Run. Hide. Fight. What Old Dominion University Teaches Us About the Protocol Every American Needs to Actually Know

Katherine Blastos March 14, 2026  ·  9 min read

Published by Vertex Security Services | March 2026

At approximately 10:49 a.m. on March 12, 2026, Old Dominion University's emergency notification system sent a message to every student, faculty member, and staff employee on campus in Norfolk, Virginia. It read: "Active shooter situation at Constant Hall. Follow Run-Hide-Fight protocols. Emergency personnel are responding."

Minutes earlier, Mohamed Bailor Jalloh — a 36-year-old former Virginia National Guardsman who had pleaded guilty in 2016 to attempting to provide material support to ISIS and was released from federal prison in December 2024 — had walked into an ROTC classroom, confirmed he was in the right room, shouted "Allahu Akbar," and opened fire. He killed Lt. Col. Brandon A. Shah, the ROTC program's Professor of Military Science and department chair. He wounded two other Army personnel. Then the ROTC students in that room subdued him and killed him — before law enforcement arrived. The FBI director confirmed the attack is being investigated as an act of terrorism.

Three words ended the threat: Run. Hide. Fight.

More precisely: trained people who had internalized what those three words actually require of them — and who were mentally prepared to act when the moment arrived.

The distance between an organization that has drilled this framework and one that has simply heard of it is a distance measured in lives. Old Dominion University demonstrated that on Thursday. The question every institution, business, school, and event organizer in this country should be asking right now is which side of that distance they are on.

Three Words. One Framework. What They Actually Mean.

Run-Hide-Fight is the Department of Homeland Security's established active shooter survival protocol, adopted by the FBI, FEMA, and virtually every major law enforcement agency in the United States. It is taught in corporate compliance trainings, displayed on laminated posters in office break rooms, and referenced in university emergency notification systems. It was the framework ODU sent to thousands of people in a single text at 10:49 on a Thursday morning.

The problem is not the framework. The problem is the gap between knowing a phrase and having a plan.

Run means evacuate immediately if it is safe to do so. It means leave your belongings. It means do not wait for confirmation, do not stop for others who are not moving, do not pull a fire alarm. It means you have already mentally identified at least two exit routes from every space you regularly occupy, and you move toward one of them the moment you have credible information that an armed threat is present. Distance is your greatest asset. The moment you create it, you have significantly improved your odds.

What most people get wrong about Run: they wait for certainty. They wait for a second gunshot, for a confirmation from a colleague, for the fire alarm to make the decision for them. Students in the ODU building described hearing faint screaming and not immediately understanding what it was. One student said he didn't know about the shooter until he was already at a parking garage — because he moved when the alarm went off, even though he initially assumed it was a drill. That instinct saved him. Waiting would have put him in the corridor.

Hide means deny access and conceal yourself when evacuation is not possible. But hiding is not cowering under a desk and hoping. It is an active, deliberate process of making it as difficult as possible for the threat to reach you while buying time for law enforcement to arrive. A lockable door. A barricaded door where it doesn't lock. Lights off. Phones silenced — not vibrate, silenced. Positioning away from the door and out of sight lines from windows. Staying put and not opening the door regardless of who claims to be on the other side, because law enforcement will announce themselves clearly and with authority.

What most people get wrong about Hide: they treat it as passive. Hiding well is a set of deliberate actions taken under extreme stress, in a space you have not previously evaluated, with people around you who may be panicking. The time to think through those decisions is not when the alarm is going off.

Fight means that if the threat enters the space where you are and your life is in imminent danger, you act — with total commitment and without hesitation. You use whatever is in the environment: a fire extinguisher, a chair, a laptop bag, a coffee mug. You aim for the threat's ability to use the weapon. You do not stop until the threat is neutralized. You yell, because it disrupts the attacker's focus. If there are others in the room, you act as a group, because multiple people overwhelming a shooter simultaneously is proven to be effective in a way that a single person acting alone usually is not.

The students in the ROTC classroom at Old Dominion University did exactly this. They were ROTC cadets and military personnel who train for high-stress situations, who have rehearsed physical response, and who have been conditioned to act rather than freeze when action is required. When Jalloh opened fire, they did not wait. They moved on the threat together, they overwhelmed him, and they ended it. The FBI special agent in charge said they "rendered him no longer alive." She added, plainly: "They basically were able to terminate the threat."

