Run / Hide / Fight: active-threat response framework

The Run / Hide / Fight framework is the DHS-standard civilian response protocol for active-threat situations — adopted by federal agencies, law enforcement, and organizations across the country following the 2007 Virginia Tech shooting. According to FBI Behavioral Analysis Unit research and data from the Advanced Law Enforcement Rapid Response Training (ALERRT) Center at Texas State University, the decision a person makes in the first 60 seconds of an active-threat event substantially determines their survival odds. Most active-shooter incidents end within 10–19 minutes — either because the attacker stops, is confronted, or law enforcement arrives — making immediate, decisive action by civilians the most consequential variable in the outcome.

The framework is not complicated, but it has to be pre-loaded. Under acute stress, the brain does not generate novel plans; it executes pre-made decisions. What you understand now, sitting calmly, becomes the action you can take without hesitation when your heart rate is at 180 beats per minute. Read this once, run through the scenarios mentally, and you will have a meaningful advantage if you ever need it.

When to call 911

Call 911 as soon as it is safe to do so — ideally while running or hiding, before you are certain of the threat type. Dispatchers can relay information to arriving officers in real time. Call immediately if you observe any of the following:

Shots fired or sounds consistent with gunshots
Person with a visible firearm, knife, or edged weapon behaving aggressively or threateningly
Vehicle attack pattern — a vehicle driving into pedestrian areas, jumping curbs, or accelerating toward crowds
Suspected improvised explosive device (IED) — abandoned bag or package in an unusual location, visible wiring, unusual odors
Anyone with a weapon making threats, even if no shots have been fired yet

When you call: state your location first (building, floor, room number), describe what you heard or saw, state your current position. Stay on the line if you can — but silence your phone ringer immediately and keep yourself hidden.

Before you start

What this framework covers: Unarmed civilian response in public or workplace settings — offices, schools, shopping centers, public events. This is not a firearms-response protocol.

Incident profile: Per FBI 2023 Active Shooter Report, the majority of active-shooter incidents in the U.S. are over in under 15 minutes. Approximately two-thirds end before law enforcement arrives, meaning civilian action is often the only action.

Perpetrator profile: Per ALERRT Center data, most perpetrators are a single attacker; roughly 10% of incidents involve two or more. Plan for one; adapt if there are more.

Your goal: Not to defeat the threat. To survive it. Run increases distance. Hide removes you from the threat's awareness. Fight disrupts enough to escape or survive. All three options serve the same goal.

Terminology note: ALERRT uses "Avoid / Deny / Defend" (ADD); DHS/FBI use "Run / Hide / Fight." Both frameworks are functionally equivalent — the verbs differ, the logic is identical. This page uses Run / Hide / Fight because it is the more widely recognized public shorthand.

The framework: priority order matters

Run, Hide, and Fight are sequential priorities, not simultaneous options. Choose in order. Only move to the next option if the first is no longer viable.

RUN — if you can get out, get out. This is always the first choice. Distance is the single most protective factor in any active-threat scenario. Leaving the building removes you from the threat's presence entirely.

HIDE — if running is not viable because exits are blocked, the threat is between you and safety, or you are protecting people who cannot run (children, injured, mobility-limited). A well-selected and barricaded hide position buys time for law enforcement arrival.

FIGHT — only if run and hide are both impossible and the threat is imminent. This is the option of last resort. It is not preferred. But it is survivable when executed decisively, and it has saved lives in documented incidents.

The framework is not a guarantee. It is a probability calculation. Running improves your odds relative to sheltering in place passively. A good hide improves your odds relative to exposure. Fighting as a group improves your odds relative to compliance with an active killer.

RUN: exit identification and execution

The 30-second exit habit, applied every time you enter a new space, is the most operationally valuable thing in this entire framework. When you walk into a building, locate two exits before you sit down. Not the one you entered through — every other exit in the facility. Stairwells. Emergency exits. Service corridors. Windows that are accessible on lower floors. Do this in restaurants, offices, malls, theaters, and public venues. It takes 30 seconds and costs nothing.

