The FBI studied 63 active shooters. Each displayed an average of 4.7 concerning behaviors, and more than half of the people who noticed took no action.
Every organization with a security program has paperwork. Emergency plans, evacuation maps, call trees. Most of it is accurate. Very little of it describes what people actually do.
That gap is your culture. It shows up in small decisions made in a hurry. A delivery driver gets to a locked door and somebody holds it open. Someone spots a stranger in a back hallway and figures it is probably fine. A volunteer reads a message that worries her and has no idea who to tell.
Those small decisions decide most outcomes.
Your equipment gets tested once a year. Your people get tested daily.The FBI went back through 63 active shooter cases from 2000 to 2013 and looked at how each attacker behaved in the months beforehand.1
The warning was already inside the building.
It just never reached anyone who could act on it.For adult attackers, the people most likely to see the warning signs were spouses and partners, then friends, then classmates and coworkers.1 The people closest to someone notice the change first.
That changes who you are building for. A reporting system designed for an employee escalating up the chain assumes the person who noticed is on the clock and knows the org chart. Often it is a wife, the coworker at the next desk, or a volunteer who comes in twice a month.
Assume the person reporting has no security training, does not know who runs what, and cares about the person they are worried about. Build anything narrower and you miss the people most likely to see it first.
Most budgets watch social media, where 16 percent of it turned up.
When someone did say something, 83 percent of the time they said it to the attacker.1 Only 41 percent of concerns ever reached law enforcement. About half reached someone like a manager or a school official.1
So the usual response is a quiet word with the person. That is a decent human instinct, and it is what most worried colleagues try first. The organization never finds out the concern existed at all.
By the time a report could reach you, that conversation has already happened.
Build for the person who has already tried to handle it alone.None of these need a staff survey. You can see all six by walking around, which is what makes them worth reporting.
How often people report concerns, and whether anything visible happens when they do.
Whether your controlled doors are still controlled at the busiest hour of the day.
Whether staff will politely ask an unfamiliar person who they are here to see.
Who shows up, who opts out, and whether leadership attends.
Whether someone can name who to call without looking it up.
Whether executives show up to this work or hand it to a coordinator.
Annual compliance training covers the material and checks whether people remember it. That gives you a record of who attended. What somebody does in the first ninety seconds of a real incident is a different question entirely.
Behavior changes when people have to make the call with the clock running, watch what it costs, and know that speaking up will not get them in trouble. A slide deck does none of that.
Stop someone in the hallway and ask who they would call if they saw something that worried them right now. If they go looking for a binder, you have your answer.
Each of these is a management decision.
Three steps. Almost everyone skips the third one, and it is the cheapest of the three.
What to watch for, how to handle a door, how to raise a worry about a colleague, and who to call. Use real names, your actual doors, your own hallways.
Run tabletop exercises where people have to decide and then live with what happens. Repetition turns knowing into doing.
Answer every report. Debrief every drill honestly. Doing it on a schedule is what carries the habit through staff turnover.
Reports going up. When more people report, it usually means they have started to believe it goes somewhere. That belief comes before every other behavior on this list. A quiet reporting line is a finding of its own.
This work has a reputation for taking years. It moves a lot faster when leadership shows up in person and reports get answered.
WorldSafe scores readiness as part of the assessment, then trains and rehearses it on a schedule. WorldSafe sells no equipment, so the findings stay about your people.
Readiness gets scored alongside the physical findings.
Scenario training built around your building and your team.
WorldSafe comes back on a schedule so the habits hold.
In almost every case, somebody saw it first. In the FBI sample more than half of those people did nothing, and most of the ones who did act went straight to the person they were worried about.1
All of this work is about getting that information to move. Name the person who takes the call. Answer every report where people can see it. Then count how many come in.
These figures come from one sample of 63 attackers. They show where attention pays off. They are not odds for any single organization.