First 30 Group

10/11/2026

We had the opportunity this past week to present at the inaugural New Jersey Standardized Active Violent Event Response (SAVER) Summit, attended by approximately 130 police, fire, and EMS personnel, most of whom were Active Shooter Incident Management instructors.

The presentation, "Managing the First 30 Minutes: Mass Attack Response for Law Enforcement Leaders," focused on five recurring challenges identified through a review of dozens of mass attack after-action reports and interviews with 17 first responders involved in these incidents.

Despite differences in the locations, circumstances, and scale of these attacks, many of the same challenges continue to emerge:

-Command & Control
-Awareness (Communication, Situational & Domain Awareness)
-Multi-Agency Integration
-Resource Management
-Casualty Care

As part of the presentation, we used our First 30 tabletop exercise kits to facilitate a simulated school attack that challenged participants to coordinate resources, manage competing priorities, and make decisions across multiple operational locations, including those beyond the attack site.

It was great working with so many experienced instructors, exchanging ideas, and discussing ways to improve preparedness and response.

Thanks to the New Jersey Office of Homeland Security and Preparedness and the SAVER team for the invitation and for organizing an excellent summit.

10/07/2026

How do you simulate hundreds of responders without putting hundreds of responders in the field?

Put them on the table.

First 30 TTX tabletop exercise kits are scalable from short roll-call exercises to complex command-level exercises involving hundreds of simulated responders and resources.

Use our maps, or incorporate your own maps and floorplans of critical locations in your jurisdiction. Change the scenario. Change the objectives. Run it again.

And when the exercise expands, so do the resources.

Each kit comes with hundreds of resource chips. Patrol. SWAT. K-9. Fire. EMS. Mutual aid. Federal agencies. Investigators. PIOs. Police chaplains. Counselors. SROs. Federal agents. HAZMAT and EOD teams. Red Cross and CERT. Drones. Off-duty cops. Snipers. Fire Marshals. And much more.

Whatever shows up during a large-scale response, we have a chip for that.

Reusable, scalable, and designed to make large-scale response training practical, reusable, and affordable.

Bring realistic mass attack tabletop training to your agency with the First 30 TTX Series.

09/30/2026

Time is critical in a mass attack response. The window to stop the threat, begin lifesaving care, and transport critically injured victims is short.

Toward the back of NFPA 3000, Standard for an Active Shooter/Hostile Event Response Program, is a particularly useful section: Annex E.

Although this annex is not considered part of the requirements within the standard, it provides five response benchmarks for informational purposes:

✅ Address the Active Threat (0-60 seconds): First-arriving officers immediately search for and stop the threat.

✅Establish Unified Command (5 minutes): Police, fire, and EMS physically co-locate and establish Unified Command.

✅Initiate Point-of-Wounding Care (10 minutes): First responders administer medical treatment.

✅Evacuate and Transport First Critical Victims (20 minutes): Transportation of critically injured victims.

✅Transport All Critical Victims (30 minutes): All critically injured patients are transported, with noncritical patients stabilized.

💡 Five minutes is a fast benchmark, and historically, establishing Unified Command quickly has been a recurring challenge. When achieved, early Unified Command can be a gamechanger, improving coordination and accelerating casualty care, evacuation, and transport to hospitals.

These benchmarks are extremely useful for training.

Exercise facilitators should measure not only whether participants accomplish an objective, but how quickly they accomplish it. This provides measurable performance data, identifies where time is being lost, and establishes clear goals for future training.

The first 30 minutes will shape the entire response. Every minute matters.

Source: National Fire Protection Association (NFPA). NFPA 3000: Standard for an Active Shooter/Hostile Event Response (ASHER) Program. 2024 ed.

09/23/2026

One of the best after-action reports we have read is the report on the terrorist attack at the Inland Regional Center in San Bernardino, California.

It's more than 140 pages of well-researched lessons learned, but the reason it has always stood out to me isn't the level of detail.

It's the title: "𝐁𝐫𝐢𝐧𝐠𝐢𝐧𝐠 𝐂𝐚𝐥𝐦 𝐭𝐨 𝐂𝐡𝐚𝐨𝐬"

That simple phrase captures one of the greatest challenges in responding to a mass attack.

Common challenges documented in reports from incidents around the world identify several issues:

✅ Lack of effective command
✅ Poor integration between agencies and organizations
✅ Overconvergence of responders
✅ Resources chasing ghost calls
✅ Communications failures
✅ And many others

Mass attacks are chaotic by nature. The goal isn't to eliminate the chaos. It's to bring order to it as quickly as possible.

That work begins long before the first 911 call.

It starts with planning together, training together, and building relationships before a crisis occurs.

A simple progression can make a tremendous difference:

1️⃣ Crawl: Host a multidisciplinary meeting with the agencies that would respond to a major incident in your community. Start the conversation.
2️⃣ Walk: Conduct multidisciplinary 𝐭𝐚𝐛𝐥𝐞𝐭𝐨𝐩 𝐞𝐱𝐞𝐫𝐜𝐢𝐬𝐞𝐬 that focus on the challenges consistently identified in after-action reports.
3️⃣ Run: Conduct full-scale exercises that test those plans under realistic conditions. Then keep training.

