Why Organizations Need Active Assailant Insurance
by David Riedman, PhD, Chief Data Officer at Merrill Herzog
The conversation around “crisis readiness” and dealing with the consequences of targeted violence is no longer hypothetical. Shootings, stabbings, vehicle ramming, and acid attacks motivated by ideology, personal grievance, workplace conflict, and radicalization continue to occur across industries. Meanwhile, the expectations placed on employers, schools, and public institutions to mitigate, prevent, and effectively respond to these attacks have never been higher. The FBI’s most recent active shooter report confirms the trend shows no signs of reversing.
Crisis readiness today is not just about reacting quickly. It is about demonstrating that your organization has taken reasonable, proactive, and documented steps to prevent violence, reduce risk, and manage an incident effectively if one occurs. For leaders trying to build resilience before an emergency strikes, the best practices across education and industry are available by way of specialty insurance products.
1. Start with an Active Assailant Policy
Too many organizations think an “active shooter plan” begins and ends with run-hide-fight posters or mandatory annual training. An effective Active Assailant policy is a comprehensive crisis management framework that integrates prevention, response, recovery, and continuity of operations from the ground up. Without that structure, training exercises and signage offer only the illusion of preparedness.
Insurance policies now exist in the marketplace that reinforce this integrated approach. They provide not just insurance coverage, but structured support for crisis response, expert deployment, threat assessment, and risk mitigation. For most policies coverage applies at the insured location and within a five-mile radius, and the policy is primary and non-contributory to other insurance, giving organizations certainty that the right coverage activates first when they need it most.
The full range of what these policies cover is extensive. On the financial side, it addresses Business Interruption, Property and Contents Damage, Loss of Attraction, Temporary Premises Costs, and Increased Security Costs. On the human side, it provides for Crisis Management Expenses, Public Relations Costs, Threat Assessments, and expenses arising directly from an attack including Medical and Psychiatric care and Childcare Costs for affected employees. Legal Liability coverage is available as an optional add-on for organizations seeking the broadest possible protection.
These policies typically recognize three distinct insured event types:
1. An Attack is defined broadly as any incident involving the use of a weapon critically, it does not need to be ideologically motivated or carried out in the name of any cause.
2. A Threat covers malicious threats made against insured people or property.
3. A Stalking Threat addresses unwanted, obsessive attention that puts an insured person in fear for their safety at their place of work. This breadth of definition ensures that organizations are not left exposed when real-world incidents refuse to follow a script.
It is essential to meet in advance with the elected crisis management team, like Merrill Herzog, to review the organization’s facility risks, workforce, operations, vulnerabilities, and culture. Threat profiles change as organizations grow, staffing fluctuates, and political or social tensions evolve. Most policies include an Onboarding Consultation, allowing organizations to receive a professional review of their violence-prevention program and risk-reduction strategies, which is exactly the kind of proactive step that courts increasingly expect from employers following a violent incident.
2. Crisis Management Firms Do More Than Respond
There is a common misconception that crisis management services exist only for the moment chaos erupts. The most valuable work happens long before and long after the incident itself. Crisis management partners help organizations build resilience, document preparedness, and manage the cascading consequences that follow an attack.
Some policies explicitly cover post-incident support, including fact-finding and evidence collection, post-incident analysis and debrief reports, litigation support, and identification of legal obligations and liabilities. Each of these elements matters enormously when an organization finds itself facing a lawsuit, a regulatory inquiry, or a media firestorm. A well-documented response is not just good practice, it is also a layer of legal protection. After any workplace violence or active assailant incident, the first questions attorneys and investigators ask are:
· What did the organization know?
· What did they do about it?
· What systems were in place?
Documented consultation with a crisis management partner becomes powerful evidence of due diligence. It can significantly reduce liability, limit reputational damage, and deflect regulatory scrutiny.
Get Merrill Herzog’s stories in your inbox
Join Medium for free to get updates from this writer.
Policies also provide 24/7/365 emergency responses from a dedicated responder in the event of an incident. That around-the-clock availability matters because attacks rarely happen during business hours. The policy’s dedicated limits protect against a catastrophic peril that might otherwise fall into a gray zone under a more general property or liability policy which is precisely where cover from other insurers may be silent when it is needed most.
3. Lessons From Recent High-Profile Incidents
The incidents of the past two years offer a sobering and instructive portrait of modern threat patterns. Taken together, they illustrate why crisis readiness cannot be delegated to a single poster on the wall or a once-a-year drill.
a. Ideological and Grievance-Based Attacks Target High-Profile Organizations
The assassination of Charlie Kirk at Utah Valley University and an active shooter targeting NFL executives at 345 Park Avenue in Midtown Manhattan both illustrate how political visibility and perceived institutional power can make organizations targets.
In the Manhattan case, a man who believed the NFL bore responsibility for his personal struggles drove across the country armed with a semi-automatic rifle specifically to target the league’s top executives. He was unknown to the organization, had made no public threats, and arrived at a building with industry-leading access controls, CCTV, and armed guards in the lobby. None of it was enough to stop a heavily armed, determined attacker with the element of surprise. When acts of mass violence are this difficult or impossible to prevent, the financial and operational consequences can be devastating without adequate coverage. Business interruption, property damage, medical costs, legal exposure, and reputational harm do not pause while an organization recovers which is exactly what the Samphire policy is designed to address.
