The Front Line Starts with the Security Guard
When thousands of people gather at a concert, a festival, a sporting fixture, or a community fair, they place an enormous amount of trust in the people responsible for their safety. Most of that trust lands squarely on the shoulders of event security guards. They are the first faces people see at the gate, the first to respond to a disturbance, and in the worst possible scenario, the first to act when terrorism strikes.
The threat of terrorism at UK events is not hypothetical. The 2017 Manchester Arena attack, which killed 22 people and injured hundreds more following an Ariana Grande concert at an indoor arena, exposed with brutal clarity the catastrophic consequences of inadequate protective security measures in crowded public spaces. It was that tragedy, and the tireless campaigning of Figen Murray, mother of victim Martyn Hett, that ultimately gave rise to some of the most significant changes in UK counter-terrorism law in recent decades.
Whether the event takes place inside a theatre, an arena, or an exhibition centre, or outside across the sprawling grounds of a music festival, a street parade, or an open-air sporting venue, the risks are real and the responsibility on security guards is immense. Against that backdrop, ACT Counter-Terrorism training has become one of the most critical tools available to event security professionals in the United Kingdom.
Understanding what Action Counters Terrorism training is, what it covers, and how it translates into real-world practice across both indoor and outdoor events is essential knowledge for every security guard working in the industry today.
What Is ACT Counter-Terrorism Training?
Action Counters Terrorism is a training initiative developed by Counter Terrorism Policing and the National Counter Terrorism Security Office. It is delivered primarily through the ProtectUK platform, the official government resource for protective security guidance and training across the UK.
The Two Core Courses
There are two core ACT e-learning programmes relevant to event security guards. The first is ACT Awareness, a counter-terrorism awareness course designed for all UK-based organisations and individuals. ACT Awareness e-Learning is a counter-terrorism awareness product designed for all UK-based companies, organisations and members of the public. The course is free to use and takes just 45 minutes in total to complete.
The second, and most directly relevant to security operatives, is ACT Security. ACT Security is a specialised training course for front line security operatives. It takes around 75 minutes to complete. The course provides up-to-date counter-terrorism knowledge that will help you prepare for, and respond to, terrorist incidents whilst on duty.
Designed by Government Counter-Terrorism Experts
ACT Security e-Learning is specialised training for front line security operatives. This free course was designed by government counter-terrorism experts from the National Counter Terrorism Security Office and National Protective Security Authority. Crucially, both courses are entirely free of charge, removing any financial barrier for security companies, event organisers, and individual operatives seeking to improve protective security knowledge across every type of event environment.
What Does ACT Security Training Cover?
For security guards deployed at events, whether indoor venues or outdoor sites, the ACT Security course builds a comprehensive awareness of the current threat environment and provides practical frameworks for action. The training covers a broad range of key areas that have direct operational relevance regardless of the event setting.
Recognising Hostile Reconnaissance
A person repeatedly photographing security positions, testing access points, or behaving in a manner inconsistent with the normal profile of event-goers may warrant closer attention. Recognising suspicious activity means understanding how someone planning harm may behave differently from regular attendees.
Terrorist attacks rarely happen without prior planning. Attackers will often conduct reconnaissance of a target venue, studying entry and exit points, security procedures, crowd flow, and vulnerabilities. This applies equally to an indoor arena as it does to an outdoor festival site. ACT Security training teaches guards to identify the behavioural and physical indicators that someone may be carrying out hostile reconnaissance.
The HOT Protocol for Suspicious Items
One of the core practical tools embedded in ACT training is the HOT protocol, used to assess whether an unattended item should be treated as suspicious. HOT stands for Hidden, Obviously suspicious, and not Typical of the environment. Security guards are trained to use their judgement to identify a suspicious item using the HOT protocol, with an understanding that the majority of unattended items are indeed harmless. Once a package has been identified as suspicious, the trained operative knows what actions to take to keep those around them safe from possible physical harm, until the item has been fully investigated.
HOT in Indoor Versus Outdoor Settings
The application of HOT differs noticeably between indoor and outdoor environments. Inside a venue such as a concert hall, theatre, or exhibition centre, what is typical of the environment is generally more clearly defined. A bag left under a seat, an unattended item in a corridor, or an object near a fire exit all stand out more readily against the controlled backdrop of an indoor space. In an outdoor setting such as a music festival, agricultural show, or open-air market, the challenge is greater.
