Acting Safely During a Knife Threat or Attack

There is no sequence of actions that will work reliably in every knife threat or active attack, irrespective of distance, environment, surprise, the number of people involved and the attacker’s behaviour. Sound guidance therefore does not begin with a disarming technique. It begins with an assessment of the situation: What is happening now? How much time remains? Which route leads out of the attacker’s immediate reach? Which action is most likely to produce the greatest immediate safety gain?

This distinction is not relevant only to the person directly threatened. Operators of publicly accessible premises, employers, security managers and senior decision-makers must examine the same situation from a second perspective: Which structural, technical and organisational conditions enable employees and visitors to recognise danger early, move away from it, summon help and care for casualties once the immediate threat has ended? Individual behaviour cannot compensate for inadequate security arrangements.

Situational assessment instead of simple rules: threat, attack and aftermath

In everyday language, the term “knife attack” is often used for very different situations. In Germany’s Police Crime Statistics, it covers offences in which an attack with a knife is directly threatened or actually carried out; merely carrying a knife is not sufficient. This statistical definition is useful for recording incidents, but it remains too broad for decisions during a specific event. A person forced to hand over a wallet at knifepoint faces a different decision-making problem from someone who is already being subjected to repeated stabbing movements.

For practical purposes, a four-part situational model is more useful. The phases do not necessarily occur in sequence. An attacker may act without a visible preliminary phase, switch between threats and physical violence, or only appear to withdraw. The model is therefore not a prediction. It is a tool for identifying the immediate priority.

The transitions are crucial. Communication that gains time during a static threat is not an adequate response once an attack has begun. Conversely, a sudden physical action during a situation that is still controlled may trigger precisely the escalation that should be avoided. Professional decision-making therefore includes changing strategy as soon as observable behaviour changes.

It is equally important to distinguish threat recognition from profiling. Clothing, age, origin or an “unusual appearance” are not reliable indicators of danger. Specific behavioural and spatial indicators are more informative: a person continues to close the distance despite evasive movement, keeps one hand concealed, deliberately distracts attention, blocks an exit or appears to coordinate with another person. These indicators still do not prove that an attack is imminent. They do, however, justify increasing distance, improving one’s position and leaving the area at an early stage.

Reaction time, distance and environment: why there is no reliable distance rule

The person initiating an attack knows when the action will begin. The targeted person must first perceive the movement, recognise it as a threat, select a response and then physically carry it out. This structural reaction disadvantage is often underestimated. It explains why seeing a weapon at close range does not automatically mean that there is still enough time to perform a prepared defensive action.

Controlled studies provide an indication of the possible timeframes, but they must not be treated as blueprints for real incidents. In a study published in 2022, 20 serving police officers performed four predetermined attack movements against a stationary target. Depending on the movement, mean execution times ranged from 0.61 to 1.07 seconds. A further study involving 74 participants examined concealed attacks initiated from approximately 2.44 metres. Across three movements, mean times to the target ranged from 1.43 to 1.60 seconds; the fastest recorded attempt took 1.04 seconds.

These figures describe attack movements measured under laboratory conditions. They do not show how long a particular person will take in a confusing environment, how reliably a defence will work or at what distance safety begins. In the studies, the task, starting position, training weapon and target were predetermined. Real incidents may involve surprise, changes of direction, grabbing with the free hand, loss of balance, furniture, other people and severe psychological stress. Neither a universal “safe distance” nor a promise that a particular defensive procedure can be completed in time can be derived from a mean value.

Distance nevertheless remains a critical safety resource because it provides time for perception, decision-making and movement. Its value is dynamic. Two metres in an open area is not the same as two metres in a narrow corridor. A closed door changes the situation in a different way from a light object that can immediately be moved around. Direction of travel also matters: a person moving backwards without knowing what is behind them may collide with a step, chair or wall. Someone who focuses exclusively on the blade may lose sight of a second offender, the exit or an obstacle.

A robust spatial assessment therefore answers several questions at once: Is the direct route to an exit open? Can a door be closed or locked? Is there an object that can obstruct immediate access? Does the selected route lead into a dead end? Are other people present who might be put at greater risk by the movement? Is the apparently safe area protected against the attacker returning? Safety depends not on distance alone, but on the combination of time, route and physical separation.

Acting safely during a knife threat

During a threat or robbery, the knife may primarily be used to control behaviour. This does not mean that the situation is safe or stable. It means only that there may still be a brief opportunity for communication, observation and a decision that is not rushed. The primary objective is not to prove a point or gain control over the offender. It is to reduce the likelihood of an immediate attack and make safe separation possible.

