Response to the Active Assailant
in High Rises and Large Buildings
The Operational Challenge
A high-rise or large-building active assailant attack expands the problem while compressing the available time. Responders must reach the threat, move vertically or horizontally across large distances, manage complex access and building systems, rescue victims, and coordinate command operations in a structure that is often unfamiliar to local personnel.
Many responders consider events such as the 1966 Texas clocktower shooting and the Route 91 shooting as an active shooter event. Although it meets the definition, those events are elevated criminal sniper events. The tactical response priorities are different when compared to standard active shooter response. Attempting to use active shooter tactics at those events can result in increased loss of life, delayed access to the perpetrator, and command confusion.
Distance, elevation, restricted access, unfamiliar building systems, delayed medical access, and competing rescue demands change the response before public-safety personnel even reach the threat. High-rise events are not an extension of conventional active-shooter response. They require a distinct operational framework.
What You Will Learn
Why High-Rise and Large-Building Events Are Different
High-rise and large-building attacks create response problems that do not exist in conventional single-site structures. Elevation, distance, limited entry points, complex floor plans, restricted areas, elevators, stairwells, tunnels, skybridges, underground roads, service corridors, and maintenance access can delay movement and complicate coordination. This course examines how building geometry and occupancy affect notification, access, search, evacuation, sheltering, victim rescue, and protection of critical operations.
Active Shooter Versus Elevated Criminal Sniper
The first operational decision may be determining what kind of threat responders face. In a high-rise active-shooter event, the perpetrator may be moving through the structure seeking additional victims. In an elevated criminal sniper event, the perpetrator operates from a fixed or fortified position and engages victims across distance and cover. Those scenarios create fundamentally different priorities for containment, approach, observation, rescue, communications, and command.
The course addresses the danger of treating every elevated shooting as the same event, using case studies including the 1966 University of Texas clock tower attack, the 1982 Detroit Buhl Building attack, the 1993 San Francisco 101 California Street shooting, the 2008 Mumbai attacks, the 2017 Route 91 attack, the 2017 Bronx-Lebanon Hospital attack, the 2018 Long Beach senior-housing attack, and the 2019 Nairobi attacks.
Building Systems, Vertical Movement, and Entry
The response is shaped by the building before responders arrive. This course examines power, elevators, HVAC, fire alarms, alarm mode, stairwells, doors, and access control. It also addresses large-building features such as tunnels, skybridges, underground roads, service areas, and maintenance access that may help or hinder responders. Participants consider entry, movement, breaching, search marking, and communications without assuming that a standard ground-level response model will transfer directly.
Five-Phase Response Framework
The course organizes the counter-response into five connected phases: response, entry, vertical transit, assault, and victim rescue. Participants examine how responders establish command, build a usable operating picture, control doors and stairwells, use shields and ballistic capability, consider armored vehicles and breaching, mark searched areas, manage fire and explosive hazards, and coordinate rescue while the threat may remain active.
Tactical Emergency Medical Services and Command Coordination
High-rise and large-building events place unusual demands on command, triage, patient extraction, and medical access. The program examines TEMS coordination with law enforcement, fire, EMS, dispatch, emergency management, and facility representatives. Participants consider how distance and vertical movement can delay initial care, how rescue priorities compete with threat containment, and how command must coordinate safe access without creating an additional casualty problem.
Lessons from Major Events and Exercise-Ready Planning
The course concludes with additional case studies (2013 Washington Navy Yard, 2019 Virginia Municipal Building, 2020 Terminal 21 attack in Thailand, 2021 FedEx Indianapolis shooting) and translates lessons into site-specific planning questions: what responders know before arrival, how they reach the threat, how they move vertically, how they rescue victims, how building systems change, and how command and medical operations remain coordinated. The program can support later tabletop, functional, or full-scale exercises.
Intended Audience
This course is designed for law-enforcement supervisors and commanders, SWAT and tactical teams, fire and EMS personnel, TEMS providers, emergency managers, 9-1-1 personnel, public-safety officials, building security, facility managers, military commanders, and government officials. This training is not available for the general public. Participants should be familiar with their organization's incident-command, emergency-management, and mutual-aid procedures. No prior high-rise or large-building response qualification is required.
Course Logistics
Duration: 4 hours
Format: Instructor-led lecture, facilitated discussion, case studies, building-systems analysis, and a five-phase high-rise response framework. Available in person or as a live webinar..
Class Size: Host-specific and scalable. Final limits depend on room capacity, delivery platform, and the desired level of participant interaction.
Prerequisites: No prior high-rise or large-building response qualification required. Participants should be familiar with their organization's incident-command, emergency-management, and mutual-aid procedures.
Audience Scope: Law enforcement, fire, EMS, emergency management, emergency communications, military, healthcare, education, government, and critical-infrastructure leaders. Children under the age of 18 are specifically prohibited from attending.
Host Responsibilities: Provide auditorium or suitable training space with seating and sightlines appropriate for expected attendance. Technical requirements include computer, projector or display, and audio capability adequate for the room. Host should invite the disciplines responsible for law-enforcement, fire, EMS, emergency management, communications, healthcare, and related command decisions. Before delivery, the host should identify target building types, participating disciplines, known high-rise or large-building concerns, and site-specific priorities suitable for discussion. If site visits, tabletop exercises, functional exercises, or other practical components are requested, facility, staffing, safety, equipment, and attendance requirements will be addressed in a separate course plan.
Threat Suppression Experience
Threat Suppression is an approved provider of integrated active assailant response training for the Department of War, having delivered more than 165 courses at 45 major installations and trained more than 20,000 service members. The company has invested more than 50,000 hours in internal active assailant research. Leadership commanded active assailant events and served as lead authors on the 2021 Oxford High School mass shooting after-action report, one of the most comprehensive analyses of an active assailant incident response.
Threat Suppression participates in multiple state and federal workgroups that shape national active assailant preparedness standards. The company provides active assailant preparedness training, rescue task force courses, emergency management support, behavioral threat assessment and management, exercises, after-action reviews, and physical security services to federal agencies, military installations, public safety organizations, healthcare systems, schools, and private organizations. Our work combines operational experience, applied research, and field-tested instruction.
REQUEST A QUOTE | DOWNLOAD COURSE DETAILS
To schedule this course for your agency, discuss customization options, or learn more about instructor qualifications and delivery format, please contact us.
Email: info@ThreatSuppression.com
Phone: 800.231.9106
Download the full course description (PDF) with detailed learning objectives, topic breakdown, and host requirements.