When you run:

Verify direction first. Do not run toward the sound of gunfire or into a space you cannot see into. If you can identify the direction of the threat, move perpendicular to it initially, then away from the building.
Leave everything. Per DHS Run / Hide / Fight guidance, leave bags, phones in pockets, belongings at your seat. Physical items slow you and others. They are replaceable. You are not.
Move quickly and low in hallways where the threat may be present. In open space with a clear path, run at full speed. Do not crouch — distance matters more than profile in open terrain.
Help others without slowing yourself. If someone near you can run with minimal assistance, take them. If assisting them will stop you both, tell them to follow and go.
Do not stop running until you are outside the building and 300 feet (90 meters) or more away — minimum distance to reduce exposure to further shots and secondary IED risk.
Keep your hands visible as you exit and approach any responders. Law enforcement arriving on scene cannot yet distinguish witnesses from perpetrators. Empty hands held at shoulder height or above signal that you pose no threat.
Do not go back in for anyone unless you are a trained responder with communications and you know exactly where the person is. Returning to an active scene increases casualties, not decreases.

Once outside and at a safe distance, call 911 if you haven't already, and stay at that location until law enforcement establishes a perimeter and releases you.

Field note

The 30-second exit habit is the only preparation in this framework you can practice every day without any equipment or training partner. Every new space you enter: two exits, mentally noted. Within three weeks it becomes automatic. People who have developed this habit describe it as "I just always know where the doors are" — not paranoia, just orientation. That pre-loaded knowledge is what turns a 10-second scramble under stress into an immediate decision.

HIDE: room selection, barricade, and silence

Hiding is not passive. A good hide has three components that each independently increase survivability: a room that provides a barrier, a barricade that delays entry, and silence that removes you from the attacker's awareness. All three together are significantly more effective than any one alone.

Room selection

Choose an interior room over an exterior room where possible. Interior walls are more likely to provide concealment from someone moving through the building. They also reduce the number of directions from which the threat can approach.
A room with a lock is significantly better than one without. Lock the door immediately. If the door swings outward and cannot be barricaded from the inside, your best option is to remain hidden behind hard cover inside the room and stay completely silent.
Choose cover over concealment. Concealment is anything that hides you visually — drywall, cubicle partitions, light furniture. Cover is anything that physically stops a round. The difference is critical: drywall stops nothing, and most interior partition walls are drywall. Concrete walls, masonry, heavy filing cabinets, and steel door frames provide cover. If your room has a concrete or masonry wall, position yourself against it, on the side away from the door.
Avoid rooms with multiple exposed windows at ground-floor level. A window is a breach point. One interior room with a single door is easier to barricade and defend than a conference room with glass walls.

Barricade methods

Once inside the room with the door locked:

Move the heaviest available furniture against the door — desk, bookcase, refrigerator, filing cabinet. Weight matters more than configuration. Even 200 pounds (90 kilograms) of furniture against a door buys 10–15 additional seconds that can mean the difference between the attacker moving on and breaching.
Use a door wedge if available. Wedges driven under an inward-swinging door resist opening force disproportionately to their size. Purpose-made security wedges (available inexpensively at hardware stores) are worth keeping in a desk drawer.
If no furniture is movable, use a belt, cord, or clothing tied around the door handle and anchored to a fixed point — chair leg bolted to the floor, pipe, heavy structural element — to create resistance.
For outward-swinging doors (where barricading is harder): focus entirely on concealment and cover inside the room. The door cannot be effectively barricaded from the inside. Your best option is silence and position.

Silence discipline

Silence your phone immediately — not just vibrate, but silent. A vibrating phone on a hard surface is audible through a closed door.
Turn off lights if possible without creating noise doing so. Darkness is concealment.
Stay low and away from the door. Position yourself behind the best available cover at the maximum distance from the door.
Do not speak unless you are communicating critical information via text to 911 (many jurisdictions now accept text-to-911; verify your local capability in advance).
Do not open the door for anyone claiming to be police until law enforcement has formally cleared the building and given an all-clear announcement. Attackers have used this tactic to gain entry to secured rooms.

If you are hiding with others, designate one person to communicate with 911 via text while others focus on barricade reinforcement.

