Active Shooter Prevention: Understanding "Left of Boom"
In this post, we've updated how we describe our approach to active shooter prevention, incorporating a clearer "left of boom" framework and current FBI data. This post was originally published on May 16, 2022, and has been substantially revised and republished in 2026.
Active shooter incidents are, by the FBI's own definition, situations where an individual is "actively engaged in killing or attempting to kill people in a populated area." According to the FBI's 2025 Active Shooter Incidents in the United States report, they designated 34 such incidents in 2025, a 42% increase from 24 in 2024, though still below the five-year average of 43 incidents per year. These incidents occurred across 21 states and Washington, D.C., spanning commerce, open space, government, education, and houses of worship settings.
Most of the public conversation about these incidents focuses on response: what to do once one is already underway or has already occurred. That conversation matters, but it is not what this post, or our training, is about.
Our focus sits earlier, in the period before an attack begins. Security and law enforcement professionals sometimes describe this using a military concept called "left of boom." If you picture a timeline with the incident itself, the "boom", at the center, everything to the left of it represents prevention and preparation, while everything to the right represents response and recovery. The further left of boom an effort sits, the more it is about preventing the incident from happening at all, rather than managing it once it has started.
Different security and safety efforts sit at different points on this timeline. The table below shows where several common approaches fall, from long before any specific threat exists to the moment of an attack itself.
Security Risk Assessment — Far left. Facility-wide physical vulnerabilities and access points, typically completed long before any specific threat exists.
Behavioral Threat Assessment and Management (BTAM) — Left, individual-focused. A specific person of concern, evaluated and managed over time by a multidisciplinary team.
Structured Behavioral Observation (what we teach) — Left, closer to the moment of concern. Real-time behavioral deviations in an environment, not just immediate warning signs, but the surveillance and scouting behavior that often precedes an attack by days or weeks. Often the last observable opportunity to intervene before an attack occurs.
Active Shooter Response — Right of boom. Actions taken once an attack is already underway.
Our training sits in the third row. It is not a facility risk assessment, and it is not the formal, individualized case-management process behind BTAM. It is the practical skill of recognizing the specific behavioral deviations that frequently precede an attack, close enough to the moment of concern that there is often still time to intervene, but grounded in observation rather than a clinical evaluation of a specific individual.
What Pre-Attack Behavior Often Looks Like
Mass attacks are rarely spontaneous. Research consistently shows that perpetrators plan and prepare in advance, often spending days or weeks testing security, probing access points, and familiarizing themselves with a target location and the routines of the people there. The FBI's 2025 data backs this up directly: nearly 68% of last year's active shooter incidents involved identifiable planning and preparation by the shooter, up from 58% the year before. This preparation frequently produces observable behavior: someone repeatedly appearing in the same location without a clear reason to be there, present at a time when a building should be locked and empty, or exhibiting unusual movement consistent with pre-attack surveillance or concealing a weapon.
We saw many of these same patterns in the aftermath of the Brown University shooting, where members of the campus community noticed a person repeatedly lingering in and around the same buildings and scanning the environment in a way consistent with pre-attack surveillance, but faced uncertainty about when and how to report it. We break down what happened and what it illustrates about pre-attack behavior in Empowering Prevention: Lessons Learned from the Brown University Shooting.
An official after-action review of that shooting, conducted by the Police Executive Research Forum, documents this in specific detail. Hours before the attack, a witness observed the eventual shooter inside the building and noted that he appeared out of place, wearing clothing inconsistent with the indoor environment and temperature, along with a facial covering. When the witness followed him, he observed the suspect displaying awareness he was being watched and adjusting his movements and direction in response. This is a real, documented example of the exact pattern we teach personnel and civilians to recognize: someone whose appearance and behavior doesn't fit the baseline of the environment they're in.
As with any behavioral observation, no single behavior proves intent. It is a cluster of specific, related behaviors, assessed together and in context, that turns an ordinary presence into something worth a closer look and a report to the right person. We walk through this process in more detail in Proactive Safety and Threat Recognition: A Structured Observation Framework.
This is not just a training philosophy. For the first time, the FBI's 2025 report includes a dedicated section on potentially averted active shooter incidents, cases where law enforcement observations, tips, or information provided to school resource officers and campus police likely prevented an attack before it happened. The report's own examples of "see something, say something" successes are, in effect, the outcome that structured observation training is designed to produce.
Why This Sits Left of Boom, Not Right of It
To be clear about what this training is: it is not active shooter response training, tactical instruction, or a plan for what to do once an attacker is already in a building. It is prevention-focused training in recognizing the behavioral deviations that often precede an attack, so that personnel and the communities they protect have the opportunity to intervene well before an incident begins. The goal is not to teach people to be afraid. It is to teach them what to look for, and what to do with what they see.
This isn't limited to campuses, protests, or public events. Workplace violence follows the same left of boom timeline, and the same pre-attack behaviors, testing security, repeated presence without explanation, unusual movement, often precede an incident at a corporate facility just as they do anywhere else. Our Corporate Safety and Security and Personal & Workplace Safety Training programs apply this same structured observation process to those settings specifically.
We saw a similar application of this same structured observation process play out in a very different setting, a protest rather than a campus, in Structured Observation in Action: Identifying a Concealed Weapon at a Protest. The environment changes. The underlying skill, establishing a baseline, identifying deviations, and interpreting them in context, does not.
Building This Capability
If your organization is responsible for the safety of a campus, facility, congregation, or public space, structured observation training gives your personnel a way to move left of boom, rather than relying solely on a response plan for after an incident has already begun. Our Threat Observation, Threat Awareness for Law Enforcement, and Threat Awareness for Security Professionals programs build this capability directly. You can learn more about how each of these "threat assessment approaches" applies specifically to your field, along with additional resources and tools for each, in our companion guides:
Guide to Threat Assessment Approaches for Law Enforcement has additional resources for building out a law enforcement threat assessment program
5 Threat & Risk Assessment Approaches for Security Professionals has additional resources for security teams evaluating which approach fits their environment
If your organization is ready to move left of boom, we'd like to hear from you.
-
Doherty, M. (2016). From Protective Intelligence to Threat Assessment: Strategies Critical to Preventing Targeted Violence and the Active Shooter. Journal of Business Continuity & Emergency Planning, 10(1), 9-17.
Federal Bureau of Investigation. (2026). Active Shooter Incidents in the United States in 2025. Washington, DC: U.S. Department of Justice.
Police Executive Research Forum. (2026). After-Action Assessment of the City of Providence and Municipal Agencies' Response to the December 13, 2025, Brown University Shooting. Washington, DC: Police Executive Research Forum.