That is not luck. That is what training produces. And Fight is the phase of this protocol that the overwhelming majority of organizations refuse to actually train — because it is uncomfortable to rehearse, because it forces people to confront the reality that this scenario could actually happen to them, and because a poster on a break room wall does not require anyone to sit with that discomfort.

The Gap Between Knowing and Prepared

The ODU emergency alert worked. It went out quickly, it named the protocol, and it directed people to act. The university deserves credit for that. But the alert also illustrated something that security professionals have been documenting for years: sending people a protocol they have not practiced is not a safety plan. It is a notification.

Accounts from the scene described confusion that is entirely predictable and entirely preventable. Students who weren't sure what they were hearing. A student who initially assumed the alarm was a scheduled drill because there had been one the week before. People who didn't know what was happening until they were already outside. That confusion is a normal human response to sudden, unprecedented stress — and it is the exact gap that training and rehearsal are designed to close.

The ROTC students who stopped the attack were not confused. They knew what was happening, they knew what to do, and they had mentally — and physically — rehearsed the decision to act. The difference between them and the students who fled the building in confusion is not courage. It is preparation.

Your organization's people will respond to an active shooter incident the way they have been prepared to respond. If they have not been prepared, they will respond the way untrained humans respond to sudden lethal threat: with confusion, with delay, and with outcomes that training could have changed.

What a Real Emergency Action Plan and Training Program Look Like

At Vertex Security Services, we build Emergency Action Plans and deliver active shooter preparedness training for businesses, schools, event organizers, and institutions. What we build is operationally specific, not generic. A template pulled from a government website does not know your building, your workforce, your exits, your locks, or your threat profile. Your plan should.

A meaningful program begins with a threat and vulnerability assessment of the physical environment. Before anything is written, we walk the space. Where do the egress routes actually go, and which ones would be blocked depending on where a threat enters? Which doors lock? Which rooms offer cover versus concealment? Where do the camera blind spots fall? Where is your most likely point of vulnerability? The answers to those questions are different for every building, and they directly determine what your plan should say.

The written Emergency Action Plan names your actual exits, your actual lockdown rooms, your actual rally points — not generic placeholders. It designates roles with specific names or positions attached to them: who calls 911, who manages communications with law enforcement, who accounts for personnel, who is responsible for individuals who cannot self-evacuate. It is written in plain language that a new hire on their first week can read and act on. It is not a binder that sits in the HR director's office.

Active shooter awareness training delivers the Run-Hide-Fight framework in the context of your specific workspace, with your specific people, in your specific building. We cover the behavioral science of pre-attack indicators — what to look for in the days and hours before violence, not just the seconds of it. We walk through decision trees. We conduct tabletop exercises so that participants have mentally rehearsed the decisions they will face before an incident forces the real thing. We address the psychological reality of the Fight phase directly, because refusing to engage with it is not caution — it is a gap in readiness that could cost lives.

Drills close the gap between knowing and doing. Reading about what to do and executing it under stress are not the same experience. We facilitate announced and unannounced live-environment drills that build the muscle memory and instinctive response that training is designed to produce. The ROTC students at ODU responded the way they did because they train. Your people can too.

A complete plan also addresses what happens after the all-clear: reunification procedures, communication protocols with law enforcement, media management, and the human support infrastructure — employee assistance, trauma response, continuity of operations — that organizations routinely fail to build out because they are focused on the incident itself and not on what follows it.

The Broader Threat Picture

The ODU attack did not occur in isolation. It happened the same morning as a vehicle-ramming attack on a synagogue in West Bloomfield Township, Michigan. The FBI is investigating both as acts of terrorism. The United States has been at an elevated posture for domestic attacks since late February 2026.

The profile of the ODU shooter carries its own set of lessons. Jalloh was not an unknown figure who appeared from nowhere. He was a convicted terrorist who had been released from federal prison more than two years before his sentence was scheduled to end, under an early release provision for inmates who completed a substance abuse treatment program. He was on court-mandated probation at the time of the shooting. His probation officer's last home visit was in November 2025 — four months before the attack. He was an enrolled student at the university where he killed a decorated Army officer. He legally could not own a firearm, so he bought one from a man who had previously been investigated by the ATF for straw purchases and received a warning letter. The gun's serial number had been partially obliterated.