FIGHT: commitment threshold and improvised weapons

Fighting an active threat is a last resort. The commitment threshold is specific: you fight only when both conditions are simultaneously true:

Running is impossible because all exits are blocked or the threat is between you and any exit.
Hiding is impossible because you have been discovered, the attacker is about to breach your position, or no viable hide exists.

If either condition is not yet true, revert to the earlier option. Do not fight when you can hide. Do not hide when you can run.

When fight is the only remaining option, the research and training guidance from DHS, FBI, and ALERRT are consistent on execution:

Commit fully

Half-measures are the most dangerous option. If you decide to fight, the entire group engages simultaneously with maximum aggression. Hesitation allows the attacker to regain control of the engagement. Per DHS guidance, the objective is to disrupt and incapacitate — not to hold or subdue.

Improvised weapons

Use whatever is in the environment:

Fire extinguisher: the most consistently available and effective improvised weapon in public buildings. Discharging it into an attacker's face obscures vision, causes respiratory irritation, and makes the extinguisher a heavy blunt object.
Heavy objects: laptops, chairs, books, tools, bags with contents, fire exit hardware. Anything with weight that can be thrown accurately at range (10–15 feet / 3–4.5 meters) creates disruption before closing distance.
Hot liquids: coffee, water from a heated carafe — available in many break rooms and cafeterias.
Scissors, letter openers, pens: only useful in close contact; these are not primary tools, but they convert empty hands into something more effective.
Chair: two-handed, legs forward, used to block and push rather than swing.

Target options

The goal is to disrupt control of the weapon or incapacitate the threat long enough to escape. Target in priority order:

The weapon hand or arm — stopping the weapon from being aimed is the primary objective.
Eyes and face — the most effective secondary target; visual disruption (whether from a thrown object, fire extinguisher, or direct contact) causes immediate loss of threat initiative.
Throat — secondary option in close contact.

Note: Per standard active-threat guidance, do not target the chest if body armor is possible. Aim for extremities, face, and throat.

Team coordination

If two or more people are fighting, coordinate before the attacker enters. Designate one person to take the weapon hand side, one to engage the other side, one to throw a distraction from a distance immediately before engagement. Three people engaging simultaneously from different angles is survivable even against an armed attacker. Compliance is not.

Count to three verbally or on fingers with your group. Simultaneous engagement prevents the attacker from redirecting to one threat at a time.

Post-event protocol

The incident ending and the threat being gone are not the same thing. Follow the post-event sequence to avoid becoming a casualty of the response phase.

Law enforcement contact

Law enforcement arriving on scene is responding to an active-lethal threat and is in a high-stress, fast-moving environment. Their primary job in those first moments is threat identification, not civilian triage.

Stop moving immediately when you see law enforcement and you are in their line of sight.
Keep both hands visible at shoulder height or above, fingers spread, nothing in your hands.
Do not reach for anything — phone, ID, bag. If an officer tells you to put something down, do so immediately and slowly.
State clearly: "I am unarmed. I was hiding in room [X]. The threat was in [direction/floor]." Give what you know, briefly, in that order.
Follow every instruction without hesitation. Officers may handcuff you temporarily for scene control — this is normal procedure. Comply.
Move in the direction they indicate — do not choose your own exit route once law enforcement is on scene.

Shelter-in-place after law enforcement arrival

If you are in a secured hide position and law enforcement has entered the building, stay in place. Do not try to find officers or navigate toward the sound of activity. Wait for an officer to physically reach your location, show credentials, and give a verbal all-clear. Per FEMA active-shooter guidance, premature movement causes officers to mistake survivors for active threats.

Witness reporting

When you are clear of the scene and in a designated reunification area:

Provide a full description of anyone you saw: clothing, approximate age, height, direction of travel, any weapons visible.
Report this to the designated officer on scene or to 911 dispatch if you have not yet spoken to an officer.
Do not post to social media until you have given a statement — social media activity can compromise ongoing law enforcement operations and occasionally endangers officers still in the building.