The title of that report is just as relevant today as it was after San Bernardino.

How is your organization working to bring calm to the chaos before the next major incident occurs?

09/16/2026

One of the biggest challenges during a mass attack isn’t getting resources to respond. It is managing them once they arrive.

After-action reports from mass attacks repeatedly document massive convergence, with hundreds of responders and resources arriving from numerous agencies and disciplines.

And they don't all bring the same capabilities.

✅ Detectives will be needed for witness management and investigative follow-up.
✅ Red Cross or volunteer personnel may support operations away from the attack site.
✅ Police chaplains become an important resource for survivors and families.

Specialized law enforcement, fire, EMS, emergency management, private security, and others will arrive with capabilities that can be put to work.

The challenge for incident commanders isn't simply establishing staging and tracking those resources. It is understanding the capabilities they bring and putting the right people in the right places.

Tabletop exercises provide an opportunity to practice the realities of resource management. Instead of generic “Law Enforcement” or “Fire/EMS” resources, use specialized chips representing the assets that may actually arrive. SWAT teams, K-9 units, federal agents, chaplains, Internal Affairs, Crime Scene Units, HAZMAT teams, investigators, off-duty personnel, and others bring different capabilities. 𝐏𝐚𝐫𝐭𝐢𝐜𝐢𝐩𝐚𝐧𝐭𝐬 𝐦𝐮𝐬𝐭 𝐝𝐞𝐜𝐢𝐝𝐞 𝐰𝐡𝐞𝐫𝐞 𝐭𝐡𝐨𝐬𝐞 𝐫𝐞𝐬𝐨𝐮𝐫𝐜𝐞𝐬 𝐚𝐫𝐞 𝐧𝐞𝐞𝐝𝐞𝐝, 𝐡𝐨𝐰 𝐭𝐡𝐞𝐲 𝐬𝐡𝐨𝐮𝐥𝐝 𝐛𝐞 𝐨𝐫𝐠𝐚𝐧𝐢𝐳𝐞𝐝, 𝐚𝐧𝐝 𝐰𝐡𝐞𝐧 𝐭𝐡𝐞𝐲 𝐬𝐡𝐨𝐮𝐥𝐝 𝐛𝐞 𝐮𝐬𝐞𝐝.

That thinking is behind the large variety of personnel and resource chips we built into the First 30 Group Tabletop Exercise Kits.

Because when you can count on a lot of resources showing up, you need to practice how you’re going to organize them, prioritize them, and put them to work.

𝐖𝐞 𝐇𝐚𝐯𝐞 𝐚 𝐂𝐡𝐢𝐩 𝐟𝐨𝐫 𝐓𝐡𝐚𝐭.

08/13/2026

Coordinating the Blue Tsunami

Mass attack responses frequently involve overconvergence - dozens or even hundreds of officers arriving quickly, often from multiple jurisdictions and agencies.

Speed matters - but large numbers of officers operating inside a Hot Zone without coordination can create serious risk.

The Washington Navy Yard attack (2013) illustrates this clearly.

A total of 117 officers from multiple agencies entered Building 197 during the initial search for the attacker - many without coordination with Command and many in plain clothes.

During the response, eight officers from five different agencies discharged their weapons.

The After Action Report noted:

“It was reported that at least one law enforcement officer indicated that he and his colleagues were federal officers and the Navy Yard was a federal facility; therefore, they did not need ‘permission’ to respond to the incident and enter the scene. Despite the truth of that statement, the officer is ignoring the much greater implications and 𝐢𝐧𝐜𝐫𝐞𝐚𝐬𝐞𝐝 𝐫𝐢𝐬𝐤 𝐜𝐫𝐞𝐚𝐭𝐞𝐝 𝐛𝐲 𝐚𝐧 𝐮𝐧𝐜𝐨𝐨𝐫𝐝𝐢𝐧𝐚𝐭𝐞𝐝 𝐫𝐞𝐬𝐩𝐨𝐧𝐬𝐞.” (emphasis added)

Uncoordinated entry with multiple agencies operating independently can result in an ineffective use of resources and raises the risk of blue-on-blue incidents.

✅ Train officers to deploy deliberately, not reflexively
✅ Establish and enforce Staging early in the response
✅ Actively control who enters the Hot Zone

Packing the Hot Zone with cops isn’t the solution.

Managing it is - and that can be a heavy lift.

Does your training address overconvergence?

08/01/2026

60 years ago today: One of America’s earliest mass attacks unfolded at the University of Texas when a man, using sniper tactics from the top of the tower, killed 15 people before police and a civilian stopped him.

✅ Pre-attack murders: Before climbing the tower, the attacker killed his mother and wife. Similar pre-incident killings occurred in other attacks, including Charles University (Prague, 2023), Virginia Tech, VA (2007), Isla Vista, CA (2014), and others.

✅ Attacker access: The attacker hid weapons and am******on in a large footlocker, used a rented dolly to move it through the tower, and disguised himself as a maintenance worker. An associate professor recalled seeing him and assumed he was simply a “workman with dolly and equipment.”

