If you cannot evacuate safely under the Run Hide Fight protocol, the recommended action is to hide. Get out of the assailant's line of sight, lock or barricade the door, silence your phone, turn off lights, and stay quiet until law enforcement confirms you are safe. Hide only after running has been ruled out, and fight only if hiding becomes impossible.
The protocol's order is not arbitrary. Run removes you from the threat zone. Hide denies the attacker a target when escape is blocked. Fight is the last resort when the other two fail. That hierarchy reflects how attackers select victims, how long most incidents last, and how responders identify threats. The depth below explains the mechanism behind each step, the numbers that shape it, and the practical thresholds that separate a good decision from a fatal one.
The decision hierarchy and why it is ordered this way
Run Hide Fight is a decision sequence, not a menu of equal options. The order reflects a simple probability argument. Distance from the attacker reduces risk more reliably than concealment, and concealment reduces risk more reliably than confrontation. Each step trades a smaller chance of harm for a larger one only when the earlier step is unavailable.
The mechanism is target selection. Active assailants generally move toward visible, accessible victims, and they tend to avoid locked or barricaded rooms when a quicker option exists. A fleeing person creates distance and leaves the attacker's field of view within seconds. A hidden person is not visible but remains physically present, so the attacker must be delayed long enough that police arrive or the attacker moves on. A fighting person must close distance and overpower an armed opponent, which carries the highest risk.
The protocol also assumes law enforcement will arrive. That assumption underpins the entire hide strategy. Hiding works because it buys time until responders can locate and stop the attacker. A strong barricade converts a few seconds of attacker attention into minutes of delay, and those minutes matter more than most people realize.
Quantified context: how long incidents last and how victims die
Most public active-assailant incidents end quickly. Federal analyses of hundreds of incidents have found that the majority conclude in five minutes or less, and many in under two minutes. Police response and engagement times have shortened over the past two decades as active-shooter training became standard. The practical implication is that hiding for two to five minutes is a realistic, survivable window.
Distance and visibility drive outcomes. Attackers with firearms hit visible, stationary targets far more often than moving or concealed ones. In incident reviews, victims who fled or hid had substantially lower fatality rates than those who remained in the open or confronted the attacker without a weapon. The exact percentages vary by dataset and methodology, so treat the direction as reliable and the specific figures as context-dependent.
Casualty counts also cluster. A small number of incidents produce most deaths, and those tend to involve attackers who move methodically through accessible spaces. Locked doors, barricades, and early flight interrupt that methodical progress. That is why the protocol emphasizes speed in the first seconds and discipline in the next minutes.
Edge cases that change the calculus
The protocol breaks down in specific environments, and knowing the exceptions prevents blind rule-following. A few situations warrant different weighting.
Open-plan offices and retail floors: concealment is thin, so prioritize a hardened room with a lockable door over a cubicle or shelving aisle. Classrooms with interior corridor windows: cover the window, move occupants away from the door, and position behind heavy furniture rather than beside it. Outdoor venues with no lockable structure: distance and hard cover beat concealment, so run toward exits and place solid objects between you and the attacker. Elevators and stairwells: stairwells can be escape routes or ambush points, so choose based on sound and sight lines, not habit. Hospitals and care facilities: immobile patients cannot flee, so staff must weigh defend-in-place against moving ambulatory people, and hiding with patients requires pre-planned rooms. Nighttime or low-light settings: darkness aids concealment but also slows your movement, so silence and stillness matter more than speed.
The professional caveat is that the protocol is a default, not a script. Training organizations describe it as a framework and expect judgment. A locked door that traps you in a dead-end room with no secondary exit is worse than a hallway with an escape route, and a barricade that takes 90 seconds to build can cost more time than it buys.
Misconceptions that cost lives
Several persistent beliefs about hiding are wrong or dangerous. Correcting them is part of applying the protocol correctly.
"Hide means duck behind a desk." Concealment hides you from view; cover stops projectiles. A desk is neither. Use a lockable room and a barricade. "Call 911 immediately and stay on the line." Call as soon as you are safe and silent, give location and attacker description, then mute. A ringing or talking phone reveals your position. "Playing dead is reliable." Attackers sometimes confirm casualties. Hiding behind a barrier and staying silent is more reliable than lying in the open. "Fighting is always heroic." Fighting is recommended only when hiding fails and death is imminent. Unarmed confrontation with an armed attacker usually fails. "Locking the door is enough." Locks slow entry but do not stop it. Add a barricade with heavy furniture and brace it low. "Police will know I am a victim." Responders cannot distinguish you from the attacker on entry. Keep hands visible and empty when they arrive.
The counterintuitive detail is that silence and immobility often matter more than physical cover. An attacker scanning a room for movement will miss a still, quiet person behind a barrier even if that barrier is thin, while a person behind solid cover who shifts or whispers gives away the position.
