Terrorism Awareness for Corporate Travellers | CloseProtectionHire

Most corporate travellers complete a security briefing that covers pickpocket risk and the local emergency number. Most terrorism awareness training stops at Run-Hide-Tell. Neither of these is adequate preparation for the threat environment that business travel now involves in a significant number of destinations.

This is not a counsel of paralysis. The statistical risk of being caught in a terrorist attack remains low, even in cities with elevated threat profiles. The practical value of terrorism awareness training is not to prevent what is statistically unlikely – it is to ensure that if the unlikely happens, the traveller responds effectively rather than freezing. Seconds matter in an active attack scenario, and a briefed traveller who knows what to do has a materially better outcome than an unbriefed one who is waiting for confirmation before acting.

The ACT Awareness standard

ACT Awareness – Action Counters Terrorism – is the National Counter Terrorism Security Office’s (NaCTSO) training framework for the public and for anyone with responsibilities in venues, workplaces, or public-facing roles. The free online course takes approximately 45 minutes and is available at the NaCTSO ACT Awareness eLearning Hub.

The course covers three areas: recognise, prepare, and respond. Recognise covers the indicators of hostile reconnaissance and attack planning – how attackers surveil venues and targets before an attack. Prepare covers the pre-event security measures that venue managers and employers can take. Respond covers Run-Hide-Tell and how to communicate with emergency services during an incident.

For corporate travellers, ACT Awareness completion is now required by many large employers as part of pre-travel preparation for high-risk destinations. It is the minimum competency standard for anyone deploying to a P1 city or attending large corporate events in the UK or internationally.

The ACT Hotline for reporting suspicious activity in the UK is 0800 789 321. The equivalent in other jurisdictions is typically the national police non-emergency line or a dedicated counter-terrorism reporting line.

Run-Hide-Tell in practice

Run-Hide-Tell is the UK government framework for responding to a terrorist attack in a public place. The logic is straightforward and deliberately simple.

Run. If there is a safe route away from the attack, take it. Do not wait for others unless it is safe to do so. Do not stop for belongings. Keep your hands visible when approaching police. Move to a safe distance and do not re-enter the area.

Hide. If running is not possible, find substantial cover and hide. Substantial cover means concrete, brick, or steel – not a glass partition, a plasterboard wall, or a car door. Get low. Turn your phone to silent (vibrate is not silent enough in a quiet space). Lock and barricade the door if you are in a room. In an open space, hiding behind a concrete pillar or vehicle engine block (not the door) provides meaningful ballistic protection from most firearms at range.

Tell. When it is safe to do so, call 999 (or local equivalent). Provide your exact location, the nature of the attack, and any description of the attacker. If voice calling risks your position, the UK police accept emergency 999 texts via the EmergencySMS service (pre-register at gov.uk/emergencysms before travel).

The most common failure in applying Run-Hide-Tell under stress is waiting for confirmation – a second shot, a second observation – before acting. Research into survivor behaviour from the Manchester Arena attack (2017) and London Bridge (2017) consistently shows that individuals who acted on the first credible indicator had better outcomes than those who paused to assess. The trigger for running is a single credible indicator of an active attack, not certainty.

Vehicle-as-weapon attacks

Between 2016 and 2021, 14 vehicle-as-weapon attacks occurred in European cities, killing over 150 people. The pattern is consistent: a vehicle (typically a truck or van) driven at speed into a pedestrian area with high footfall and limited barriers.

Nice (July 2016, Bastille Day crowd on the Promenade des Anglais, 86 killed), Berlin Breitscheidplatz (December 2016, Christmas market, 13 killed), London Bridge (June 2017, evening pedestrian traffic, 8 killed), Stockholm Drottninggatan (April 2017, pedestrianised shopping street, 5 killed), Barcelona Las Ramblas (August 2017, tourist pedestrian zone, 15 killed).

The consistent elements of vulnerable locations:

• Wide pedestrian streets or promenades with no vehicle access barriers
• High footfall at predictable times (markets, events, evening leisure)
• Long unobstructed run available for an approaching vehicle
• No hostile vehicle mitigation (HVM) infrastructure in place

Pre-trip route awareness can reduce exposure. Before arrival in a city, identify which areas have the vehicle-as-weapon vulnerability profile and where HVM barriers (bollards, planters, installed barriers) are in place. Most European city centres have significantly improved HVM infrastructure since 2017, but gaps remain.

