By Erik Engstrand, Chairman for the Risk & Resilience work group, ECSP
Across Europe, shopping places are designed to be open, vibrant, and welcoming environments. They are spaces where communities gather, where daily life unfolds, and where millions of visitors expect to feel safe. Yet this openness — so essential to their purpose — also presents a growing challenge in an increasingly uncertain security landscape.
Commercial venues such as shopping centres remain attractive soft targets, particularly high-footfall locations and great commercial spaces.
The 2026 terrorism context (ref. EU TE-SAT 2026) indicates an elevated threat level across the EU. In early March 2026, Europol highlighted increased risks linked to the widening geopolitical tensions involving Iran.
Preparedness in this context is no longer a theoretical exercise — it is an operational responsibility.
The rise of active assailant incidents in public spaces is a reality that cannot be ignored. These events, often unfolding within minutes and with little or no warning, leave very limited time for reaction. Evidence shows that most incidents are over within five to ten minutes, frequently before law enforcement can intervene. This underscores a critical truth: preparedness at the local level is decisive.
Download the ECSP Active Assailant Incident Response Guide here
A Gap Between Awareness and Preparedness
At ECSP, we observe a recurring gap between awareness and operational readiness. While the risk is widely acknowledged, structured plans, clear communication protocols, and coordinated stakeholder responses are not always in place.
In a crisis defined by speed and uncertainty, this gap becomes critical. Uncertainty itself can amplify risks.
As the European voice of retail real estate, ECSP works to translate shared experience across markets into practical guidance. Our Active Assailant Incident Response Guide is part of that effort — designed to support those who are directly responsible for managing shopping places: center management, security providers, and tenants.
Three Critical Factors for Effective Response
The guide is built around three operational priorities: planning, communication, and cooperation.
- Planning is the foundation. Without clearly defined procedures, roles, and responsibilities, even well-prepared teams can struggle to respond effectively. Preparation must address the full timeline — before, during, and after an incident. As highlighted in the guide, the absence of a structured approach can significantly increase both human and operational consequences.
- Communication is equally decisive. In rapidly evolving situations, clear and immediate messaging can reduce confusion and support safer outcomes. Communication tools — whether PA systems, SMS alerts, or internal channels — must be pre-defined, tested, and understood by all stakeholders.
- Cooperation is essential. Effective response depends on coordination between center management, security services, tenants, and public authorities. No single actor can manage such situations alone. Preparedness, by definition, is collective.
From Procedures to Action Under Pressure
Active assailant incidents are characterized by intensity, uncertainty, and limited time. This places particular importance on execution.
Procedures must therefore be simple, clear, and regularly practiced. Staff and tenants need not only guidance, but the confidence to act under pressure. Well-rehearsed actions — whether evacuation, lockdown, or communication — can make a meaningful difference in the first critical minutes.
Preparedness as an Ongoing Process
Preparedness does not end with response. Recovery, support, and evaluation are integral to resilience.
This includes caring for affected individuals, managing communication in the aftermath, and systematically reviewing procedures. Continuous improvement — through training, exercises, and collaboration with authorities — is essential to maintaining readiness over time.
Through its work in Brussels and across European markets, ECSP aims to support this process by facilitating knowledge-sharing, promoting practical standards, and strengthening cooperation between stakeholders.
A Shared Responsibility for Safer Places
This is a sensitive and complex issue. No framework can eliminate risk entirely. But preparedness can reduce its impact.
For Europe’s shopping places, this means moving from awareness to action — ensuring that plans are in place, roles are clear, and cooperation is established before an incident occurs.
We invite all stakeholders to engage in this work and strengthen their preparedness.
The ECSP Risk & Resilience Workgroup is helping shape the future of safe and resilient retail assets across Europe.
Commercial retail spaces face an increasingly complex risk landscape. In this context, the ECSP Risk & Resilience Workgroup supports the industry in strengthening preparedness and reinforcing its duty of care.
To support these efforts, ECSP has released a practical Best Practice Guide on how to prepare for, plan for, and manage an Active Assailant incident.
The guide provides actionable recommendations to help shopping places improve preparedness, response and coordination with authorities in the event of such incidents.
Download the ECSP Active Assailant Incident Response Guide here
Erik Jerker Engstrand
Is a security and risk management professional with international experience from leading positions in both retail and property companies. He is the Founder and CEO of SAFE Asset Group, based in the Greater Gothenburg Metropolitan Area, Sweden.
As well as working in executive security consulting in Asia, Engstrand served as Country Risk Manager, Russia for IKEA and Head of Group Security for Stockmann/Lindex in Europe.
Engstrand is a Certified Protection Professional accredited by ASIS International.
At the ECSP, the European Council of Shopping Places, Engstrand is Chairman for the Risk & Resilience work group.
