Ep 114: What is an Active Threat?
Episode 114
Published Jun 23, 2025
Last updated Feb 18, 2026
Duration: 25:56
Episode Summary
Understanding what constitutes an “active threat” is crucial for first responders, as it directly impacts how they prioritize their actions during critical incidents. This episode provides actionable insights for law enforcement, fire, and EMS professionals to improve response effectiveness and save more lives.
Episode Notes
In this episode, our hosts dive into what truly defines an "active threat," focusing on scenarios like active shooter events and the critical decisions first responders must make in real time. They discuss how to recognize when a threat is still actively causing harm versus when the situation shifts and responders need to quickly transition from pursuing the attacker to providing lifesaving care to victims.
The conversation highlights the importance of situational awareness, explaining that if responders continue searching for a threat after the danger has passed, it can delay medical help and cost lives. The episode also covers the challenges law enforcement faces in recognizing these transition points, the impact of training and communication, and why understanding the difference between an active threat and a cleared scene is crucial for saving lives during high-stress incidents
Key Points Covered
- Defining “Active” in Active Threats
The episode explores what it truly means for a threat to be “active,” emphasizing that it’s not just about someone having committed violence, but whether there is ongoing danger—such as an attacker still actively causing harm. - Transition from Active Threat to Rescue Mode
The team discusses the critical moment when responders must shift focus: when the immediate threat is no longer present, the priority must move from neutralizing the attacker to rescuing and treating the injured. - Stimulus and Response
Responders are trained to move rapidly toward the source of danger (the “stimulus”), bypassing injured victims if necessary to stop the threat. Once there’s no longer evidence of active killing, responders must quickly transition to rescue operations. - Operational Indicators
A practical tip: if responders are moving past doorways and not stopping, they’re still in “active threat” mode. When they begin clearing rooms or pausing at doors, it’s often a sign the threat is no longer active, and priorities should shift accordingly. - The Importance of Communication and Manpower
The episode highlights the need for clear communication and sufficient resources. Multiple teams may be required to handle both threat neutralization and rescue at the same time, depending on manpower. - Mindset Shift for Law Enforcement
The hosts stress the importance of changing the traditional law enforcement mindset—recognizing that once the active killing stops, saving lives through rapid rescue becomes just as urgent as stopping the attacker.
Why This Matters
Understanding what constitutes an “active threat” is crucial for first responders, as it directly impacts how they prioritize their actions during critical incidents. The episode provides actionable insights for law enforcement, fire, and EMS professionals to improve response effectiveness and save more lives.
View this episode on YouTube at: https://youtu.be/TfqpsDgg21g
Transcript
Bill Godfrey:When we talk about an active shooter or an active threat, what do we mean by the word active? That's today's topic coming up now.
Welcome to the "Active Shooter Incident Management" podcast. My name is Bill Godfrey, your podcast host. I am joined by two of my other fellow instructors here at the National Center for Integrated Emergency Response, Kami Maertz on the law enforcement side.
Kami Maertz:
Hello
Bill Godfrey:
Kami, thanks for coming back in.
Kami Maertz:
Thank you for having me.
Bill Godfrey:
And Pete Kelting, good to have you back. It's been a hot minute since you've been in the studio.
Pete Kelting:
Absolutely, Bill, it's a pleasure to be back.
Bill Godfrey:
All right, so today's topic, we are going to be talking about what we mean by active when we talk about an active threat or an active shooter event. And more specifically, how to distinguish the two, which is not always real clear. Kami, you want to start us off?
Kami Maertz:
So I think obviously we always know that there has been an active threat. There's been injured, somebody has come in and shot, but when does that become no longer active in what we are considering active. And so we're looking for things of stimulus, that driving force that is pushing our contact teams forward to bypass the original injured, to push past, knowing that that active killing is still occurring, that active threat is still on scene, still actively killing, and we have to eliminate that threat.
Bill Godfrey:
Pete, what are your thoughts?
Pete Kelting:
Yeah, absolutely. You know, the event starts with dispatch. So intelligence that comes in just from the call takers, you know, immediately kind of define that it's an active threat, that there's an active shooter. But the stimulus that Kami just talked about is we have to constantly be aware of that. You know, what dictates our movement from our first responders and when we switch in to pushing RTFs down range?
