Product Family


Head of U.S. Terrorism and Political Violence,Crisis Management

This year marks the 10th Anniversary of the mass shooting at Virginia Polytechnic University, a tragic event that claimed 33 lives on April 16, 2007 when a 23-year-old mentally-disturbed student shot and killed 32 students and instructors over a two hour period before committing suicide.   ​

Sadly, over the last 10 years, active assailant incidents have been on the rise. According to the Federal Bureau of Investigation’s (FBI) 2015 report -- A Study of Active Shooter Incidents in the United States Between 2000 and 2013, there were 160 incidents between 2000-2013, killing 486 individuals. The follow up report, “Active Shooter Incidents in the United States in 2014 and 2015 released June 2016 shows continued increases.  In 2014 and 2015 alone, there were 20 incidents each year - up from the 2013 high of 17 - that resulted in 92 deaths and 139 injuries.  If broken down, that’s about one incident every 18 days. And that does not include 2016’s high profile incidents including the June mass shooting at Orlando’s Pulse night club, the worst active assailant incident  in US history, resulting in 49 deaths.

While the frequency of active assailant events has increased, incidents have also been more lethal in recent years. According to the FBI, an average of three people were killed per mass shooting event between 2000 and 2013. This has since doubled; an average of six people were killed per active shooter incident between 2014 and 2015.

In terms of targets, there are also a few locations that are consistently selected by assailants. According to a study of over 200 active assailant incidents by the University of Texas, business locations have historically experienced the most active shooter events, with 98 events between 2000 and 2015. Schools had the second highest number of active shootings, with 44 events. Thereafter, there were 32 active shootings that took place in a public venue environment. There were eight active shootings that occurred in churches and seven that occurred within medical facilities during this time period. Military bases experienced three active shootings. Out of 209 recorded events, assailants did not have any apparent relationship to the shooting location in 95 cases. In 36 instances, the shooter was a current employee and in 12 cases the shooter had been fired and as a result, was a former employee. The shooter was a student or former student in 32 cases. In three cases, the shooter was a member of the church/religious institution that was attacked(To learn more, download Active Assailant case studies from S-RM here.)


While the list of incidents may continue to grow, there is also a growing list of incidents that have been minimized and perhaps many more that have been averted because of what we have learned from previous tragedies. The FBI, Homeland Security and other local law enforcement agencies analyze each event and apply the lessons learned to improve how they respond to future incidents. They also help people and organizations prepare for active assailant incidents, boosting their ability to survive, and teach ways for the public to spot warning signs that could thwart an incident altogether.  ​

Raise Red Flags

One key lesson learned from Virginia Tech and other subsequent incidents is that we all need to watch out for warning signs. Active shooters often share their plans or at least their worrisome state-of-mind with someone, somehow. For instance, in January, students in Florida were credited for preventing a potential incident when they reported rumors to school administrators about two students’ plans to carry out a mass shooting at their school the following day. Even more recent, parents in Florida reported their student after discovering suspicious materials and learned of her plans to carry a “Columbine-like” attack at her high school. 

Potential active assailants may give off behavioral and verbal cues of their growing resentment towards others, withdrawal from society and propensity to violence. They may post messages on social media that raise red flags about their mental state.  Warning signs also may be:

  • Depression or withdrawal

  • Explosive outbursts of anger or rage without provocation

  • Talk of previous incidents of violence

  • Behavior that suggests paranoia (“everybody is against me”)

For instance, the Virginia Tech shooter apparently submitted angry, violent writings for certain class assignments well before the April 16 attack. He also had been admitted overnight to a hospital in 2005 after his roommate claimed he threatened suicide only to be released after denying such claims. 

In response to the incident, the Virginia legislature modified the criteria for involuntary commitment, tightened procedures for mandatory outpatient treatment, and increased state funding for community mental health services. Virginia Tech also established a threat assessment team and many others followed. According to Virginia Tech’s Threat Assessment website:

“The mission of the team is to determine if an individual poses, or may reasonably pose, a threat of violence to self, others, or the Virginia Tech community and to intervene to avert the threat and maintain the safety of the situation. The team responds to behaviors exhibited by students, employees, visitors, and non-affiliated persons prior to a critical incident in an attempt to prevent violence so that the Virginia Tech campus remains a safe and secure working and learning environment.”

Warning signs cannot be ignored. However small, raising red flags to questionable behavior, social media posts or other outcries can help community officials investigate and potentially prevent a mass tragedy. As we learned from Virginia Tech’s example, community involvement and cooperation are key in prevention. 

Virginia Tech, like most universities, now has the capability to disseminate emergency information via phone call, email, text message, website, Twitter, hotline and loudspeaker, if necessary.

Clearly Communicate

In 2011, Virginia Tech was fined by the U.S. Department of Education for failing to issue a prompt campus-wide warning after Cho shot his first two victims. School officials sent an email notification about the dorm shooting to students and faculty at 9:26 that morning. According to the Department of Education, however, the message was too vague and did not indicate the potential of a gunman still at large.

Virginia Tech, like most universities, now has the capability to disseminate emergency information via phone call, email, text message, website, Twitter, hotline and loudspeaker, if necessary. The Ohio State University (OSU) showed the effectiveness of quick communication during their November 2016 active assailant event. The incident was initially reported as a shooting, however, the attack was carried out by a student who smashed his car into pedestrians on a campus sidewalk and then started slashing passersby with a knife. Eleven people were injured during the attack. 