The environment is less structured, items are scattered more naturally, and determining what is genuinely out of place requires sharper situational awareness. ACT training helps security guards calibrate that awareness for whichever environment they are operating in.
RUN HIDE TELL
Perhaps the best-known element of ACT training is the RUN HIDE TELL guidance, which applies in the event of a firearms or weapons attack. The training covers the principles of how to stay safe in the unlikely event of such an attack, how to interact with the police, and what to do until individuals can be safely evacuated.
RUN HIDE TELL Indoors
For event security guards, the application of this principle varies significantly depending on whether the event is indoors or outdoors. At an indoor event such as an arena, a nightclub, or a conference centre, the priority in a RUN scenario is moving people quickly and safely through designated emergency exits, away from the threat and towards predetermined assembly points outside.
The confined nature of indoor spaces means that panic can spread rapidly and bottlenecks at exit points can prove fatal. ACT-trained security guards understand the importance of directing crowds calmly and decisively, preventing crush situations while facilitating rapid evacuation.
RUN HIDE TELL Outdoors
At outdoor events, the picture is different. Open spaces can offer more natural escape routes, but they also present the challenge of directing large, dispersed crowds across wide areas, often with limited physical barriers to channel movement. In some outdoor attack scenarios, particularly those involving a vehicle or a firearm at range.
The HIDE element of RUN HIDE TELL may also apply differently, directing people behind solid structures, vehicles, or into nearby buildings rather than simply running across open ground. ACT training gives security guards the conceptual tools to make these judgements in real time.
Invacuation and Lockdown Procedures
Closely related to RUN HIDE TELL is the concept of invacuation, the sheltering of people inside a building or specific area when evacuation is not safe. This is particularly relevant for indoor events, where a threat may be developing outside the venue and moving people indoors or to a secure area within the building offers greater protection than directing them into an exposed street.
Security guards at indoor events must understand when invacuation is the appropriate response and how to implement it effectively, securing entry points, communicating with attendees, and coordinating with police. ACT training, combined with venue-specific emergency planning, prepares guards to make these critical public protection decisions under pressure.
Responding to Bomb Threats
ACT Security also prepares security staff for how to respond to a credible bomb threat during an event. The module is scenario based and investigates how security operatives would respond in the event of such a threat. It allows staff to calmly reflect on the choices that they would make and builds genuine confidence in knowing they would be able to deal with a similar real-life situation.
For indoor events, a bomb threat may require the immediate and controlled evacuation of an entire building, a complex undertaking in a venue where thousands of people may be seated in tiered stands or packed into a standing arena. For outdoor events, the challenge shifts towards establishing a cordon around a suspicious area while managing the movement of large crowds across an open site. In both cases, the structured thinking instilled by ACT training enables guards to respond purposefully rather than reactively.
Reporting and Communication
A critical part of any counter-terrorism response is communication, both within the event security teams and with police. ACT training reinforces the importance of reporting suspicious behaviour promptly and through the correct channels. Reporting suspicious behaviour and activity can make the difference between life and death, and understanding why this will play a vital role in disrupting terrorist activity is central to the ACT ethos.
Effective communication is the thread that holds any security operation together, whether that operation is taking place in a single enclosed building or spread across a multi-stage outdoor festival site. Security guards are trained to act upon their suspicions and to understand why doing so at the earliest opportunity can directly support the wider counter-terrorism security effort.
ACT Training and the Events Industry Specifically
The UK events industry encompasses an extraordinarily diverse range of gatherings, from intimate indoor theatre productions and conference events to mass outdoor music festivals, sporting fixtures, and public celebrations. Each presents its own distinct security profile, but all share the fundamental characteristic that large numbers of people are gathered in one place, creating both the potential for terrorist targeting and the responsibility for robust protective security measures.
Events bring together large crowds, open spaces, and multiple access points, all of which can be vulnerable to attack. Even when the risk appears low, every event security team must be prepared.