Bill Godfrey:
So when we teach this, one of the things that we typically tell law enforcement is, when you are pushing past doorways, when you're ignoring doorways and ignoring rooms and you're pushing down a hallway, then you are clearly on the trail of an active threat. When you no longer are comfortable pushing past a doorway and now you're stopping and you're taking a quick peek or maybe even doing a room entry to check that room, you've now switched to clearing. And your second priority is supposed to be rescue. So the threat at that point is no longer active or you've lost intel, you've lost track of 'em. And so until something else picks up, the active threat moves to the next priority, which would be rescue of the injured. Is that enough of an explanation?
Kami Maertz:
Well, I think it is changing the mindset, right? And so our purpose is to try to push home of what an active threat is. And what you're saying is correct. If we're moving to clearing, then we've moved past that second priority and people are going to die. And so we have to keep that mindset of what are our priorities and continually go down and say, "Are we looking for an active threat because we have active stimulus? Are we looking for an active threat because we're in tunnel vision, and we're continuing to move towards a last indication?" And I think if we start doing that, we're chasing ghosts. And if we're chasing ghosts, we're not taking care of our second priority in that rescue.
Pete Kelting:
Yeah, absolutely, I think just as you said, that if we pay attention, it's a constant transition from our contact teams down range is, is the stimulus there to keep us moving towards a threat? It's a balance of a situational awareness of understanding how many officers you have on scene also. The communication of follow-on officers saying, "Hey, we're arriving, we're entering this, you know, location of the building," that then you can start to make some strategic decisions. You know, does this team continue to push through the stimulus that we think is still active? Or do we, you know, put another team to look at intel, talk to witnesses really quick or even, and you know, throw some stop the bleeding bags out. But it's gotta be a constant transition situational awareness of where we're moving through the building and how we need to do that.
Bill Godfrey:
You know, it seems when we run these scenarios in training where the shooting stops and the responders don't know why, they don't know if the person has committed suicide, if they fled the scene, if they've been subdued by the people they were attacking, you know, the shooting stops and you don't know why. And it always seems to be an interesting learning point to try to get them to recognize, oh, the situation has changed, and I need to transition from active threat mode to rescue mode. Why is that so hard for law enforcement to make that change?
Pete Kelting:
You know, I think we were talking about it a little bit off camera is, you know, post-Columbine, you know, law enforcement, the responsibility is to train the response to go into the situation was mainly put on tactical officer mindset, tactical officer training. And that was greatly-
Bill Godfrey:
Now when you say that, you mean the SWAT teams were doing the bulk of the training?
Pete Kelting:
SWAT team, some type of tactical, you know, component that was doing the most of the training. And we were very successful at that, but we seemed to tend to stop at the transition. We would, you know, either contain the bad actor or put the bad actor down and then what, right? So we've come a long way. And I think a lot of agencies are moving towards that, realizing that that transition immediately to, you know, what is, you hear me say all the time, you know, what is our threat right now? The clock or the gun? And so when we know, or the stimulus, when we know that we need to keep moving through, like a lot of the early training videos, if you remember you saw training videos that say, "We're stepping over injured, we're stepping over injured." Well, we only step over 'em if we need to go after that threat stimulus.
Bill Godfrey:
The threat.
Pete Kelting:
The threat.
Kami Maertz:
Yes.
Pete Kelting:
But at that point in time, if it's not there and we're paying attention to our intel, we're listening to our radios, we've got good communication through tactical to our contact teams, then we make decisions to start looking at that, you know, that rescue portion of it. And that we're not just stopping at the high five of putting the bad guy down.
Kami Maertz:
Yes.
Pete Kelting:
We're actually, you know, transitioning to that rescue that you talk about so well.
Kami Maertz:
And I think you brought a good point up earlier too, about the manpower, right? Because a lot of it is dependent on manpower. If you have plenty of contact teams that are on scene at the same time, you can have officers who are continuing to move forward, starting going on to maybe your third mission as long as you have that second mission prioritized. So if you have people who are doing rescue, you can have additional contact teams who are moving in looking for additional injured maybe in other locations, determining if you need a second Casualty Collection Point, all of those things. But also looking for another bad actor, right, in that same scenario. So it doesn't mean that you're gonna switch everybody to doing rescue and nobody else can continue to look if you have the manpower, but it's gonna be dependent on manpower.
