Every so often, Guy Bliesner pulls together teachers and staff for scenario training. What if a school bus crashes? Or the power goes out on a snowy day? Or a kid goes into anaphylactic shock on the playground? As Analyst for the Idaho Office of School Safety and Security (IOSSS), he says tabletop exercises and other forms of scenario-based training are key to business continuity. For schools to keep functioning, people need to know what to do in an emergency, and they need to practice.

“Most schools, certainly in Idaho, do not have paid security staff. The reality is these guys are the first responders — and for many events, they are the only responders,” Bliesner says.

Bliesner is not alone. Across a range of industries, security leaders look to bolster business continuity through scenario-based training, using real-world situations as the basis for readiness exercises.

How it’s Done

At the Texas Biomedical Research Institute, a San Antonio campus that combines administrative and research spaces, Director of Security and Emergency Preparedness Mark Hammargren uses scenario training to ensure staffers can respond in times of crisis.

“I do active shooter awareness training for all employees during onboarding and orientation,” he says. That three-phased training includes an awareness presentation, a tabletop exercise and a field training exercise.

“Then I do scenario-based training based on the model of ‘avoid-deny-defend.’ They get tabletop scenarios where we run them through the concepts of personal defense, how to handle a situation and recognizing suspicious behavior,” he says.

Hammargren will also give employees scenarios: If this happened, what are you going to do? “It's about making them think about what they’ve just learned in their awareness training. Then I will do a full-scale field training exercise where I’ll get some role players, some safety observers, and we will run that same group through a real event,” he says.

Bliesner has a tight formula to deliver this kind of training too. His approach offers training in small increments, about 10 minutes at a time, with participants asked to quickly think through a likely risk scenario or real scenario that happened somewhere else and make crucial decisions in response.

“We give them the condition, the way the school that originally had the incident handled it and what their after-action report was. They spend five or six minutes talking about it. They look at how the original school handled it and where they found the security gaps given their after-action,” he says.

Participants are given enough real-world detail to ensure they have a proper understanding of the crisis.

“We give them context: The time of day, the season, the temperature. If you have to evacuate your building and it’s nine degrees below zero, that’s different than if you have to evacuate and it’s 65 degrees and sunny,” Bliesner says. “We try and give them all the information that was available when the initial incident took place so that they can — as much as possible — put themselves in the mindset of the principal and staff who had to deal with that event.”

Why Scenarios?

Security practitioners point to several critical advantages to scenario-based training versus classroom training. In general, they say the real-world nature of this approach helps to ensure a higher degree of resilience, offering businesses a way to maintain operations even in the face of the unexpected.

“Scenario-based exercises have proven to be an effective training method as they are engaging and interactive, while also facilitating effective knowledge transfer,” says Brian Harrell, Vice President and Chief Security Officer at AVANGRID and former Assistant Secretary for Infrastructure Protection at the U.S. Department of Homeland Security.

This kind of training “provides learners a risk-free environment to experiment and fail without penalties and consequences. They allow participants to learn from their mistakes,” he says.

A member of the Behavioral Sciences Department at York College of Pennsylvania, and an emeritus member of the International Foundation for Protection Officers board of directors, Christopher Hertig sees a number of advantages to a scenario-based training approach as well.

“In the field, you can hand the security officer a card that says: This is the situation, how would you respond? They would tell you what they would do. If they know the procedures, it is readily apparent, and if they don’t, that is painfully apparent too,” he says.

In general, scenario-based efforts deliver “active learning, meaning the learner is engaged,” he says. “Some people don’t learn from reading. They need to watch and to do. Overall, you’re more likely to have an impact with an active learning strategy.”

Many security leaders say a hands-on strategy to training leads to more effective outcomes.

“Clients have shared with us that they became more aware of their surroundings and how their actions impact their co-workers and the environment around them after the training programs,” says James Hayes, Vice President at global security, investigations and compliance consultancy Guidepost Solutions.

Those who’ve gone through scenario exercises have reported “reductions in cost associated with low-level theft and loss. Some clients have experienced increased efficiency as a result of a streamlined employee or product movement,” Hayes says. “In some instances, particularly for sports and entertainment venues we’ve worked with, the production of emergency management plans has significantly reduced insurance and security costs for clients.”

Hammargren sees a direct connection between the impacts of scenario training and his efforts to support business continuity. Business continuity depends on people’s ability to react quickly in a crisis: Time is a crucial element. To drive that level of response, “you need people to understand the threats, to be able to communicate, to be prepared,” he says. That’s what scenario-based training delivers.

Best Practices

To make effective use of scenario-training strategies, security experts suggest a range of specific best practices.

First, scenarios need to be grounded in reality. They need to address actual, likely threats rather than esoteric ‘what-ifs.’ As a former security officer on the Three Mile Island nuclear facility, Hertig has seen training that misses that mark.

“We were required to have plans for all kinds of things, like the central alarm station being taken over by terrorists, but we didn’t have plans for an angry steel mill worker coming in with a gun, which was by far more likely,” he says. “People were being laid off from the steel mills at that time, and they were having many problems. We needed people to be able to deal with those simple, realistic threats, whereas with scenarios, people tend to get carried away — their creativity gets the better of them.”

To avoid that trap, security professionals can use the risk assessments as a starting point to construct realistic scenarios tailored to their organization.

“Organizations should assess the risks they face and develop a plan to mitigate those risks,” Hayes says. “The most important thing a company, school or house of worship can do to prepare is to understand their risk and develop a plan in the event they are thrust into crisis or face an emergency.”

Once the risks are documented, it becomes a matter of getting buy-in for scenario-based training. People may be reluctant to participate in a scenario, to give it their all, especially if they are not security professionals themselves or don’t understand the benefits of such training. One way to drive enthusiastic participation is to make the training personal.

“You have to develop empathy,” says Morgan Ballis, Co-Founder of the Campus Safety Alliance. “I use case studies to emotionally connect with people: stories of victims and survivors. If I am training a business on some form of attack, I will use a case study that reflects that — ideally one that is specifically from their industry. That will resonate with them, and they will begin to see the potential consequences.”

While engaging non-security staff in these efforts can be difficult, their participation is often vital to success, says William N. Wilkins, Executive Director of Global Security and Construction Management at Valero Energy.

“Security is not a compartmentalized activity,” Wilkins explains. “When a significant security event occurs, it impacts virtually every element of the business and may require coordination from outside consultants, response agencies and regulators. Extending invitations to these groups to participate in [scenario-based] exercises enhances the realism and allows a security leader to see how the integration of different organizations — and personalities — affect plan performance.”

Making it Fit

Finally, organizations can benefit from efforts to make scenarios specific to particular working groups. While some scenarios may apply to everyone — active shooter training, for instance, or severe-weather exercises — it’s also helpful to tailor exercises to unique employee populations.

“For example, we have a specific group in shipping and receiving. What are they looking for? How do they recognize suspicious packages?” Hammargren says. “I do that semi-annually for that specific group because nothing comes to the Institute without going through shipping and receiving.”

Texas Biomedical Research Institute is also one of seven national primate research centers. “We have a couple of thousand nonhuman primates on our campus, and we have specialized training for that team: Recognizing suspicious behavior, a drone in the air that potentially could be a hazard to an animal, or how to deal with an emergency,” he says.

While it can take some time and effort to construct and implement this kind of specific training, those who’ve done it say it is worth the effort.

“We did the bus-accident scenario with a school where 75% of their students were bussed,” Bliesner says. “About six weeks after they had run that scenario, they had that bus accident. And I got a call from those folks telling me that their response was much, much better based on the fact that they had the right mindset. They didn’t have to make it up as they went along.”