✅ Attacker barricading: To delay arriving police, the attacker used furniture and wedged a dolly against a door leading to his position.

✅ Sniper tactics: Positioned 231 feet above ground, the attacker fired on pedestrians below - wounding a man from over 500 yards away. The survivor later commented that he had underestimated the sniper’s effective range.

✅ Monitoring response: Equipped with an AM/FM radio, the attacker listened to live news reports to track developments during the assault.

✅ Concerns of multiple attackers: Heavy gunfire and constant movement on the tower led many to believe multiple shooters were involved.

✅ Public safety response: With limited training and resources, it took 96 minutes for police to end the attack. Officers were outgunned—some retrieved hunting ri**es from homes and am******on from hardware stores. An armored truck assisted in evacuating the wounded. Lack of command and control further hindered response efforts.

✅ Aircraft use: A deputy piloting a small plane with a police sharpshooter onboard, responded above the tower. Turbulence prevented accurate fire on the sniper. The attacker fired at the plane, striking it twice, but not hitting the occupants.

✅ Bystander intervention: Armed citizens retrieved personal ri**es, returned fire, and one civilian ultimately helped police neutralize the attacker.

✅ Early lockdown tactics: Long before “Run, Hide, Fight,” civilians improvised barricades. Eight people, including two nuns, blocked a doorway using a blackboard and desk for protection.

✅ Legacy and change: The unprecedented nature of this event helped spur the development of SWAT teams to handle catastrophic incidents more effectively.

07/30/2026

𝐅𝐢𝐫𝐬𝐭 30 𝐓𝐓𝐗 𝐢𝐬 𝐧𝐨𝐰 𝐚𝐯𝐚𝐢𝐥𝐚𝐛𝐥𝐞.

Mass attack after-action reports continue to identify familiar operational challenges: establishing Unified Command, prioritizing limited resources, coordinating across disciplines, and making critical decisions during rapidly evolving incidents.

The First 30 TTX Series, developed by First 30 Group, was designed to help public safety agencies and schools prepare for these challenges through realistic, objective-driven tabletop exercises built on lessons learned from real-world incidents and nationally recognized incident management and exercise principles.

The series includes:

✅ Active Shooter
✅ Complex Coordinated Terrorist Attack (CCTA)
✅ School Safety (all-hazards)

Each kit includes large vinyl maps, hundreds of role-specific resource chips, scenario injects, a comprehensive facilitator guide, and supporting resources to help agencies design and facilitate meaningful tabletop exercises that strengthen coordination, command, and decision-making.

Every exercise is an opportunity to identify gaps, improve coordination, and strengthen preparedness before a real incident occurs.

Additional information about the First 30 TTX Series is available in the comments. If you have any questions, feel free to reach out.

07/22/2026

It was a pleasure speaking with hundreds of police, fire/EMS, and school safety professionals about the importance of an integrated response during mass attacks at schools. Using real-world case studies, we examined lessons learned from past incidents and discussed how coordinated planning and response can save lives.

Greg Pass, Director of Training and Research, First 30 Group, presenting "From Classroom to Command Post: Integrating School Critical Incident Response"

05/28/2026

Not Just Street Cops: Integrating Non-Traditional Law Enforcement Officers during Active Shooter Response

In the early moments of a mass attack, you use the resources immediately available.

As minutes pass and mutual aid pours in, the challenge shifts - from getting help to 𝐮𝐬𝐢𝐧𝐠 𝐡𝐞𝐥𝐩 𝐰𝐢𝐬𝐞𝐥𝐲.

History shows that help doesn't always fit the mold of “traditional” first responders. Real-world examples highlighting both successes and challenges of non-traditional law enforcement response include:

✅ Inland Regional Center (San Bernardino, CA – 2015): Probation officers monitoring police radio traffic responded within minutes. As additional probation officers arrived, Command integrated them into casualty care and building security, allowing other units to focus on critical tasks.

✅ University of Nevada, Las Vegas (Las Vegas, NV – 2023): A LVMPD police report notes that a Division of Motor Vehicles investigator who responded to the active shooter call “accidently discharged one round into a three-panel glass wall; no one was injured.”

✅ Robb Elementary School (Uvalde, TX – 2022): The response included hundreds of officers, many of whom came from non-traditional law enforcement roles - Texas Parks and Wildlife officers, a junior college police officer, and a fire marshal among them. Ultimately, a Border Patrol team stopped the attacker.

You may see responders you don’t routinely train with - game wardens, regulatory investigators, and other unconventional law enforcement units.

These are legitimate law enforcement professionals; but their missions, experience, and operating environments may differ.

That’s not criticism - it’s reality.

The takeaway:

▪️ Use the help that arrives - but use it wisely
▪️ Leverage people based on what they do best
▪️ Assign roles intentionally, not by badge alone
▪️ Plan ahead for how specialized units will be integrated
▪️ Train with non-traditional agencies to understand their capabilities

Does your training address how non-traditional law enforcement partners would be integrated into the response?