The Value of Time During an Intruder Response: An Interview with Mark Warren

Once a critical incident has begun, people have only moments before needing to take action. But without training, it’s difficult to know what action to take is the right one.

Join this recorded as Mark Warren from Strategos International comes back for Part 2 of 3 webinars about Emergency Preparedness. In this session, Mark will: 

  • examine the difference between a trained versus an untrained response,
  • discuss the impact of the physiological and psychological response,
  • share response models and their effect on response,
  • define the difference between the Professional First Responder as opposed to the True First Responder.
Justice Clearinghouse Editors (JCH): This webinar is a continuation of your previous webinar, “Does Preparation Equal Prevention? Why Prepare for an Intruder Response Incident.” Does someone need to have attended the previous webinar in order to understand this webinar?  

Mark Warren: The previous webinar was a general overview of this type of critical incident. This time we will try to dive deeper into the various elements of a critical incident. We have broken up the previous topic into three distinct areas; the prevention phase, the response phase, and the recovery phase. We will go into each area in a more in-depth study so that participants will hopefully have a better understanding of the types of things they may already be doing or should consider doing in their respective facilities.

We will want to identify the various risk factors for workplace violence, accepting risk, overcoming normalcy bias, the trained versus an untrained response, the various response models and some advantages and disadvantages of each, visitor management processes, reunification considerations and the overall communication element throughout the life cycle of the critical incident are a few of the topics we will cover over the three webinars.


“The untrained response starts with

startle and fear, followed by Normalcy Bias, disbelief, denial, panic and helplessness.

This downward spiral causes many people to take no action during a crisis

leaving the suspect to decide who lives and who dies.”



JCH: What are the most common mistakes people make when they first realize their organization or company has been intruded or that there is an active shooting taking place?

Mark Warren: Unfortunately, many people suffer from “denial” and have never accepted the fact that something like this could occur to them. Because of this, they have never really mentally prepared themselves to have to respond to a crisis such as this.

We often tell people that “the body cannot go where the brain has never been.” This means that most people wind up relying on their innate survival instincts, which is the fight, flight or freeze reaction. The brain’s basic level survival instinct is activated through the sympathetic nervous system as a fear-based response to the threat of either serious pain, injury or death. Once the sympathetic nervous system activates, any of the fight, flight or freeze reactions could be the appropriate one, but you have no guarantee which one the brain will choose for the body to respond with.

What we really need to do is to train to overcome our basic level instincts. Through proper training, you are programming the brain in potential responses to given circumstances that elevate better possibilities for a better outcome. This training must consist of more than a tabletop exercise or watching a video. That is why in our hands-on training we conduct controlled scenarios to allow people to understand, in real time, their possible responses to given stimulus.

When you study tragedies such as these, so many times you see that people actually appear to do very little. No reaction in a crisis makes one really wonder how someone could freeze and do nothing while someone is attempting to take your life. We have analyzed many of these incidents and what you start seeing is the difference between a trained response versus an untrained response. The untrained response starts with startle and fear, followed by Normalcy Bias, disbelief, denial, panic and helplessness. This downward spiral causes many people to take no action during a crisis leaving the suspect to decide who lives and who dies.



“We knew how police were going to respond, we knew how to think like a bad guy,

so the real question was:

“if that was my family member working as a teacher in a classroom

and this happened, what would I want them to know,

and how would I want them to respond before the police get there?”



JCH: Many law enforcement and public safety agencies will “practice” their responses – have drills – where they will practice how to respond to a  mass casualty incident. Why should justice/public safety-related organizations practice what to do when they have become the target?

Mark: Just as previously stated, our response, good or bad, is heavily dependent on our previous training, but more importantly the quality of the previous training. Most police departments now recognize that it is important to create the “battlefield” for our officers. The first time they see the chaos of the fight, we want it to be in training and not real life.

In 1954 General Orlando Ward said, “One of the biggest reasons for failure in the field of battle is not knowing what to do next…….this is a result of not having been trained thoroughly in what to expect on the battlefield.”

