Security Lessons Schools Can't Afford to Ignore

School shootings keep happening. Since the March 2023 massacre at Covenant Presbyterian School in Nashville, where a former student killed three nine-year-old children and three adults before being shot and killed by responding officers, dozens more have followed. Different schools, different cities, the same devastating pattern.

The security protocols, technology, and law enforcement response at any given school will be tested again. The only question is whether they're ready.

Most post-incident analyses of Covenant focus on law enforcement response and in-school protocols in isolation. Here, I will examine both together – the security measures present at Covenant, where they held, where they failed, and what the Metropolitan Nashville Police Department (MNPD) response added or couldn't compensate for. The goal is to extract lessons that security directors, integrators, consultants, facilities managers, and law enforcement can apply today.

The attacker, whose desire for notoriety was cited as a primary motivation, will not be named here.

What We Cannot Control, and What We Can

No security system can read the human heart and preemptively identify evil. What we can do is close the gaps between warning and response, between protocol and execution.

At Covenant, a friend of the attacker received a social media message the morning of the attack indicating the attacker expected to die that day and that an earlier post had been a suicide note. The friend contacted the Davidson County Sheriff's Office at 10:13 a.m., but the attack had already begun at 10:10 a.m. The attacker had been sitting in the school parking lot for approximately 15 minutes before entering.

The warning came too late, but it came. That gap between tip and response is worth examining at every school.

Access Control Held, Until It Didn't

Covenant School was secured. The attacker did not simply walk through an unlocked door. Armed with a long gun and two semi-automatic pistols, they shot through a set of glass side doors to gain entry. The first victim was a custodian who witnessed the breach and attempted to flee but was killed before reaching safety.

A 2026 study by the ALERRT Center at Texas State University, funded by the Security Industry Association (SIA), puts Covenant in sobering context. Analyzing 54 school-based active shooter events from 2000 to 2025, the researchers found that in every successful mechanical breach in the dataset, the perpetrator defeated the barrier by shooting through glass, not by overcoming the locking mechanism. Flush doors with functional locks were never successfully breached.

Covenant is specifically named in the report as one of four incidents involving aluminum-frame exterior doors with glass panels that were successfully breached – alongside Sandy Hook (2012) and Central Visual and Performing Arts High School in St. Louis (2022).

The report also found that behind secured doors, only 16.7% of documented door interactions resulted in any casualty, compared to 50% behind unsecured doors. The data makes a straightforward case: Access control matters enormously, but glass entry points are a documented, recurring vulnerability.

As schools invest in construction and renovation projects, ballistically-rated glass or security glazing at exterior entry points deserves serious consideration.

When the Fire Alarm Became a Threat Multiplier

At the moment the attacker breached the entry doors, a second failure cascaded from the first. Smoke from weapons fire triggered the school's fire alarm system, initiating a building-wide evacuation. Staff, faculty, and students began moving toward exits before anyone inside had confirmed an active shooter was in the building. By one estimate, approximately 200 people were potentially directed into the attacker's path.

Fire safety systems have saved countless lives over more than half a century of use. The issue here is that a single-alarm evacuation model is insufficient for today's threat environment. Schools need automated alarm systems capable of distinguishing between triggers – fire, gas, and active threat – and communicating the appropriate response.

If the fire alarm and the active shooter alarm are indistinguishable, occupants cannot know whether to evacuate or shelter in place. That ambiguity costs lives.

Shelter in Place: Proof It Works

Despite the alarm confusion, shelter-in-place protocols ultimately demonstrated their value. After killing three children and a teacher on the stairwell and shooting the school's headmaster in the second-floor hallway, the attacker spent considerable time wandering the second floor, unable to locate additional victims.

Classrooms in lockdown were holding. The attacker fired into several classroom doors, injuring one student, but was unable to penetrate the sheltered spaces effectively.

At that point, the attacker had claimed six lives and was still actively hunting, but the shelter-in-place response had effectively denied further access. Shelter in place works when the alarm that triggers it is the right alarm, sounded at the right time.

The ALERRT/SIA report offers a powerful data point on this front. In a September 2025 attack at Evergreen High School in Colorado, staff initiated a lockdown just 42 seconds after the first shot. The attacker subsequently spent nearly three minutes unsuccessfully attempting to re-enter the building before abandoning the effort entirely.

The Jefferson County Sheriff's Office credited the locked doors directly: "Lives were saved because of the actions they took during their lockdown drill."

The contrast with Covenant – where fire alarm confusion triggered an evacuation before shelter in place could take effect – is instructive. The attacker at Covenant eventually moved back to the first floor, entered the church sanctuary, fired at televisions and through doors leading to the Pre-K and kindergarten wing without hitting additional victims, then moved to the vestibule where they observed police vehicles outside and fired on them for several minutes without striking any officers.

Law Enforcement Response

MNPD officers arrived on scene and entered the building at approximately 10:23 a.m. – roughly 13 minutes after the attack began. Publicly available video shows a staff member outside the building handing keys to a responding officer to access the locked entry.

Officers entered on the first floor, heard shots from the second floor, moved toward the sound, and neutralized the attacker, ending the attack.

The response was swift by any objective measure; however, it also illustrates a persistent reality: in an active shooter event, law enforcement response – however fast – arrives after the attack is already underway.

The security architecture must assume that gap exists and plan accordingly.

What the Investigation Revealed

The post-incident investigation found the attacker had fired 152 rounds from two weapons. More significantly, the person had conducted multiple reconnaissance visits to the school prior to the attack, supplementing knowledge gained as a former student. Planning reportedly began as early as 2018.

The ALERRT/SIA report reinforces a principle worth building into every new construction and renovation decision: Security measures that are not visible or identifiable are more difficult to defeat. If an attacker can map a school's security infrastructure through repeated visits, they can plan around it. Concealed or non-obvious security layers add meaningful friction to that planning process.

The school's video surveillance system proved invaluable to the post-incident investigation, providing forensic psychologists with behavioral documentation that, combined with the attacker's writings and social media history, helped establish motivation and timeline.

Lessons Learned

Covenant had protocols, access controls, and practiced procedures in place. What the incident revealed were gaps at the intersections – between access control and alarm systems, between alarm systems and shelter protocols, between warning and response.

The ALERRT/SIA study found that 61.7% of doors with known status were unlocked or propped open at the time of attack across its dataset, meaning the most common way a perpetrator gains access is by walking through an unsecured door.

Covenant was different: the doors were locked, and the attacker had to shoot through them. That distinction matters, and it reflects a school that was doing the fundamentals correctly. The gaps that cost lives there were in alarm differentiation and the chain of events that followed the breach – gaps that are addressable.

Alarm systems that distinguish threat types, ballistically-rated entry glass, concealed security infrastructure, and shelter-in-place protocols tied to the right triggers are all within reach for most institutions.

There is no reasonable expectation that attacks like this will stop. There is every reason to ensure that when the next one comes, the systems, protocols, and people in place are ready to minimize the damage.