The systemic failures that allowed Jalloh to reach that classroom will be examined and debated for years. None of that debate changes what was true for the people in Constant Hall at 10:49 on a Thursday morning. They had no visibility into his prison release, his probation records, his movements, or his intentions. What they had — what your people have — is the protocol that went out in that text alert. The question is whether they know what to do with it.

Lt. Col. Brandon Shah gave his life doing what he had committed himself to: teaching and leading the next generation of military officers. His students honored that in the most profound way possible. What every organization in this country owes to the people who walk through their doors each morning is the preparation that gives those people a fighting chance if the worst happens.

Vertex Security Services

Vertex Security Services provides threat and vulnerability assessments, Emergency Action Plan development, active shooter awareness training, event security, school security, and executive protection for individuals, organizations, and institutions operating in today's threat environment. Our team brings backgrounds in Army Special Forces and law enforcement — professionals who have operated in high-threat environments and understand that effective security is built on preparation, not reaction.

If your organization does not have a site-specific Emergency Action Plan, has not conducted active shooter training in the past twelve months, or has never run a live drill — this is the moment to change that. The conversation is confidential and there is no obligation.

📞 970-989-4610

📧 admin@vertexsecurityservices.com

🌐 www.vertexsecurityservices.com

📍 P.O. Box 8604, Aspen, CO 81612

Frequently Asked Questions

What is Run-Hide-Fight and where does it come from?

Run-Hide-Fight is the active shooter survival protocol developed and published by the Department of Homeland Security, adopted by the FBI, FEMA, and the majority of law enforcement agencies in the United States. It establishes a priority hierarchy for response: evacuate if possible, deny access and conceal yourself if evacuation is not possible, and fight back as an absolute last resort if the threat enters your location and your life is in immediate danger. The framework was developed based on analysis of active shooter incidents and what survivor behaviors most consistently improved outcomes.

Why did ROTC students stop the ODU shooter when trained law enforcement hadn't arrived yet?

Because they were in the room, they were trained, and they acted immediately. Law enforcement response times — even excellent ones — involve a gap between the onset of violence and arrival on scene. At Old Dominion University, the attack began at approximately 10:49 a.m. and the all-clear was not issued until 12:15 p.m. The threat was resolved by the people in the room before the exterior response was fully organized. This is consistent with what research on active shooter incidents shows: when potential victims have been trained to respond and choose to do so, outcomes improve significantly. The ROTC students were not untrained bystanders. They acted within the Fight framework — decisively, collectively, and effectively.

What is an Emergency Action Plan and does my organization need one?

An Emergency Action Plan is a documented protocol that specifies exactly what your people should do, and who is responsible for what, in the event of an active shooter incident or other emergency at your location. Federal OSHA regulations require most employers to have an EAP that addresses evacuation procedures and emergency escape routes. Beyond legal compliance, an EAP that is site-specific — meaning it reflects your actual building, your actual people, and your actual threat profile — is the foundation of any meaningful preparedness posture. If your organization's EAP is a generic template, has not been updated in more than a year, or has never been tested through a tabletop exercise or live drill, it does not provide the protection you likely believe it does.

How is Vertex Security Services' training different from an online compliance course?

An online compliance course delivers information. Vertex Security Services delivers preparation. The difference is the difference between reading about how to perform CPR and having been trained to perform it under stress on a real patient. Our training is conducted in person, in your environment, with your people, and addresses the specific physical and psychological realities of your space and workforce. We cover pre-attack behavioral indicators, decision-making under stress, the physical reality of the Fight phase, and site-specific protocols that your people can actually execute. We conduct tabletop exercises that force participants to make decisions rather than simply receive information. We can facilitate live drills. Compliance courses check a box. Our training builds the readiness that actually changes outcomes.

How is Vertex Security Services different from other security firms?

Vertex Security Services is a woman-owned, Colorado-based firm headquartered in Aspen. Our operational leadership includes backgrounds in Army Special Forces and law enforcement with SWAT experience. We bring the kind of personnel and operational methodology typically reserved for government and high-risk contractor work to private clients — businesses, schools, institutions, and events — who need genuine capability, not the appearance of it. We are licensed, insured, and operate nationwide. Every engagement begins with an honest assessment of your actual risk profile and what it actually requires — not a pitch for services you don't need.

Vertex Security Services is a woman-owned, Colorado-based security company headquartered in Aspen, providing executive protection, armed security, school security, event security, emergency action plan development, active shooter training, and threat vulnerability assessments nationwide.