As the event unfolded, OSU officials quickly turned to social media to inform its students, staff, and faculty of the attack. Using Twitter and email notifications, OSU sent out “shelter-in-place” alerts to notify those on campus to “run-hide-fight” for their safety. The event could have potentially developed with a higher number of casualties had it not been for a member of the Campus security force already in the vicinity. 


Don’t Wait


Law enforcement authorities have learned they can’t wait as far as communicating and reacting. Prior to the Columbine High School attack, the standard police response to such an event involved first securing a perimeter around a building, and then entering. The high death toll at Columbine led police to re-work their tactics as we have learned that an active assailant event requires quick response.


Currently, response protocol promoted by many national agencies including the FBI and Homeland Security, and many local police departments - and as indicated in the tweet sent to OSU student - is the “run-hide-fight” strategy. Many have produced short videos to teach this simple response action plan to as many as possible.  See the FBI’s video.    

The first two actions - run and hide - are rather instinctive.  If an active assailant or shooter enters a building, occupants are advised to exit the building immediately, if it is safe to do so, or seek shelter in a safe location. If exiting the building is not possible, or if a lockdown, or shelter in place, is announced, it is recommended that individuals go to the nearest room or office, closing or locking the door and if the door has no lock, barricading the entrance with whatever items are available, such as desks, chairs, bookshelves.  Given lessons learned from previous incidents, more facilities are also being designed with these risks in mind. Special locks - giving the ability to lock from inside a room for instance, and other devices are now available to help in lockdown procedures. 



The ‘fight’ component of the “run-hide-fight” response protocol is one that many safety experts only advocate if no other option is available.  Recent situations however have brought more attention to the possible need to fight back and helping people prepare to exert any and all force required to protect themselves.  

An active shooter is not looking for a fight; but rather a body count.  They choose soft targets, places where they expect little or no resistance. This is prompting many from universities and schools to entertainment venues and shopping malls - to boost security measures and train to handle such incidents. 

There is also greater emphasis on helping individuals develop a stronger situational awareness of their surroundings - no matter where they are or where they go - so that they know where exits are located and have a plan of action in the event of an active shooter or active assailant attack. Training today is helping people prepare their minds and develop habits in their thinking, establishing a greater sense of situational awareness and knowledge of ways to increase their chance of survival. 

While not appropriate in every situation, having properly trained individuals can help neutralize a situation faster, saving lives. A good example of this is what happened in 2015 on a train in France when three US vacationers - two who were active US servicemen - reacted immediately when gunshots were fired. Certainly their military training was invaluable in this situation. But they were also joined by two other travelers who, lacking that training, still helped tackle and subdue an assailant armed with an AK-47, pistol and knife. No one was shot and likely dozens were saved by their instinct to immediately fight back.

While the active assailant threat cannot be eliminated, creating greater situational awareness crisis management, planning and risk transfer solutions can be used to better protect employees, customers, students and others during and following an incident. There is empowerment and security in remaining vigilant and sharing information on incidents and behaviors that seem out of place.


To Learn More about Active Assailant Prevention, visit resources like the FBI. XL Catlin’s risk management consultancy partner S-RM also helps businesses address and train for potential active assailant incidents. Download S-RM’s Active Assailant case studies here.




# # #


To learn more, contact Ben Tucker, XL Catlin’s Head of U.S. Terrorism and Political Violence, Crisis Management at or call 212-915-6936 or Anton Wallis, Head of Risk Management at S-RM at or call +44 (0)20 3763 9595.

To contact the author of this story, please complete the below form

Invalid First Name
Invalid Last Name
Country is required
Invalid email
Invalid Captcha

More Articles

Global Asset Protection Services, LLC, and its affiliates (“AXA XL Risk Consulting”) provides risk assessment reports and other loss prevention services, as requested. This document shall not be construed as indicating the existence or availability under any policy of coverage for any particular type of loss or damage. AXA XL Risk. We specifically disclaim any warranty or representation that compliance with any advice or recommendation in any publication will make a facility or operation safe or healthful, or put it in compliance with any standard, code, law, rule or regulation. Save where expressly agreed in writing, AXA XL Risk Consulting and its related and affiliated companies disclaim all liability for loss or damage suffered by any party arising out of or in connection with this publication, including indirect or consequential loss or damage, howsoever arising. Any party who chooses to rely in any way on the contents of this document does so at their own risk.

US- and Canada-Issued Insurance Policies

In the US, the AXA XL insurance companies are: AXA Insurance Company, Catlin Insurance Company, Inc., Greenwich Insurance Company, Indian Harbor Insurance Company, XL Insurance America, Inc., XL Specialty Insurance Company and T.H.E. Insurance Company. In Canada, coverages are underwritten by XL Specialty Insurance Company - Canadian Branch and AXA Insurance Company - Canadian branch. Coverages may also be underwritten by Lloyd’s Syndicate #2003. Coverages underwritten by Lloyd’s Syndicate #2003 are placed on behalf of the member of Syndicate #2003 by Catlin Canada Inc. Lloyd’s ratings are independent of AXA XL.
US domiciled insurance policies can be written by the following AXA XL surplus lines insurers: XL Catlin Insurance Company UK Limited, Syndicates managed by Catlin Underwriting Agencies Limited and Indian Harbor Insurance Company. Enquires from US residents should be directed to a local insurance agent or broker permitted to write business in the relevant state.