If you are caught in a vehicle-as-weapon attack, move immediately at a right angle to the vehicle’s direction of travel. Running in the same direction as the vehicle is running with it. Moving perpendicular takes you out of its path. Seek an entrance to a building or an underground passage.

Suspicious packages and substances

The standard protocol for a suspicious package has not changed in 30 years of application and remains correct:

Do not touch, move, or cover it. Evacuate the immediate area. Do not use a mobile phone or radio within 15 metres of the suspected device. Call emergency services from a safe distance and describe the item, its exact location, and why it concerns you.

The radio frequency protocol is not bureaucratic caution – some improvised explosive devices use radio frequency as a detonation trigger. A mobile phone call or a two-way radio transmission in close proximity to a correctly constructed IED can detonate it. Post-blast, do not re-enter the area for at least 30 minutes without emergency services confirmation – secondary devices targeting first responders and survivors are a documented tactic.

For suspicious substances (powder, liquid, or aerosol with no obvious source), the response is: leave the area immediately, move upwind, do not eat or drink, wash exposed skin with cold water and soap (cold water, not hot), remove outer clothing. Call emergency services. The UK’s Hazardous Area Response Team (HART) manages decontamination for chemical, biological, and radiological exposures.

Hotel terrorism response

Hotel attacks have a different dynamic from open-space attacks. In an open space, running is usually the first option. In a hotel, the attacker may be between you and the exit.

Mumbai’s Taj Mahal Palace attack (November 2008) lasted 60 hours and killed 166 people at multiple sites. The DusitD2 Nairobi attack (January 2019) lasted approximately 20 hours, killed 21 people, and involved attackers moving through the hotel complex systematically. Both involved attackers moving through corridors and clearing rooms.

The correct response in a hotel when an attack is in the building:

Move to a room and barricade the door. Use a door wedge (carry one), chairs jammed under the door handle, or furniture moved against the door. Turn off lights. Get low and away from the door. Call emergency services by text where possible – voice may indicate your position.

Do not open the door for anyone, including individuals identifying themselves as security or hotel staff, unless emergency services have confirmed by phone that officers are at your floor. Attackers in hotel scenarios have impersonated hotel staff. Wait for confirmation. The Manchester Arena attack (2017) generated 75 separate calls from survivors who had sheltered safely. Police confirmation of floor-by-floor clearance is the standard release signal.

For those travelling to P1 cities with elevated terrorism threat profiles and requiring a fully integrated protective intelligence and travel security programme, see our executive protection services. For the advance work methodology that identifies venue terrorism risk before the principal arrives, see our advance work guide. For the specific counter-terrorism considerations for places of worship – including NaCTSO guidance, Martyn’s Law obligations for large congregations, hostile vehicle mitigation, and the Christchurch and Pittsburgh attack lessons – see our security for religious sites and places of worship guide. For the CBRN threat spectrum – chemical, biological, radiological, and nuclear – including the Salisbury Novichok attack, Tokyo subway sarin attack, AMERITHRAX anthrax letters, IAEA radiological incident data, corporate mailroom protocol, and decontamination procedures – see our CBRN and bioterrorism awareness guide.

Sources

NaCTSO: ACT Awareness Programme, National Counter Terrorism Security Office, 2024. Home Office: Statistics on the Operation of Police Powers under the Terrorism Act 2000, 2024. Terrorism (Protection of Premises) Act 2024, UK Parliament, Royal Assent 3 April 2024. NPSA: Protecting Crowded Places – Guidance for Venues and Events, National Protective Security Authority, 2024. DHS: Active Shooter – How to Respond, US Department of Homeland Security, 2023. CISA: Bomb Threat Guidance, Cybersecurity and Infrastructure Security Agency, 2024. NaCTSO: Suspicious Packages Guidance, 2024. ISO 31030:2021, Travel Risk Management: Guidance for Organisations, International Organization for Standardization.

For the security framework specific to diplomatic missions and embassy staff – Vienna Convention obligations, SECCA 1999 standoff standards, post-Benghazi safe haven requirements, ambassador close protection, and locally engaged staff vetting – see our security for diplomatic missions and embassies guide. For the specific security risks of executive travel by rail and metro – station vulnerability patterns, BTP annual report data, 7/7 London and Madrid Atocha attack lessons, and the protective protocol for last-mile rail transit – see our rail and metro security guide for corporate travellers.