Comparison of response options
The table below compares the three protocol actions plus two common alternatives people sometimes improvise. It frames each by what it requires, what it protects against, and when it fails.
| Option | Primary mechanism | Works best when | Main failure mode |
|---|---|---|---|
| Run | Creates distance, exits the threat zone | A safe exit is visible and reachable | Exit leads into the attacker's path |
| Hide | Denies visibility, adds time delay | Escape is blocked, a lockable room exists | Room has no lock, barricade, or secondary exit |
| Fight | Stops the attacker directly | Hiding has failed and death is imminent | Attacker is armed and you are not trained |
| Play dead | Appears non-threatening | Very rarely, in open areas with no cover | Attacker confirms casualties |
| Shelter behind cover | Blocks projectiles | No lockable room, hard cover available | Cover does not conceal movement or sound |
Run protects best when a clear route exists. Hide protects best when a defensible room exists. Fight protects only as a last resort. The alternatives are improvisations with narrower conditions and higher failure rates.
Timeline of a hide decision
The table below maps a realistic sequence in an office or classroom setting. Times are approximate ranges drawn from incident timelines and training guidance, not fixed rules.
| Time from first alert | Action | Why it matters |
|---|---|---|
| 0-15 seconds | Recognize gunshots or alarm, stop and listen | Direction and distance determine run versus hide |
| 15-30 seconds | Move to the nearest safe exit or room | Early movement avoids the crowd surge at main exits |
| 30-60 seconds | Lock or barricade, turn off lights, silence phone | The first minute decides whether the room is defensible |
| 1-3 minutes | Move occupants away from door and windows, stay low and quiet | Attackers scan for movement and sound |
| 3-5 minutes | Remain still, monitor for responder commands | Most incidents end in this window |
| 5-15 minutes | Prepare to evacuate on responder instruction | Police may clear rooms before the building is secure |
| After clearance | Exit with hands visible, follow responder directions | Prevents misidentification during the response |
The key threshold is the first minute. A room secured within 60 seconds is far more defensible than one secured at three minutes, because the attacker's search pattern has usually moved past nearby rooms by then.
Practical actions with concrete thresholds
The following steps convert the hide recommendation into specific behaviors. Each has a threshold or condition attached so the action is testable rather than vague.
Choose a room with a solid door, a working lock, and at least one secondary exit or window if escape becomes possible. Rooms without a lock are last choices. Barricade with the heaviest available furniture placed low and braced against the door, and add a secondary wedge. Aim to make entry take longer than 30 seconds. Silence your phone completely, including vibration and alarms, and turn off lights that are visible from outside the room. Do not rely on airplane mode alone. Move at least 6 feet from the door and stay below window height, out of the line of sight through any glass. Call 911 only after the room is secured and quiet. Give building, floor, room, number of people, and attacker description, then mute. Stay still and silent until law enforcement identifies themselves and gives clear instructions. Do not open the door to anyone who has not been confirmed as police.
A few red-flag warnings deserve emphasis as warnings rather than instructions:
Do not hide in a room with a glass door or interior window unless you can cover the glass and block sight lines. Do not barricade a door that is your only exit if the barricade cannot be removed quickly. Do not shout for help or wave through windows once hidden; signal only if you are certain responders can see you and the attacker cannot. Do not assume a locked door is safe if the wall or door is thin; move behind hard cover as well.
Reconciling thresholds matters here. Training sources give different minimum distances, barricade targets, and phone-silence steps. The reconciliation is directional: farther is better, heavier is better, and quieter is better. Treat any specific number as a floor, not a ceiling. A 30-second barricade target is not a guarantee; it is a minimum effort that correlates with survival.
Limitations of the protocol and what it cannot do
Run Hide Fight is a general framework, and it has real limits. It cannot account for every building layout, every attacker behavior, or every occupant capability. People with mobility impairments, young children, or large groups need pre-planned alternatives that the three-step sequence does not provide.
The protocol also assumes training and rehearsal. A person hearing the steps for the first time during an incident will execute them poorly, and a barricade built under stress by untrained hands often fails. Organizations that adopt the protocol should pair it with drills, room-level plans, and clear communication systems.
Finally, the evidence base is observational. Incident reviews describe what worked and what failed, but they cannot run controlled trials on active-assailant responses for obvious ethical reasons. The protocol reflects the best available pattern, not a proven causal law. Apply it with judgment, and defer to local law enforcement guidance and facility-specific plans when they exist.
This article is general educational information about emergency response, not a diagnosis, treatment plan, or official safety directive. It does not promise any outcome in an active-threat situation. For immediate danger, call local emergency services, and follow the instructions of law enforcement and your facility's safety officers.