What you don't wanna do is prioritize clearing above rescue. And I think sometimes that's what we do because of what you're saying though, 'cause that's kind of what we're trained, right? Is look, look, look, look, look until we find that bad person, until we find that and we eliminate that threat at all costs, let everything else go. And I think that's one of the big things that we have tried to really push to say that you're not winning in that because you're losing to the clock, and that clock is just as valuable as getting rid of the bad guy and eliminating that bad guy.
Bill Godfrey:
And historically, there's a pretty notorious example of this kind of coming home to roost. There was a large agency that had a school shooting, and their definition of a hot zone was it was hot until the suspect is killed, captured, or contained. And it's a beautiful soundbite, it's a great soundbite. What it doesn't account for is when the suspect is no longer shooting, and you don't know why. Maybe they've left the scene, maybe they've committed suicide, they've been apprehended, they gave up, they're going to try to go barricade up someplace else. It doesn't mean the threat is gone.
And I think that's the thing that becomes so hard to communicate effectively when you're trying to teach these concepts, is we're not saying that there isn't a threat anymore. It's that the threat isn't actively killing.
Kami Maertz:
Yes.
Bill Godfrey:
And it's almost like, you know, Pete, you mentioned, what's your threat right now, is it the suspect or is it the clock? I almost wonder if we didn't miss an opportunity to say, at a certain point, if the suspect is no longer killing, the active threat is the clock, and you need to get onto rescue. But I don't know how we communicate that more clearly than we already have been to try to get law enforcement to understand, yes, you are going to be uncomfortable with not knowing why the suspect has stopped shooting. And? So what?
Kami Maertz:
Yes.
Bill Godfrey:
There's work to be done if we're going to save lives, we've gotta get on it and get the rescue started.
Kami Maertz:
Well, I think also even with that, so I think there is sometimes a failure or misunderstanding of the Casualty Collection Point security's job is. So some of the concept, or the statements have been made, "Well, what if he comes back around, and he comes back into the Casualty Collection Point, and you're doing rescue? No, you have security, and their job is to protect that room. That is their role. Their role is to protect that room. Now, if you have enough people in there and they can start that direct threat care, they can start that direct threat care, but their job is security. They are securing that room. So you have police officers and law enforcement who are waiting for somebody to come back in. And if that bad actor makes an appearance, they can eliminate that threat.
And so the mindset of if we set a Casualty Collection Point that we're gonna somehow turn into fire rescue and we're doing all the rescue is a wrong concept. We are not not protecting people. We're not set, not creating areas that are secure and safe. We are doing that in the Casualty Collection Point. That is part of it.
Bill Godfrey:
You know, Pete, that's a really good point. The entire reason we're setting the Casualty Collection Point is to get security over an area because we're in an unsecured area. And if we knew the outcome of the suspect and we knew that the suspect was in custody, we wouldn't really have an unsecured area anymore, would we?
Pete Kelting:
Right, and I think that's a true definition between when we, you know, try to emphasize, you know, we recognize that everything's a hot zone when we first arrive, but we've gotta transition down to warm zones. We've gotta feel comfortable that we've got security elements in place that you're talking about. I commonly always say, you know, "Hey, RTFs come with cops and guns." That's a reason, right?
Kami Maertz:
Yes.
Pete Kelting:
And so we gotta be comfortable working in that warm zone. Could the threat reappear at any given point? Absolutely. But that's why we have security elements in place.
The other thing is that, you know, early on, years ago, as we went down this road in training with contact teams and RTFs, there was a lot of misunderstanding about, a lot of folks would say, "Hey, we can't repurpose contact teams, they're just for getting the bad guy." But like you said, you know, we're talking about many contact teams down range. It takes a little bit to get RTFs to your Casualty Collection Point or whatever. Those contact teams were all trained in, you know, basic first aid, were carrying tourniquets, or stop the bleed kits in a lot of, you know, places, now schools, commercial buildings. We've gotta transition some of those contact teams to start dealing with the injuries at that point in time waiting for RTFs to get in place, because every second is a drop of blood, like I was talking earlier.
