Skip to content

What is a Marauding Terrorist Attack?

Marauding terrorist attacks are fast-moving, violent incidents where assailants move through a location aiming to find and kill or injure as many people as possible

Last Updated 31 May 2022


Marauding terrorist attacks (MTA) are fast-moving, violent incidents where assailants move through a location aiming to find and kill or injure as many people as possible. Most deaths occur within the first few minutes of the attack, before police are able to respond.

MTAs can take many forms and include a combination of the following:

  • A lone attacker, multiple attackers or multiple groups of attackers
  • Arrival at a location on foot, in a vehicle or an attack perpetrated by insiders
  • Entering without using force or forcing entry using an explosive device, a vehicle, coercion of someone with access or a combination thereof
  • Attackers armed with bladed weapons, firearms, pipe bombs, petrol bombs suicide vests or multiple weapons

Bladed weapon attacks progress less rapidly than those involving firearms since attackers must be within striking distance of their victims and expend more energy on each person.

It is more important than ever that your organisation or premises is aware of the heightened risks and adequately prepared for any potential attack. NPSA have also produced guidance to enhance the capability of SCR operators to respond to the immediate impact of a terrorist incident.

New and detailed guidance is now available providing information as to the range of measures that can be taken to minimise the impact of an attack and help save lives. These measures range from implementing simple changes to security processes and technical systems to introducing new and sophisticated security systems. This guidance sits alongside the Run Hide Tell campaign, which is designed for general members of the public.  The MTA guidance is designed to help organisations develop a security plan, based on the principles of RHT.


Marauding Terrorist Attacks: Making your organisation ready discusses how your organisation can recognise an attack, take immediate action and facilitate the police. It is most relevant to office buildings, including multiple tenancy buildings. However, the principles of the advice can be usefully applied to all types of locations including cinemas, hotels, hospitals, schools, shopping areas, shopping centres, stadiums, theatres, temporary event venues and transport hubs.

Basis of the guidance

The guidance has been written and based on:

  • Extensive analysis of previous MTAs in the UK and elsewhere around the world
  • Live simulations of marauding attacks involving hundreds of people to understand where responses can fail and test the effectiveness of training, procedures and security systems.
  • Reviews and discussions with businesses that have highlighted common issues.

Introducing the MTA Guidance

NPSA and NaCTSO have developed a series of guides to help your organisation assess the risk and implement a range of protective security mitigations. These guides are based on analysis and learning from MTAs that have taken place, live simulations of attacks and exercises and feedback undertaken with businesses.

The 10 guidance pieces are:

  • MTA: A Busy Reader's Guide to Making Your Organisation Ready, which provides a high level summary of the key issues for senior managers.
  • MTA: Making your organisation ready, which is the principal guidance document setting out all of the protective security mitigations and considerations
  • MTA: Technical supplements, providing further information of specific topics that are important to effective defences.

This guidance also contains checklists contained in the documents, to help you establish next steps.

Marauding Terrorist Attacks: Supplementary guidance - Announcements

Alerting personnel using live and recorded announcements

Marauding Terrorist Attacks:Active delay systems

Measures that can further delay the rate of progress of an attack

Marauding Terrorist Attacks:Supplementary guidance -Testing and exercising

Detailing techniques to validate that your plans will work at the moment of need

Marauding Terrorist Attacks:Supplementary guidance -Preparing personnel

Developing a programme to raise awareness and provide training

ASCEND - Improving organisation response to Marauding Terrorist Attacks

A summary of key emerging themes from trials conducted between 2017 and May 2018

Marauding Terrorist Attacks:Supplementary guidance - Lockdown

Considerations for locking doors to delay and frustrate attackers

Short Animation - Lockdown at sites

NPSA have produced an animation which discusses the application of lockdown at sites. It explains that lockdown can be an effective measure to reduce casualties and fatalities. It discusses the need to design lockdown of a site and the complexities of lockdown management. It offers options of the types and ways to lock down which ensures acting fast can save lives.

View Video Transcript

This animation is part of a series of terrorist incident films for organisations and businesses and should be used as a discussion piece about the application of lockdown at your sites . 

It focuses on lockdown of a site.  Lockdown should only be implemented if that is the best course of action

For further guidance search “MTA” on NPSA website at:

Lockdown can be an effective method of keeping people safe, but it is not suitable for every site or attack method.

During a Marauding Terrorist Attack most deaths will occur within the first few minutes. By instigating a lockdown, the number of casualties can be greatly reduced.

You must know your Lockdown procedure to ensure it can be implemented quickly when an attack is detected.

During an attack, every barrier and every second counts and it is important to keep valuable distance between attackers and innocents.

Through locking down you are able to delay attackers, help innocents escape, prevent people from putting themselves into an attacker’s path.

The larger and busier your site is, the greater the complexity of implementing lock down becomes. Familiarity with the lockdown options at your site is vital.

Lockdown is typically most useful when an attack begins outside of your site, where you can delay or prevent any attackers gaining access. But there are lockdown options to implement even when an attack is underway inside a site.

