Seven 2025 shooters were considered insider threats
INSIDER THREATS: Seven shooters were considered insider threats.
NCIER®
Shooter connection to location and insider threats
18 claims on pp. 7–75 (fact 16, definition 2).
Claims about Shooter connection to location and insider threats
In seven commerce incidents, shooters had a connection to the location or a victim
In seven incidents, shooters had a connection to the location and/or a victim.
Three commerce shooters were insider threats; four were former employees or patrons
Three of them were insider threats —shooters who were current employees, and four were either former employees or patrons of the location but not deemed insider threats.
All insider threat attacks occurred at warehouse, plant or trade businesses
All insider threat attacks occurred at warehouses/plant/trade businesses.
Neither retail shooter had prior ties to victims or locations
Neither shooter had prior ties to their victims or locations.
Commerce shooters split evenly: 7 with connection, 7 without (50% each)
Connection (50%) 7 No Connection (50%) 7
Military complex attack was the only government insider-threat incident
This was the only incident in the government location category which met the definition of an insider threat.
Evergreen HS (Colorado) shooter, 16-year-old student, died by suicide; both HS shooters insiders
The second incident took place at Evergreen High School in Colorado, where a 16 year old student opened fire inside and outside the building. The suspect died by suicide after law enforcement arrived. Both shooters were current students and considered insider threats.
Education shooter breakdown lists current and former students with counts 1 and 3
Current Student Former Student 1 3
Annunciation and CrossPointe shooters were former members or attendees of the sites
Both the Annunciation and CrossPointe shooters had ties to the attack locations, as former members or attendees.
15 shooters (44%) had some connection to the location or victims
Fifteen shooters (44%) had some connection to the location or victims.
Seven insider-threat shooters: three commerce, three education, one government
Seven of them were identified as insider threats based on their status as students or employees at the time of the attack. These incidents occurred in commerce (three), education (three), and government (one) location categories.
Eight connected non-insider shooters, mostly at commerce (four) sites
The remaining eight shooters with connections were not considered insider threats. These incidents occurred in commerce (four), houses of worship (two), education (one), and open space (one).
15 shooters had a connection to the location, 19 had none
Connection (15) | No Connection (19)
Seven shooters were insiders and 27 were non-insiders
Insider (7) | Non-Insider (27)
Glossary defines insider threat and law enforcement exchange of gunfire
INSIDER THREAT: an employee, contractor, student, or other individual with legitimate access and/or trust who carries out an active shooter attack LAW ENFORCEMENT EXCHANGE: instances where both the shooter and law enforcement officer(s) discharge firearms at each other
Shooter connection means link between shooter and location, victims or circumstances
SHOOTER CONNECTION: refers to the relationship or link between the shooter and the location, victims, or circumstances of the incident 52 Refer to Appendix
Top
Find the Perfect Training Class For You