Now, most police departments realize it is not enough to only take their officers to the range to fire their weapon. This is only one small aspect of a fight. The real decisions are not made pulling the trigger, but before. So now we conduct force on force training where officers have to learn to fight another person that is and will think and shoot back. This is important because we are training officers to overcome the activation of the sympathetic nervous system. It is not normal to expect anyone to run toward the sound of shots fired but in law enforcement, we do all of the things that the average person would not want to do. This can only be accomplished through proper training

In fact, the courts have said that we have to provide training that is adequate to the task that must be performed. Therefore, in an active homicide in progress, the first thing officers had to be re-trained to do after Columbine is to go to the threat and place them under as much pressure as possible. This has evolved to the point that it is accepted practice with even one officer. We still cover multiple officers but now we are focusing more on good decision making for the individual officer so that they understand what their response requires at any time. If we stop the threat, cause a barricade, cause him/her to commit suicide or surrender. Once the threat is stopped we have to switch to other priorities such as secondary threats, and triage/crisis casualty care for the injured.

As the response evolution continues, the national practice of the Rescue Task Force is gaining a lot of momentum. Many people have perished after attacks because of the delay in getting wounded people the appropriate care in the critical time. Police officers were not trained for this element and were relying on EMS/Fire not realizing at the time that their protocols had them not entering an area deemed unsafe.

This discussion must continue, but as a national trainer, I still see a lot of Fire/EMS personnel who are reluctant to enter the scene. This is a training issue and the various terminologies between police and fire is part of the problem, which needs to be worked out.

Another area often overlooked in the response groups is the dispatchers. They are a crucial component in getting the appropriate responders on scene. The disconnect is currently dispatchers are trained to inquire and ask questions that are more for the protection of responding emergency personnel than the victim caught in the middle of a homicide in progress. We train dispatchers to approach the problem from a balanced problem-solving solution.

The police are trained to make decisions on a “life safety priority list” which identifies a pecking order of possible involved people. This order is: victim, citizen, officer and last, suspect. We will always place a victim as our highest priority, willing to risk our life to save theirs. The next person we will place before our safety will be any involved citizens, or someone who could become a potential victim if we don’t act. Then the officer will act on behalf of a fellow officer before himself and the suspect is always last. The suspect’s life is not worth our life and our tactics will change to reduce risk to officers over suspects. Once dispatchers understand the concept, they start directing the calling party to better protect themselves.


JCH:  Mark, you have a lifetime of experience – from military to law enforcement. What drew you to this particular line of work after a rich and fulfilling career in law enforcement? How has what you learned in your previous law enforcement/military life helped prepare you to help others prepare for Intruder Responses? 

Mark: I have been very fortunate during my career to do a lot of the things or career goals I wanted to do. I was lucky to have a grandfather (St. Louis Metropolitan Police Department 32 years) and an uncle (Chief of Police in Livingston, MT) who were both police officers and I knew from talking to them I wanted to be a police officer since I was 16 years old.

I never realized how the career goals I set for myself would put me where I needed to be now, but it has. I was assigned patrol duties and worked for small and large agencies, county and city, which allowed me to understand the difference in law enforcement resources and how the same type of problem may have to be handled completely different.

I worked undercover for five years as a drug investigator and this is when I really matured and understood how to think like a bad guy. I was a team leader on our buy bust team responsible for planning and executing high-risk arrests. After working undercover, I went back to uniform and earned a position on our SWAT Team. I loved the training and dedication required to always be prepared to respond at any hour to any situation. I was allowed to work in almost every position on the team, except breacher, and became one of the lead trainers and assistant team leader. I became a field supervisor and as a Seargent. I really enjoyed attempting to help officers identify their career goals and get them into the training needed to accomplish their goals.

I think one of the biggest factors that helped prepare me to assist other people was always learning to see from someone else’s perspective. It started once I learned to start thinking like a bad guy, which most cops start doing with great success. It helps us solve crimes and catch criminals in the act. We started training law enforcement and military operators in all of the tactical arenas but in about 2007, we started to realize that even though we were training police officers to respond faster and better to these potential homicides in progress, the suspects were still having success.