Types of Lockdown

One way lockdown

A One Way Lockdown can be a strong choice. Doors are locked on one side, but can be opened from the other side which keeps attackers out and can prevent the risk of crush or becoming trapped by an attack.

Good announcements and communication from the Security Control Room is paramount to

provide information about the location of attackers. Announcements can also provide an update on the lockdown status of the building to those inside.

This is to prevent locked doors being inadvertently opened allowing attackers to access the safe areas.

Two Way Lockdown

A Two Way Lockdown, means both sides of a door are locked and no one can exit or enter through the door.

Two way lockdown is achieved either by manually locking down the doors or by disabling the Automatic Access Control systems.

Once a two way lockdown is implemented, the function to leave and enter is disabled. People remain in the area that they were in when lockdown was initiated.

Implementing a two way lockdown needs very careful planning. You are taking away people’s right to leave and locking people into a specific area of your building. 

You also do not want a crowd to flee towards an exit they cannot use. This could potentially cause alarm or a crush.

If attackers gain entry to the locked zone, people wishing to escape will be unable to as they are trapped by the locked door.

Partial Lockdown

By closing entrances, typically the main entrances of a site, an attacker can be kept within or out of specific areas.  Allowing other areas or routes within the site for people to escape.

This is a Partial Lockdown.

Zonal Lockdown

Detecting an attack early means you may be able to lock pre-determined areas within your building thus allowing people to safer areas.  Some sites may be able to lock dedicated zones such as floor plates in an office block.

However, a complex system of zones that are individually controlled is impractical to manage in the fast pace of a marauding terrorist attack.

Partial and Zonal lockdowns need to be monitored by the Security Control Room and will need to be reactive to the movements of the attackers.

Good communication with the ground security team is vital to track the actions and whereabouts of the attackers in real time.  We need to show animation of SCR and Comms with security on ground.

An attack is a fast paced and intense situation, so dynamic lockdowns should be practical and achievable, with reasonable expectations of what can be expected of security staff.

Ways to lockdown

Centralised Lockdown Management

A centralised lockdown system benefits from being easy and fast to implement.

This requires a security control room with access to Automatic Access Control Systems to lock or unlock doors remotely through the one centralised system.

It is beneficial to also give front-line personnel the ability to initiate lockdown.

This could be a panic button on the ground level to help speed up the instigation of any lockdown.

Manual Lockdown

A manual lockdown relies on individuals to lock the doors and barriers.  It is important that this should be safe, easy and achievable and you need to check it is physically possible for every barrier to be locked down. A Manual lockdown is only practical where barriers may be locked quickly and from a safe location.

Staff should not put themselves at risk to lock any doors or barriers and should always be putting distance between themselves and any attackers, never moving towards an attack.

Thumb turn locks on doors are recommended.

These are quicker and easier to use and require minimal training and they avoid the use of keys, which may not be immediately available.

Door locks should be placed in easy to access positions for example in the middle of the door, not in hard to reach areas such as at the top or bottom of a door.

Any shutter and door controls should be located away from the door so that they can be operated safely.

Wherever possible centralised and manual lockdowns should be monitored by the security control room to ensure lockdown integrity is maintained.  

Lifts and Escalators

If it is possible - lifts and escalators should also be locked down. This can prevent attackers getting easy access to other floors of the building.

However, locking down lifts and escalators is only feasible when they are controlled by a centralised building management system, operated by the security control room and should not be a task expected of ground security staff as it could expose them to danger.

Lockdown Management.

Whatever Lockdown you deploy, it needs to be continually monitored and managed by the Security Control room.

Communication between ground security staff and the control room needs to be maintained at all times, and up to date information shared with the emergency services.

Clear and consistent announcements should be used throughout the lockdown to inform those inside as to the current status of the site and location of the attackers. But be aware that an attack is highly stressful, and people may ignore these announcements.

Designing Your Lockdown

Every site is different and faces its own challenges when designing and implementing lockdown.

You need to consider:

What is reasonably possible and how many access points, do you have within you site?

What barriers and ways of locking them do you have at your site?

Can they be locked manually or centrally and are staff trained to lock them?

How much time is needed to spend time training KEY staff, and briefing ALL staff, on how they should respond to a lockdown.

If a crowd were to attempt to leave using a locked exit, could and should it be opened?

Are crushing injuries a risk if the door remains closed?

Attacks can cause life-threatening injuries or people may have a medical emergency whilst in a locked zone. Should these people be allowed to leave the locked area?

If a fire is started whilst lockdown is in effect, should lockdown be cancelled to allow people to evacuate?

The answer will depend on the nature of the hostile, the ferocity and the location of the fire; its ability to spread and hazards associated with toxic smoke.

What if there are marauding attackers outside the locked zones but a fire inside?

What if a fire alarm sounds, and you are unsure if it is a real or false alarm?

Lockdown can greatly reduce the number of casualties at your site during an attack.

It can control and restrict the movement of an attacker and it can put distance and time between an attacker and their intended targets.