Indoor Event Vulnerabilities
Indoor events carry specific vulnerabilities that ACT-trained security guards must understand. Enclosed spaces concentrate crowds, limit natural escape routes, and can amplify the impact of an explosive device or weapon. Venues such as arenas, theatres, cinemas, nightclubs, and exhibition halls typically have defined entry and exit points that, while easier to control under normal circumstances, can become dangerous bottlenecks during a panic-driven evacuation.
Guards working indoor events must be thoroughly familiar with the venue layout, emergency exit locations, assembly points, and invacuation options, and ACT training provides the counter-terrorism context within which all of that venue-specific knowledge becomes purposeful.
Outdoor Event Vulnerabilities
Outdoor events present a contrasting but equally serious set of challenges. Open-air festivals, street carnivals, outdoor sporting events, and public gatherings are characterised by large, fluid crowds, extensive perimeters that are difficult to fully secure, multiple access points, and an environment where it is harder to establish what is out of place.
Vehicle-borne attacks represent a specific threat to outdoor events where public roads or open spaces are adjacent to crowds. ACT training, combined with Hostile Vehicle Mitigation awareness, equips security guards at outdoor events to think proactively about these threats and communicate concerns to supervisors and police promptly.
ACT Within the Professional Qualifications Framework
ACT training is already embedded within the professional qualifications framework for event security in the UK. The ACT modules form part of spectator safety qualifications. For the Award and Certificate at Level 2 and Level 3 Certificate it will be the ACT Awareness eLearning resource. For the Level 3 Extended Certificate and Level 4 Diploma it will be the ACT strategic session, the one-day course delivered regionally through the regional Counter Terrorism Units by licensed Counter Terrorism Security Advisors.
This integration ensures that event security guards working across both indoor and outdoor environments are not simply receiving counter-terrorism training as an afterthought. It is woven into the formal professional pathway, supporting consistent organisational preparedness across the industry.
The ACT Strategic Session
For those working at the higher levels of event security management, the ACT Strategic Session goes further still. The purpose of the ACT Strategic Session is to build collaboration and understanding between different businesses from a single geographic area, so that they can learn from each other, understand the different issues each business may have, and work together to better prepare for, and protect against, a terrorist attack or similar incident.
This collaborative element is particularly valuable in major event settings, whether an indoor arena complex or a large outdoor festival, where security services must coordinate with venue staff, hospitality teams, local police, transport operators, and neighbouring businesses.
The Legislative Backdrop: Counter-Terrorism and Security Act 2015 and Martyn's Law
The legal framework underpinning security preparedness at UK events has evolved significantly in recent years. The Counter-Terrorism and Security Act 2015 placed a statutory duty on a wide range of specified authorities to have due regard to the need to prevent people from being drawn into terrorism, and introduced significant provisions around data retention, authority-to-carry schemes, and the Prevent duty for public authorities.
The Arrival of Martyn's Law
More recently, the landscape has shifted dramatically with the passage of the Terrorism (Protection of Premises) Act 2025, commonly referred to as Martyn's Law. The Terrorism (Protection of Premises) Act 2025, also known as Martyn's Law, received Royal Assent on 3 April 2025. This Act delivers the government's manifesto commitment to strengthen the security of public events and venues.
The Act comes at a time when the government considers the threat level from terrorism in the UK to be substantial as well as less predictable and harder to detect and investigate. This reflects precisely the kind of evolving risk that ACT training is designed to address, equipping security guards with the awareness and procedures they need to respond even when threats are difficult to anticipate.
A Tiered Approach for Qualifying Premises
Martyn's Law applies to both indoor and outdoor venues and events. Whether it is a permanent indoor arena, a temporary outdoor festival site, or a ticketed sporting event held in an open stadium, if the expected attendance reaches the relevant threshold, the legal duty applies.
Under the tiered approach established by the Act, when the requirements come into force the person responsible for standard duty premises will have to notify the Security Industry Authority of their premises and have in place, so far as reasonably practicable, appropriate public protection procedures. These are the procedures that should be followed by people working at the premises if an act of terrorism were to occur at the premises or in the immediate vicinity.
Enhanced Duty Premises
For larger premises and qualifying events of 800 or more people, a threshold easily reached by most mainstream indoor concerts and outdoor festivals, enhanced duty requirements apply. Certain larger premises fall within the enhanced tier, with additional procedural requirements in recognition of the potentially higher impact of a successful terrorist attack. For enhanced duty premises, the legislation requires not only that public protection procedures are in place but that steps are also taken to reduce vulnerability to terrorist attacks more broadly.
