Every officer has heard run-hide-fight. It gets taught in orientation, printed on posters near the break room, referenced in every active-shooter awareness video a client’s HR department has ever forwarded. It is also, for a contract security officer standing a post, close to useless as a decision framework — because it was written for civilians with no assigned role, and an officer is not a civilian with no assigned role. An officer has a post, a post has a function, and the active shooter response protocol for security officers that actually holds up under stress is the one written into that specific post’s orders long before anyone hears a first shot.
The question run-hide-fight doesn’t answer
Run-hide-fight tells a bystander how to survive. It says nothing about whether that person’s job in the next ninety seconds is to get themselves to safety, get other people to safety, lock down a specific area, or relay what they’re seeing to responding officers. For a security officer, that question — what is my function right now — is not something to figure out in the moment. It has to already be answered, in writing, specific to that post, before the incident starts.
This matters because the honest, uncomfortable fact about the first ninety seconds of any active-shooter event is that almost nothing an officer improvises in real time will be as good as something they rehearsed and had assigned to them in advance. Adrenaline degrades decision-making in predictable ways: tunnel vision, auditory exclusion, a strong pull toward doing something familiar even when it isn’t the right something. An officer whose post order says “in an active threat, your role is to initiate lockdown of Zone C and notify dispatch on the primary channel” has a script to fall back on when the rest of their brain is not fully online. An officer with no assigned role is making a judgment call from scratch, under the worst possible conditions to make one well.
Why the answer depends on the post, not the officer
This is the part that gets lost in generic active-shooter training, which by necessity has to be written for a general audience. A generic answer cannot tell a hospital lobby officer, a school-entrance officer, and a warehouse-perimeter officer the same thing, because their functions in an active threat are not the same.
An officer stationed at a controlled entrance may have a role centered on denying further entry and directing arriving responders to the scene — someone has to be the person who tells police exactly which door, which floor, which direction the threat moved. An officer inside an occupied building with no ability to see the threat directly may have a role centered on initiating lockdown procedures for the areas under their control and getting an accurate headcount or evacuation status back to the client’s own emergency team. An officer on a roaming patrol with radio contact may have a role centered purely on relay: report location, description, direction of movement, and stay far enough back to keep doing that. None of these are “hide,” none of these are “fight,” and none of these are the same as each other. They are all legitimate answers, and the wrong move is picking the generic one instead of the one written for that specific post.
This is also why an officer who transfers between posts, or who picks up a shift at an unfamiliar site, cannot assume their role carries over. The active-shooter function at post A does not transfer to post B just because the same person is standing it. If the post order at the new site hasn’t been read — really read, not skimmed at the start of a shift — the officer is back to improvising from scratch.
Building the active shooter response protocol before the first 90 seconds, not during them
The protocol only works if three things are already in place, and all three are pre-incident work, not in-the-moment work.
The post order has to actually specify the role, not gesture at it. “Follow active shooter protocol” is not an instruction an officer can execute; it’s a placeholder for one that was never finished. A usable post order says what this specific post’s officer does, who they notify, and on what channel.
The officer has to have read it recently enough to recall it under stress. A post order an officer skimmed once during initial training six months ago is not reliably retrievable at 2 a.m. under adrenaline. This is a training-cadence problem as much as a documentation problem — the answer has to be reinforced, not just filed.
The communication path has to actually work in the first ninety seconds, not eventually. A relay role is worthless if the officer’s only way to reach dispatch is a phone call that has to be dialed, answered, and understood before any information moves. A direct channel — an open push-to-talk line to dispatch and, where the client’s plan allows it, to other officers on site — cuts the time between “I see something” and “the right people know it” from a phone-tag sequence to a button press. In an active-threat scenario, that gap is not a minor efficiency gain; it is most of what determines whether the information reaches responding police while it’s still useful.
What goes wrong when this isn’t built in advance
The failure mode is not usually an officer freezing completely — it’s an officer defaulting to the generic civilian instinct because the specific one was never given to them. They hide, because that’s what the poster said, when their post order actually needed them to be the one relaying the shooter’s last known position to police. Nobody trained them wrong on purpose; the post order just never said anything more specific than “follow protocol,” and under stress, the vaguer, more familiar instruction wins.
Whatever the officer’s role was, the minutes after the threat is contained are also part of the protocol, and they’re the part that’s easiest to shortchange once the adrenaline fades. A clear, time-stamped account of what the officer saw, what they reported, and when — captured while it’s fresh rather than reconstructed from memory during a debrief days later — is what the client, the responding agency and, if it comes to it, the company’s own attorney will all eventually ask to see. Treating that record as an afterthought is its own failure mode, separate from but just as costly as freezing in the moment.
The fix is not more general awareness training — most officers have already had plenty of that. It’s making sure every post’s order answers the specific question before an incident, reviewing it often enough that it’s actually recallable, and making sure the officer’s communication tool works instantly rather than requiring a sequence of steps to reach the person who needs the information. Written down and drilled, “what do I do in the first ninety seconds” stops being a judgment call and becomes muscle memory.
This is not legal or safety-compliance advice, and specific active-shooter protocols should be developed with each client, local law enforcement, and qualified security consultants who know the site. If your company is building or reviewing post orders across multiple sites, see how post orders live in the app alongside real-time push-to-talk radio communication, or get in touch to talk through how your officers access them in the field.