But Lockdown can be difficult to achieve and it may not be appropriate for all sites and all forms of attack.

Because of this, lockdown must be developed, tested, exercised, rehearsed and refined to make sure that the procedure works for your site.

Acting fast will save lives.

Subtitled version

Short Film - Café Lockdown Drama

NPSA have also produced a short film which introduces the quick actions a member of staff within a small business can take to lockdown their premise during a terrorist incident. The principles of which can be applied across many types of locations and ultimately acting fast can save lives.

View Video Transcript

This film is part of a series of terrorist incident films for businesses. It focuses on lockdown of your premises, hiding and alerting others. Lockdown should only be implemented if that is the best course of action.

For futher guidance search "MTA" on the CPNI website at:

[background chattering]

Shopping centers, retail parks, venues and other public areas can be targets for terrorists and other hostiles.

[background chattering and instrumental music)

If you work in places like these, it is important that you maintain good lines of communications with your neighbours, that you are vigilant and alert to the potential risk of any attack and that you know what you should do in the event of an attack.

[phone pings to alert user of message]

[music and background chattering stops]


Warning neighbouring businesses will raise awareness of what is happening at your site.

Join a local network group.

[faint scream]

Assess the situation and establish if an attack is in fact happening. 

[people running past window]

Come away from the windows. 

What's happening. 

I don't know, get to the back. 

[faint heartbeat]

[screaming and shouting]

Get inside, go on, get inside

Alert and inform everyone in your premises to hide.

[Background music]

What's going on out there?

There's been an attack. Get to the back and hide.

Lock all doors by any means possible.

Turn off the lights and keep people out of sight and instruct them to stay quiet.

Are you locking us in? 

He's outside. You've got to hide. Go on, get down and hide. Go on, get down and hide!

[taps numbers on her phone]

Tell the emergency services.

Know the address and location of your premises.

Describe the attackers appearance and give numbers of attackers and victims if you have them.

Which service is required? 

There's been an attack at Hamilton Shopping Center.  

Can you confirm the address of the emergency? What's happening right now? 

[people running, screaming]

I don't know. I saw a man with a knife, people are running. 

We have had reports of an incident in the area. 

[mumbles] oh no

So there has been an attack? 

I'm going to need you to listen to me. You need to keep yourself and your customers safe. Run if you can, hide if you can't. 

He was right outside. 

Lock your door, turn your lights off, stay hidden. 

I've done that. We're hiding at the back. 

Police are on their way. Just keep as much distance between you and them as possible. You're doing well.

You must stay hidden until you are informed by the police that you no longer need to be.

[heavy breathing]

[attacker shakes handle of café doors]

What's happening now? Can you still see the attacker? 

He's at the door. 

He can't get in. 

Stay hidden, police are on their way. 

[door handles are shaken]

Ensure people remain hidden. Do not given attackers an opportunity to spot you.

[attacker shakes door handle]

Tell everyone to stay hidden. Police are on their way.

[attacker continue to shakes door handle]

[heavy breathing]

He's gone. 

Stay inside, stay hidden. Police are on their way. 

[sinister music]

It is imperative that you are prepared and ready to act in the event of an attack.

Warning. Join a local network group to get early indication of any threats.

Assess the situation and establish if an attack is happening.

Alert and inform everyone to hide. 

Lock all doors and turn off all lights.

Tell the emergency services.

Ensure people remain hidden until the police inform you not to be. 

Acting fast will save lives. 

Subtitled Version

Marauding Terrorist Attack Standard (MTAS)

MTAS has been developed to reflect the range of forced entry threats faced by UK government, national infrastructure and crowded places. It provides a means for determining the delay (resistance time) of a physical barrier (product) against either: 

  • the use of bladed weapons to attack the physical barrier in order to achieve access through it; 
  • the use of firearms to attack the physical barrier followed immediately by a forced entry attempt using manually operated tools; or 
  • detonation of a small explosive device (improvised or plastic explosive) in contact with the physical barrier, or a person borne improvised explosive device (PBIED) in close proximity to the physical barrier, followed immediately by a forced entry attempt using manually operated tools. 

Guidance document Introduction to the Marauding Terrorist Attack Standard (MTAS) explains how the standard classifies the delay a product provides to such entry attempts by attributing one or more performance levels to a product.  The sophistication levels are BASIC, LOW, MODERATE, HIGH and EXPERT.

Products that have achieved MTAS resistance classifications are listed in the following chapters of NPSA's Catalogue of Security Equipment (CSE):

  • Doors, Tubestiles, Turnstiles (Note locking hardware on its own will not achieve MTAS.  Locking hardware has to be part of door etc)
  • Roller shutters
  • Walls and Enclosures
  • Window Protection

The CSE also contains a number of generic designs which are based on NPSA's SME knowledge and research.

Further advice

For further information please contact your NPSA adviser, your local police force Counter Terrorism Security Adviser or a NPSA recognised security professional.

Did you find this page useful? Yes No