The Implementation Period and Statutory Guidance
The government intends for there to be an implementation period of at least 24 months from Royal Assent before the Act comes into force. During this time the Home Office will publish statutory guidance to assist those responsible for qualifying premises and events in understanding and meeting their obligations. This guidance will support businesses and organisations across England, Wales, Scotland and Northern Ireland in planning their compliance effectively.
The Security Industry Authority has been named as the official regulator and will carry out enforcement action against those who fail to meet their obligations once the legislation takes effect. ACT training sits at the heart of how event organisations will demonstrate the necessary organisational preparedness across both indoor and outdoor settings. A security team that has completed ACT Security e-learning is far better positioned to develop and implement the kind of public protection measures that Martyn's Law demands.
| Training Element | What It Covers | Indoor vs Outdoor Application | Risk Level |
|---|---|---|---|
| Threat & Item Detection | Spotting hostile reconnaissance (suspicious behaviour, photography, testing access) and assessing unattended items via the HOT protocol (Hidden, Obviously suspicious, Typical) | Indoor: easier to spot anomalies in controlled spaces. Outdoor: harder due to open, scattered layouts | 🟡 Medium |
| Attack Response (RUN HIDE TELL, Invacuation, Bomb Threats, Vehicle Attacks) | Evacuating, sheltering, or locking down during firearms, weapons, bomb, or vehicle-borne attacks | Indoor: controlled evacuation/invacuation via defined exits, avoiding crush points. Outdoor: managing dispersed crowds, cordons, and vehicle perimeter threats | 🔴 High |
| Reporting & Communication | Promptly escalating suspicious activity through correct channels to supervisors and police | Applies equally indoors and outdoors; underpins every other response | 🟢 Low |
| Legal Compliance (CTSA 2015 & Martyn's Law) | Statutory duties incl. SIA notification and public protection procedures for premises/events of 800+ people | Applies to both permanent indoor venues and temporary outdoor event sites | 🟡 Medium |
Implementing ACT Training in the Event Security Environment
For security managers and event organisers, the practical implementation of event security ACT skills should be built into the pre-deployment preparation for every event, indoor or outdoor. SIA licence-linked qualifications include a section on terror threat awareness, and together the two ACT e-learning courses cover this material.
This means that for licensed security operatives, ACT training is directly aligned with the requirements of the Security Industry Authority's licensing framework and supports compliance with the broader counter-terrorism protective security standards expected of the industry.
Pre-Event Preparation for Indoor Events
Best practice suggests that all security guards deployed at an event should have completed both the ACT Awareness and ACT Security e-learning modules before taking up their post.
At indoor venues, this should be combined with a thorough venue-specific induction covering emergency exits, invacuation points, communication systems, and coordination procedures with venue management and police. Understanding the physical layout of an indoor space is essential for executing any public protection procedures effectively when time is critical.
Pre-Event Preparation for Outdoor Events
At outdoor events, the pre-event briefing should address perimeter vulnerabilities, vehicle access controls, assembly points, and the specific challenges of managing large dispersed crowds across open ground. Security guards must understand the scope of the site, the position of medical teams, the location of police liaison points, and the communication channels available to them. ACT training provides the counter-terrorism framework within which all of this operational preparation becomes strategically meaningful.
Tracking and Recording Completion
Training completion is logged on the ProtectUK platform, making it straightforward for organisers to verify that their security teams are properly prepared. ACT training is a simple, no-cost way to improve event safety by ensuring staff know how to respond in the event of an emergency. It does not replace an event's emergency plan, but it significantly enhances the team's readiness and supports the kind of consistent, well-prepared security culture that both the Counter-Terrorism and Security Act 2015 and Martyn's Law are designed to promote.
The value of ACT training lies not only in the specific knowledge it imparts, but in the professional mindset it cultivates. A security guard who has engaged meaningfully with Action Counters Terrorism training, whether they are standing at the entrance of an indoor theatre in London's West End or patrolling the perimeter of an outdoor summer festival in the north of England, approaches their role with heightened awareness, a clearer sense of responsibility, and the confidence to act decisively when it matters most.