Bill Godfrey:
Yeah, and I think it's important to note that a contact team basically deals with security problems. That's their primary mission. But their secondary mission is saving lives. And if you've got a contact team of three or four and you have injured, so at least one or maybe two of the team members stay on security and keep heads up while the others do medical. And sometimes I feel like that gets lost in translation, is we're not suggesting the entire team drops their guard and turns their back on the hallways and starts working on medical. No, it becomes a team mission, if you will. Some are gonna stay on security and some will turn their attention to medical. How well do you think people get that?
Kami Maertz:
I think honestly in the trainings, I think it comes across very clear because you have the people who are actively doing it. So those people will be maintaining, because even in the training, right, they're looking for that bad actor to come in, they're making sure. And then you have other people who are doing those direct threat cares. So I think in the training it does come across, which is why it comes down to training. Which is why it comes down to teaching whatever kind of training we're doing that some people are going to maintain security. And I think even giving that appearance and showing how it's supposed to work is really important to kind of getting past that "We've always done it this way, let's continue to do it this way," is to say, "this is a way to do it, but it's a good way to do it," right? And this makes sense if you can see how it functions. Does that make sense?
Pete Kelting:
Absolutely, I think it ties back into what we started off with is that, is the threat still active, right? And based on the amount of contact teams we have down range-
Bill Godfrey:
And by active, meaning they are actively killing.
Kami Maertz:
Active stimulus.
Pete Kelting:
Active killing, active stimulus, you're hearing shots fired, you're getting tactical or dispatch telling you that somebody just called in from-
Kami Maertz:
Active intel.
Pete Kelting:
Active intel from building such and such. And you realize you're near that, and you make a decision to keep pushing on. But there's also immediate action plans too, is like if you have a contact team of four, some agencies might, you know, be very well off to run six on the first one. What's the immediate action plan? You and I stay here, the four go and hit the, you know, keep pushing towards the active threat, but we're gonna deal with this immediate medical attention.
Kami Maertz:
It's starting to create those warm zones, right?
Pete Kelting:
Correct.
Kami Maertz:
'Cause that's the main thing is you have to create those warm zones. You can't prioritize chasing through hot zones if you're not going back and creating warm zones. And if you have six people, it is those immediate action plans, even in a Casualty Collection Point. And we do it in training all the time. If you have that Casualty Collection Point set, if you have four people. If you have four people in there, as soon as you walk in that room, there should be an immediate action plan and says, "If an active threat breaks out, we're staying, you two are going so that everyone knows the plan," So that has already been discussed. If scene is not active, you don't have active stimulus, there's nothing you've moved into rescue, there needs to be a plan that's already predetermined, already discussed of if it breaks active, you're going to do something. And that is part of the training though, right? That's part of the mission. So that's not a deviation from it. That is part of the training, that's part of the plan.
Pete Kelting:
And it's the confidence in leadership that our folks take charge down range in the contact teams. And where we kind of fault on that a lot of times I see across the country, especially on multi-jurisdictional response if they haven't trained together a lot, it seems like everybody's just pushing towards the active threat. Everybody wants to keep pushing towards the active threat, and there's really no sense of who took charge down range and say, "Hey, let's develop this immediate action plan and deal to the known bleeding right now and push to the threat when we need to push to the threat."
Kami Maertz:
Yeah, and then they are the eyes and the ears for tactical. So they're the ones who are down range, they see what's going on and to redisperse those entities, right? So if they call back and say, "Hey, we have six standing here and there's no longer a need for six here," so they can tell tactical, "we're gonna send two forward to go and do this." But that way everyone's communicating the plan, but everyone knows the plan and you're not wasting resources. But it is the contact team leaders who are really looking around and saying, "How can we reutilize these people."
Pete Kelting:
Get that situational awareness and have confidence in what you're doing.
Kami Maertz:
Yes.
Pete Kelting:
Absolutely.
