Five operational lessons in workplace lockdown procedure and threat response — and why “it won’t happen here” is the most expensive assumption in corporate security.
On Monday morning, a man opened fire from a hotel window in a quiet, densely populated Montreal neighbourhood.
By the time it was over, a police officer and a civilian were dead, a second officer was fighting for her life, and the gunman himself had been killed.
It was the first time in 24 years a Montreal officer had died in the line of duty.
That single number should stop every security leader mid-scroll: this wasn’t a high-crime hotspot with a known threat profile.
It was an ordinary Monday, in an ordinary building, until it wasn’t. Most active shooter incidents are over in under three minutes long before any external response arrives.
What happens in that window is decided entirely by what your organisation put in place beforehand.
Source: (The Guardian)
Here’s what the Montreal incident actually tells us, and the five gaps most sites still haven’t closed.
What Happened in Montreal
Police received a call around 11:35 a.m. reporting a man pointing a gun from a window of a hotel in the Côte-des-Neiges area. Responding officers were met with gunfire from a long gun as they approached the building.
Montreal Police Chief Fady Dagher confirmed one officer and one civilian were killed, a second officer was critically injured (she has since stabilised), and the suspect died at the scene. Authorities placed the surrounding blocks under a shelter-in-place order for several hours before lifting it once the site was declared secure.
Chief Dagher was explicit that no motive had been established at the time of the briefing, and urged the public not to speculate. That distinction matters operationally: your response plan has to work regardless of whether an incident turns out to be targeted, opportunistic, or something else entirely — you don’t get to wait for a motive before you act.
Why Active Shooter Preparedness Matters for Corporate Security
It’s tempting to file this under “police incident, not my problem.” The data says otherwise. In the United States, the FBI’s active shooter reporting has tracked a sustained upward trend — from roughly 20 incidents a year in the early 2000s to close to 50 in recent years — and one recent industry tracker put the 2019–2023 increase at 89% over the prior five-year period. Hotels, offices, and other commercial premises are consistently among the most common settings, not just schools or government buildings.
Australia’s threat profile and firearms environment differ meaningfully from North America’s, and any organisation building a business case here should commission a local risk assessment rather than importing US figures directly. But the operational reality — that most incidents resolve in minutes, before police arrive — is a physics-of-response problem, not a jurisdiction-specific one. It applies just as much to a CBD office tower or a shopping centre in Melbourne as it does to a hotel in Montreal.
Five Corporate Security Gaps This Incident Exposes
1. Perimeter awareness that stops at the building line
A gun visible from a public-facing window was reported by a bystander, not flagged by any internal system. Most commercial sites still rely on passive CCTV that’s reviewed after the fact, not monitored for real-time threat indicators. If your monitoring model depends on someone happening to notice, you don’t have a perimeter control — you have a hope.
2. Lockdown that isn’t rehearsed
Montreal’s shelter-in-place order worked because it was executed by a police force with practiced protocols. Most corporate sites have a lockdown policy in a document somewhere, but staff have never run it live. A policy that hasn’t been drilled will fail exactly when it matters — in the first 60 seconds.
3. First responders who aren’t first
With most incidents over before police arrive, the actual first responders are receptionists, security officers, and whoever’s nearest the door. Yet training budgets are still overwhelmingly weighted toward compliance modules rather than scenario-based drills for the people who will realistically make the first call.
4. Communication that assumes everyone’s watching one channel
Emergency alerts, radios, PA systems, and mobile messaging all failed for different people in different incidents historically — because organisations pick one channel and assume it reaches everyone. Redundant, multi-channel alerting isn’t a nice-to-have; it’s the difference between a coordinated evacuation and a bottleneck at the fire exit.
5. Coordination with law enforcement that starts on the day of the incident
Sites with existing relationships with local police — shared floor plans, pre-agreed rally points, known key-holders — cut response friction dramatically. Sites without them are having those conversations for the first time while an incident is unfolding.
Active Shooter Response Checklist: Is Your Site Actually Ready?
- Real-time monitoring (not just recorded CCTV) covers all public-facing entry points and windows
- Lockdown procedure has been physically rehearsed in the last 6 months, not just documented
- Front-of-house and security staff have scenario-based active threat training, refreshed annually
- Alerting runs on at least two independent channels (e.g. PA + mobile push)
- Local police have current floor plans, emergency contacts, and agreed rally points on file
- A named decision-maker can authorise lockdown/evacuation without waiting for head office sign-off
- Post-incident continuity plan exists separately from the emergency response plan
Frequently Asked Questions
Isn’t this an Australian-irrelevant, US-style problem?
Not entirely. The frequency and firearms context differ, but the response-time physics don’t — most incidents, wherever they occur, resolve before external responders arrive. That’s the part every site, in any country, needs to plan around.
What’s the fastest fix if budget is tight?
Start with drilling the lockdown procedure you already have. It costs nothing but staff time and closes the single biggest gap — a plan nobody has practiced.
Who should own this internally?
One named person, not a committee. Diffuse ownership is the most common reason lockdown authority stalls in the first critical minute.
Conclusion
Montreal didn’t have a known threat, a history of violence at that location, or any warning that made this site different from thousands of others. That’s exactly the point. Security programs built around “this wouldn’t happen here” are built on the one assumption Monday’s shooting just disproved. The organisations that come out of an incident like this intact aren’t the ones with the biggest security budget — they’re the ones whose people already knew, without thinking, what to do in the first sixty seconds.
If you need a more precise evaluation of your facility’s risks, Shield can conduct a comprehensive risk assessment tailored to your environment.