan while adjusting to observed hazards.

1. Escape or avoid. Move away from the attacker through a route not exposed to the threat. Leave belongings, warn others without forcing them to follow, keep hands visible, and do not gather at a nearby window or parking lot. Do not direct people toward unverified sounds, smoke, locked exits, or the attacker's last-known path.
2. Hide or deny access. If escape is unsafe, enter a securable place, lock or barricade access, move out of view, silence devices, turn off visible sources when the plan calls for it, spread away from the doorway, and remain quiet. Do not open for an unidentified voice. Give 911 the room and occupants if possible.
3. Defend life as a last resort. When an attacker creates immediate danger and escape or secure shelter is unavailable, people may need to act decisively to interrupt the attack using available lawful means. This is survival against immediate harm, not pursuit, punishment, or a general security assignment.

A guard's uniform does not create a duty or authority to hunt the attacker. Leaving a protected group to search hallways can reveal the group's location, confuse police, and create another victim. Protect people in the guard's immediate area, communicate what is known, and let responding law enforcement form the tactical response.

Dynamic evacuation and lockdown

A facility-wide instruction may not fit every location. People with a clearly safe exit away from the attacker may need to leave while those closer to danger remain secured. A guard at a control point should use cameras and verified reports to prevent routing evacuees into the threat. Keep fire and life-safety consequences in mind; do not lock a door in a way the approved emergency plan forbids.

If an attacker is outside, deny entry and move people away from exposed glass. If the attacker is inside, opening an exterior or compartment door without understanding direction can spread the threat. Communicate door status and responder access. Do not let an unknown person tailgate into shelter simply because the person claims to be police; verify through the emergency channel when possible.

Edged-weapon danger

A knife or edged tool can cause lethal injury at close range. The safest control is usually distance and a barrier: move behind a locked door, vehicle engine block, counter, substantial furniture, or other cover; leave the attack path; direct others away; and call police. Watch hands and movement from safety. Do not approach to inspect blade length, debate whether the knife is legal, or attempt a disarm because a training diagram made it look simple.

If the person is holding an object but not threatening anyone, avoid turning uncertainty into a close confrontation. Use cover, notify, and apply verified property policy. If an attack is immediate, force law depends on the present necessity to protect life. When the threat ends or the weapon is dropped and separation exists, reassess; do not close distance for punishment or unsupported custody.

Police arrival

Responding officers may not know who is the guard. Put down objects that could be mistaken for weapons when safe, keep hands open and visible, avoid sudden movement, and follow commands immediately. Do not grab an officer, run toward the team, or point with an object in hand. Provide short critical information—attacker location and direction, description, weapon, number, victims, and known hazards—then move where directed.

A commissioned guard with a firearm must be especially alert to mistaken identity. Firearms authorization does not make that guard part of the police entry team. Follow agency training, the site plan, and officers' commands.

Medical response and preservation

Once the immediate attack area is reasonably safe or responders direct, call for emergency medical service, guide responders, and provide trained bleeding control or other care. Do not rush unprotected into an uncleared area. Use cover while moving casualties only when the current danger makes movement necessary. Establish survivor and witness locations without unlawful detention.

Preserve weapons where they fall unless movement is necessary for life safety; do not unload, handle, or group them for convenience. Protect video, access logs, alarm records, radio traffic, messages, and the guard's contemporaneous notes. Record warnings, locations, route decisions, people sheltered or assisted, force, injuries, and police handoff. Each witness gives an independent account.

The exam-ready sequence is recognize—warn and call—escape or secure—defend life only as a last resort—identify safely to police—aid and preserve.