There was a disconnect and the Virginia Tech attack really brought it out to us. Police set the record for the best possible response to an “active shooter” incident, we were on scene in 2-3 minutes with two SWAT Teams, and one suspect set the record for the most killed in a school shooting in the U.S. This was a huge turning point for us and made us ask some different questions. We realized that the people who were on scene when these incidents occurred determined success or failure more than anyone else.

So the question we asked ourselves was from a different perspective. We knew how police were going to respond, we knew how to think like a bad guy, so the real question was: “if that was my family member working as a teacher in a classroom and this happened, what would I want them to know, and how would I want them to respond before the police get there?” When we started answering that question we could see where the failure in response was occurring. Our training systems and response protocols are designed from three perspectives: police response, suspect actions and the “True First Responders” (the people on the scene) actions.


…”One of the biggest factors that helped prepare me to assist other people

was always learning to see from someone else’s perspective.”


We also started identifying the various peer groups within a community and what type of role they would play in the overall incident. These incidents affect a community from top to bottom and because of this, the solution has to be the community. We call it a “Community Response Philosophy.” Once you identify the group you can start identifying the knowledge base that particular group needs to have and what the training should consist of. This is where we have excelled as a company by understanding this and working with our clients from a holistic approach to prevent, respond and recover from these incidents.


JCH:  Without giving the webinar away, and keeping in mind that we have the whole spectrum of the justice community, what will audience members learn from your presentation that they can then immediately apply to their own preparedness efforts?

Mark: I would have to say the first thing I hope everyone can walk away with is a better overall understanding of awareness and why a community is at risk to these incidents. Once they accept risk they can start planning to overcome the risk.

Second, understand that preparation does not equal prevention. By accepting risk, planning and preparing to overcome the risk, we put into place policies and procedures that give us a better possible response to a given situation. While we may not stop an incident completely, we will mitigate the overall outcome and lessen the damage and enhance the recovery phase.

Third, I hope to assist people in identifying the various peer groups in their respective communities and what types of discussions they should be having to better prepare for a crisis.

The three webinars are broken into the main three phases of an incident: prevention, response, and recovery.

In the Prevention Phase (webinar 1) some of the areas we will look at are:

  • Awareness and the role it plays,
  • Recognition,
  • Assessments,
  • Reporting Threats,
  • Planning: Policies/Procedures and Access Control,
  • Visitor Management

In the Response Phase (webinar 2) we will look at:

  •    Lock down Principles
  •    Lockdown Failure
  •    Response Protocols and Methods
  •    Training and Drills

In the Recovery Phase we will look at:

  •    Communication Capabilities
  •    Memos of Understanding
  •    Organized Evacuations
  •    Transportation
  •    EMS Role and the Rescue Task Force
  •    Casualty Care
  •    Reunification Areas and Set Up
  •    Debriefing Procedures
  •    Counseling Services



“We realized that the people who were on scene when these incidents occurred

determined success or failure more than anyone else.”


Click Here to Watch “Effective Response – The Value of Time During an Intruder Response Incident.”




Additional Resources
6 years ago
Crisis Communications During the Aurora Movie Theater Shooting
A few weeks ago, we went through the detailed timeline of the Century 16 Theatre Shooting in Aurora […]
6 years ago
INFOGRAPHIC: Lessons Learned from the Seattle Pacific University Shooting
This infographic, based on a webinar, reviews the basics of emergency management, the types of mi […]
6 years ago
Lessons Learned from the Aurora Movie Theater Shooting: An Interview with Lt Stephen Redfearn
Prior to the Pulse Nightclub shooting in Orlando, the Aurora Movie Theatre shooting was the largest […]
7 years ago
Effective Crisis Leadership: An Interview with Dr. Jeff Fox, PhD
Leadership isn't easy.  While managing and leading during a routine day - the type of day where you […]