The Kirk incident demonstrated something equally important: how quickly political events or public-facing gatherings can become targets. In the aftermath, investigators scrutinized venue security, staffing decisions, access control protocols, and whether preventative guidance had been sought in advance. Organizations that had documented their preparedness consultations were in a far stronger position. Integrated active assailant insurance and crisis management support provides the bridge between policy, planning, prevention, and response — and creates a defensible, documented record when scrutiny arrives.
b. School Shootings Reveal the Speed of Escalation
The 2025 shooting at Annunciation Catholic School in Minneapolis (the highest-casualty school attack of the year, with two children killed and 29 others injured) was carried out by a former student who had exhibited concerning behavioral indicators years prior. Classmates later reported seeing warning signs long before the attack. That detail is not unusual. Research consistently finds that student reporting of peers’ concerning behavior is one of the strongest predictors of whether an attack is stopped before it happens. Combined with additional school shooting incidents in Dallas, Denver, Nashville, and rural Georgia that year, this underscores a persistent pattern of behavioral indicators that if acted upon early can interrupt an attack.
In Dallas, a student at a high school that had already experienced a shooting the previous year was allowed in through a side door by a fellow student, then opened fire on four others. The breach did not happen through a main entrance with security controls. Instead, it happened through a fire exit door that should by code cannot be secured from the inside. No security posture is airtight, which is why layered protection that combines physical controls, behavioral awareness training, and insurance coverage is the only realistic approach.
Policy definitions of Threat and Stalking Threat are designed around this kind of early-stage intervention, emphasizing documentation, early action, and immediate notification to the crisis responder before a situation escalates.
c. Healthcare and Institutional Settings Face Unique Vulnerabilities
In 2025, a man grieving the death of his partner entered the ICU of UPMC Memorial Hospital, took several people hostage, and shot and wounded three of them. Healthcare facilities face a particularly complex threat environment because they are open around the clock, have numerous entrances and exits, and serve people in their most distressed states. Emergency departments are especially exposed, precisely because high accessibility and emotional intensity are inherent features of the environment. Between 2000 and 2019, at least 146 active shooter incidents occurred in hospital settings, a number that has continued to rise. Any organization operating in a high-access, emotionally charged environment such as healthcare, education, government, entertainment and retail should recognize that the barriers separating them from an incident are thinner than they appear.
d. Random Violence Defies Traditional Risk Models
One of the most unsettling lessons from recent years is that threat assessment alone cannot stop every attack. The 345 Park Avenue incident is a clear illustration because an unknown individual with no prior relationship to the organization and no prior public threats managed to mount a surprise assault against one of the most security-conscious organizations in the country. The common thread in these attacks is not a failure of intent, but instead it is the recognition that some attacks will succeed despite best efforts. In cases where violence cannot be prevented, organizations need financial and operational resilience to recover from mass violence.
4. Additional Principles for Staying Crisis-Ready in 2026
Preventative and preparedness actions should include:
• Schedule a yearly crisis-readiness audit. Use onboarding consultations and follow-up reviews to keep plans current as staffing, facilities, and threat landscapes evolve.
• Leverage professional threat assessments. External specialists evaluate threats objectively, avoiding the institutional blind spots that make internal reviews unreliable.
• Invest in post-incident recovery planning. The policy’s Business Interruption and Personal Accident coverage directly reduces how long and how costly recovery becomes after an attack.
• Develop a transparent communications strategy. Poor messaging in the immediate aftermath destroys trust and creates legal exposure. Crisis communications support is built into the Samphire policy.
• Treat all threats as triggers for assessment. Direct, indirect, or implied threats — including stalking and online threatening behavior — should activate a documented response, not a wait-and-see approach.
• Document everything. Meeting notes, consultation records, threat logs, and training attendance create the paper trail that separates organizations that can demonstrate due diligence from those that cannot.
Crisis readiness in 2026 is not optional, and it cannot be outsourced to a single tool or training module. Build the plan, meet with the experts, and document everything. You cannot stop every threat — but you can control how prepared you are, and how protected your organization is when someone who intends to cause harm arrives at your insured property.
About Merrill Herzog
Merrill Herzog is a risk advisory and crisis response firm that helps clients prepare for and defend themselves against security risks, respond to critical and crisis situations, and safeguard commercial interests globally. In addition to helping clients navigate active assailant incidents, Merrill Herzog provides pre-incident preparation services including Risk Assessment, Safety & Security Audits (covering access control, surveillance, and communication systems), Policy Review and Development, and Training including Run/Hide/Fight, Rapid Trauma Care, Behavioral Awareness, Situational Awareness, Threat Assessments, and Drills and Exercises including tabletop, full-scale, and first responder integration. For more information, visit merrillherzog.com or email info@merrillherzog.com.