Family reunification

Designate a family rally point before an incident happens — not during it. Per established emergency management guidance:

Primary rally point: a specific location near the family member's primary location (school, workplace, neighborhood block) — not at the scene of the incident.
Secondary contact method: an out-of-state or distant contact that all family members can reach independently to relay their status. Local networks often saturate during mass-casualty events; out-of-region contacts remain accessible.
Schools and workplaces have formal reunification plans — know your school district's reunification site in advance, and do not go to the school during an active incident. Follow the district protocol.

Mental health follow-up

Acute stress reactions after surviving an active-threat incident are normal and do not require clinical intervention in most cases — they resolve within 4–6 weeks with social support and a return to routine. Persistent symptoms (intrusive memories, hypervigilance, emotional numbing, sleep disruption) lasting more than 30 days warrant professional support.

SAMHSA Disaster Distress Helpline: 1-800-985-5990 (24/7, free, confidential, available in 100+ languages). Text "TalkWithUs" to 66746. This line is specifically designed for people recovering from disasters, mass-casualty events, and traumatic incidents and has counselors activated specifically after mass-shooting events.

Special scenarios

Vehicle-as-weapon attack

Vehicle attacks typically occur in high-pedestrian areas — markets, festivals, promenades, transit stops. The vehicle's lethal zone is directly in front of it and extends approximately 200 feet (60 meters) at highway speeds in an open space. Vehicles cannot easily turn at speed.

If you observe a vehicle attack pattern:

Move perpendicular to the vehicle's path of travel — not away from it (which keeps you in the threat corridor) and not toward it.
Get behind hard cover immediately: concrete barriers, parked cars (engine block side, not door panels), building facades, stone planters. Drywall and glass do not stop vehicles.
Move uphill if available — most vehicle attacks occur on flat or downward-sloping terrain; an attacker cannot easily drive uphill at speed into a crowd.
Do not crowd in the vehicle's natural stopping zone — after a vehicle attack, the attacker may exit with a secondary weapon.

Workplace incidents

Most active-threat planning assumes a stranger attacker. Workplace incidents often involve a known person — former employee, domestic partner, or current colleague in crisis. The risk profile differs slightly: the threat may know building layout, know who is present, and have a specific target list. The response framework is identical, but workplace incidents reinforce why exit familiarity and barricade preparation matter regardless of perceived threat level.

When entering any workplace building, make it a routine to vary which entrance you use on different days. Familiarity with multiple routes means you have multiple options in any emergency.

School incidents and parent protocol

When a school reports an active-threat incident:

Do not drive to the school. This is the single most counterproductive action a parent can take. Parents converging on the school block emergency vehicles, obstruct law enforcement perimeter establishment, and can be caught in a secondary attack or misidentified as a threat. Per school district protocols and law enforcement guidance nationwide, parents are routed to a pre-designated reunification site — typically a community center, large parking area, or alternate school within the district.
Know your district's reunification site in advance. Find it before you need it. It is published in your district's emergency plan.
Monitor the district's official communication channels — school app, district website, text alert system — rather than social media, which is typically faster but also more frequently incorrect.
Students are trained to follow teacher/staff direction in an active-threat event. In almost every documented case, students who followed their school's protocol were safer than those who deviated from it.

Active-threat response checklist

Identify two exits in every new building you enter — before you sit down
Know your school district's reunification site and your employer's emergency plan
Set a family out-of-state contact that everyone can reach independently
Locate the nearest fire extinguisher on every floor of your workplace or school
Text-to-911: verify whether your county supports it (check county emergency management website)
Know your organization's active-threat plan — most schools and major employers have one; ask for it
Know the SAMHSA Disaster Distress Helpline: 1-800-985-5990

The active-threat response framework does not require physical fitness, special training, or equipment. It requires only pre-loaded decisions. The situational awareness habits that keep you in Condition Yellow in public spaces — particularly baseline calibration on entry and continuous exit awareness — are the upstream complement to this framework. Awareness creates the seconds that make Run possible before Hide becomes necessary. For the decision structures that govern physical confrontation within use-of-force law, self-defense law covers the legal framework that surrounds any physical resistance decision. If your household's emergency planning includes evacuation from your area, evacuation and mobility planning extends this framework into the transportation and route-selection decisions that follow an active-threat event.