Evidence review: 14 September 2026. This note accompanies Core42’s 2024 whitepaper. Historical observations in that paper should not be read as a current threat assessment.
Crime statistics, intelligence assessments and site observations answer different questions. A historical incident count can describe what was recorded in a particular period. It cannot, by itself, establish the threat to an individual venue or the adequacy of its arrangements.
For an organisation responsible for a crowded place, the practical task is to define credible scenarios, examine the circumstances in which people could be harmed, and agree how prevention and response will work together. That requires current information about the site and its operating environment.
Use the research for the question it can answer
Core42’s 2024 active armed offender whitepaper discusses the Australian context and planning considerations. It is a dated industry paper, not a forecast, a control-effectiveness trial or a substitute for current agency advice.
The paper’s discussion of social conditions and radicalisation provides context for further inquiry. It should not be used to infer that a person experiencing mental illness, financial stress or isolation is likely to become violent, or that any single social factor causes an attack.
Review the whole response
Our advisory recommendation is to review physical arrangements, staff responsibilities and emergency coordination together. Test what people would actually be able to detect, communicate and do under the scenarios relevant to the site. Check assumptions through records, inspection and exercises, rather than relying on the existence of a policy or a particular technology.
The Australian Government’s active armed offender guidelines for crowded places provide a planning reference. Its advice for individuals is to escape when safe, otherwise hide, and tell police by calling 000 when safe to do so.
A site plan should translate relevant guidance into arrangements that account for its layout, occupants, operating conditions and emergency services interfaces. The appropriate mix of detection, delay, access control, communication and training depends on that assessment. This note does not establish a universal priority order or direct security officers to confront an attacker.
Keep the basis current
Record the information used, the decisions made, the person accountable for each action and the triggers for review. Changes in site use, nearby activity, intelligence or lessons from an exercise may require the plan to be revisited.
For current national threat advice, consult ASIO and Australian National Security. Use the whitepaper as background alongside those sources and a site-specific assessment.