Bill Godfrey:
So little bit of a tangent on this question. Do you think that part of the difficulty that we've seen in getting law enforcement to shift gears from this bad guy at all costs before we do anything else, this singular minded, we have to have an accounting of what has happened to the bad guy, we have to tie that off and know what happened to him. Is part of our difficulty crossing the chasm on this that we haven't really convinced a lot of law enforcement why it matters and really made the case with data about how five minutes, 10 minutes of continued bleeding really matters? Do you think that's part of it, we haven't made our case yet to law enforcement?
Pete Kelting:
Yeah, I mean, I think so in the sense of, I commonly refer to after-action reports. And almost every after-action report, you know, is put together the timeline of the bad actor moving through the venue, so to speak. And you can see where okay, this victim first had, you know, shots or injuries. And then you see where contact teams have moved in. And it's either not sure where the active threat was, it's a large facility. We think we need to keep clearing. We've gotta get that across to everybody that, hey, it's important to have your situational awareness and respond to the active threat as it's continuing.
Bill Godfrey:
As long as it's active.
Pete Kelting:
As long as it's active. But make that transition into saving lives where you need to.
Kami Maertz:
I think some of it is also the training in the silos. You train for tactical and for tactical purpose. You're going after that bad guy, and your success is you know, capturing that bad guy or knowing what happened to that bad person, right? The bad actor is like you're saying though, is having that accountability, tying that string and saying, "We know exactly what happened, and we're done for our tactical." That's the success there. And the other side of it is rescue. And so if you're not marrying those entities and realizing the importance of both sides of those, I think that you lose it. And I think for law enforcement for years we highly focus on the tactical portion of things. That's just our training, we revert back to training, especially things like this. So we're reverting back to that training. Our training has been for many years, tactically, go down, find the bad person, find what's happened here and end it, and/or you know, end it in containing whatever it is versus that rescue component.
Bill Godfrey:
You said something that made me think, do you think psychologically we may have a challenge in that individual law enforcement officers who may be on a contact team feel like if they didn't find the suspect that they failed? That it feels like a failure if I don't know what happened to the suspect? Could that be part of what we're battling?
Kami Maertz:
I think that's some of it, I think mentally is also, is that it's a fear that kind of drives it too. That tunnel vision into that fear of we gotta find this, we have to end this. And that drives it into that tunnel vision of, "What if they come back around? What if they injure somebody else? What if I didn't know, what if I didn't do enough?" And those questions, so I do think what you're saying is legitimate, like, I do think that that's a fear for them and it drives that tunnel vision to not keep that situational awareness, to not realize that there's other things killing people right now. It's not only the gun is killing people, other things are. What injuries they've created are killing people right now. And if we don't stop that, we are not helping anything. So we're not helping the big picture of saving lives if we don't stop the bleeding.
Pete Kelting:
Yeah, and I think when you look at communication, and we keep coming back to that is, you know, it's important we drive home, you know, if you put a bad actor down, relay the information, white male, you know, whatever dressed in this and so forth. So you can try to eliminate those plus-one feelings. Like, you want to keep finding that other shooter. And then somebody's following up on the intel, you know, it's come into dispatch that there was one shooter and this was the description. Okay, we know we confidently feel that we have that person down. Then we can kind of say, "Hey, maybe we don't have to put that much emphasis on chasing that plus-one shooter that we're so used to trying to say we need to do."
Kami Maertz:
And intel is a huge portion. When you are on these scenes, people are going to give you intel. If it's coming from dispatch or it's coming from other parties who saw this person, maybe they're connected to this person, right? Maybe that person came here and they know exactly who it is, they can tell you what vehicle they were driving. You can start all those intel. So you don't wanna chase past or run past that person giving you intel when you're looking for somebody who may not even be there anymore, may have already, you know, committed suicide, all the things and you're pushing past, with all of your resources, past that vital intel. Our intel should really be driving our response.
If anything, it should be allowing us to take that information in. Because what if the person did? What if this person told you, "Hey, that is Bob, and I know Bob and Bob is wearing this." Well, Bob has recirculated back into your population and is back sitting there waiting. What if that happened, and if you had stopped and listened to that intel, you would know exactly who the shooter is and where they're at?
Bill Godfrey:
So going a slightly different direction, but I'll bring this back real quick. When we teach and train this stuff, we often tell fire and EMS, "Look, unless you're pre-deployed at a planned event," excuse me, unless you're pre deployed at a planned event, it is almost impossible to get a rescue task force deployed into the warm zone in under 10 minutes. It's just really, really difficult to get that done because of everything that law enforcement has to do. And in fact, when we look at the data from our full scale scenarios and we look at the charts, that's exactly what we see. It is typically around a 12 minutes plus or minus that the rescue task forces are getting down range. Now, you know, sometimes they move them a little faster, sometimes they go a little slower.
Interestingly enough, when we give them scenarios where the shooting has stopped and they don't know why, the rescue task forces always seem to be delayed. It's usually 15, 16 minutes before they're pushing down range. But what that shows us is that law enforcement is there with the injured for about 10 minutes. And you can see, 'cause the system we use has a realtime bleeding model. So from the moment a person's injured, whatever their injuries are, one gunshot, four gunshots, whatever. And as that realtime bleeding model continues to calculate, you can actually see that, when law enforcement gets involved in patient care quickly and early, they save a lot more. Because if the injured lay there and continue to bleed, even for that 10 minutes waiting for RTF, we typically see at least two, sometimes three that had survivable wounds but simply bled out to the point where they became a cardiac arrest, they went into, you know, when it became a trauma code because they bled out.
Do you think it would help to package messaging? And this is probably a different podcast entirely, but do you think it would help to package messaging for law enforcement to show them the data and make the case from a statistical point of view that, "Hey, this is what happens. And when you spend 10 minutes doing this instead of this, this is the outcome." Does that get us over the hump, or is that just the wrong thing for the wrong audience?
Pete Kelting:
No, it's absolutely right on track. I think we refer to the ME report from Pulse, and there's a couple other ME reports out there that talk about survivable wounds maybe if there was, you know, quicker immediate care. You know, early on in our deliveries, Bill, we used to, many of the instructors would, you know, say, "By show of hands, who carries a tourniquet?" when tourniquets first became popular, right? And we'd get the show of hands, "I carry a tourniquet." Okay, and then the next question was, "Who's the tourniquet for?" And it would be a debate, "Well, it's for me or my partners, for me or you," right?
Kami Maertz:
Yes.
Pete Kelting:
Okay, what about the bleeding, you know, person right there, "Well, still just for me or you." And when that debate started, and at first those tourniquets were in what? Go bags, they weren't even on us.
Kami Maertz:
Yep.
Bill Godfrey:
Yes.
Pete Kelting:
Right? They came in a go bag. And then we transitioned to, "Well, let's carry it on ourselves." Well, they've been asking me who's the tourniquet for. If I'm gonna stick to it's for me or you, then maybe I should carry two, right? And then we went from carrying two to, "Maybe we oughta put a stop the bleed kit in some of our go bags and so forth." Let's get stop the bleed kits in schools and places like that.
Kami Maertz:
Yes.
Pete Kelting:
What's that telling us is that when we have the moment and opportunity to save somebody's life by putting a tourniquet on, we need to have that tourniquet, no matter if it's for me or you or for the person laying in front of us that's wounded. So we're making that transition and that progress, but we've gotta get that message out there a little bit more emphasized and clear that this is what we want to do.
Bill Godfrey:
It is an interesting question. You know, we want to turn the tide. We've got the data, the information. We know what needs to happen. How do you message that to get it to take hold and not get distorted? And how do you get your mind off of that singular mission focus and realize that, just because I don't have the suspect in cuffs and I don't know what happened to him, doesn't mean I failed on that mission.
Kami Maertz:
No.
Bill Godfrey:
Because if I turn my attention to the people that were shot and I save lives, then I have, by all definition, had a successful outcome to the mission. It's really an interesting challenge.
Well, hey, thanks both of you for engaging in this conversation, talking about this topic. And if you have any questions about this, you can put 'em in the comments or you can email us at info@c3pathways.com. We're always happy to help answer any questions that you might have. If you have some specific needs in your organization and you'd like some assistance, give us a call. We're here to help. Thank you to our producer, Karla Torres. And as always, until next time, stay safe.