Calm, concise language, visible hands and movements that are as predictable as possible can help. If complying with a demand requires reaching into a pocket, a brief verbal explanation may reduce the risk of misunderstanding. An instruction that has not been understood should, if circumstances permit, be clarified calmly. Provocation, threats, arguments about consequences or demonstratively staring at the weapon hand may increase tension. De-escalation is not a psychological formula and offers no guarantee. It is an attempt to slow the situation down for as long as the attacker permits a minimum degree of communication.

No amount of money, no mobile telephone and no other replaceable possession justifies a physical confrontation with a knife. This does not create a rigid rule that complying with every demand will always be safe. An instruction to move to another location, enter a vehicle, allow oneself to be restrained or go into an isolated room materially changes the risk. The same applies if a second offender appears, the attacker suddenly closes the distance or demands give way to physical violence. Simple blanket advice cannot account for these changes.

Spatial awareness continues during communication: Where is the nearest usable exit? Is it genuinely clear? Which objects could make direct access more difficult if the situation escalates? Who else is nearby? Is the apparent escape route controlled by the attacker or an accomplice? This observation should not turn into conspicuous scanning or hurried preparation. The aim is to maintain a calm, continuous understanding of the situation.

An early opportunity to escape is particularly valuable when it increases distance and does not require moving directly past the attacker. As soon as a safe route is available, leaving the area takes priority. A person who has reached a protected location should not return to retrieve property, record the incident or observe it at close range. Doing so creates new risks and makes it more difficult for responding officers to distinguish offenders from victims, witnesses and helpers.

When the attack has begun: priorities instead of promises about technique

An active knife attack is not an orderly exchange of individual movements. The weapon may be concealed or recognised only at a late stage. The attacker may grab, push or strike with the free hand; either person may lose balance; and the direction of attack may change repeatedly. Video demonstrations in which an announced movement is performed slowly and followed by a multi-stage disarming sequence do not reproduce these conditions.

If a usable escape route lies outside the attacker’s immediate reach, it should be taken at once. Physical separation matters more than speed alone. Doors, substantial furniture, vehicles, counters, rows of seats and other solid structures can lengthen the attacker’s route and obstruct direct contact. An obstacle is useful when it remains between the two people, cannot easily be bypassed and does not obstruct the escape route.

The frequently repeated word “escape” is useful only if the route can actually be used. If the attacker is already within immediate reach, simply turning one’s back or retreating in a straight line may not end the attack. It may first be necessary to disrupt direct access, protect particularly vulnerable parts of the body, retain the ability to move and create a brief opportunity for separation. These are objectives, not instructions for a guaranteed technique.

Everyday objects within reach may primarily be useful as mobile protective surfaces or means of maintaining space: for example, a chair, rucksack, sturdy bag or another object that can be placed between the body and the weapon. Whether an object is suitable depends on its material, size, available grip and the surrounding space. An object that occupies both hands, obstructs vision or blocks the exit can become a disadvantage. Its function in the actual situation matters more than an abstract description of it as an “improvised weapon”.

If physical separation is impossible and there is an immediate threat to life or physical safety, physical resistance may become unavoidable. Its purpose remains narrow: to interrupt the active attack and end contact. As soon as an opportunity to escape arises, there is no longer a reason to continue the confrontation. Pursuing, punishing or continuing to use force against a threat that has already ended does not serve this objective. In German criminal law, Section 32 of the Criminal Code is particularly relevant: self-defence is the necessary defence against a present unlawful attack. Whether its requirements were met always depends on the circumstances of the individual case; an online article cannot determine that legal assessment in advance.

The situation remains unclear even after an apparently successful defence. The knife may fall to the ground, another offender may intervene or the attacker may become capable of continuing. A dropped weapon should not be picked up. Being encountered by police while holding a knife creates a life-threatening risk of misidentification. Distance, visibly empty hands and compliance with police instructions are now the priorities.

People, spaces and organisations: safety is more than individual behaviour

During incidents at railway stations, public authorities, educational institutions, shopping areas, workplaces or event venues, people do not act in isolation. They respond to the movement of others, incomplete information, public-address announcements, spatial bottlenecks and the behaviour of staff. It is therefore insufficient simply to tell visitors to “run away” or “remain calm”.

A study published in 2024 analysed footage from 27 CCTV cameras and additional incident data relating to the attack at Leytonstone Underground station in London. The researchers did not find one uniform form of crowd behaviour. Instead, they observed different and often purposeful, socially oriented responses: people escaped, warned others, assisted the casualty, communicated with emergency services, assessed the situation or acted collectively in relation to the attacker. The study therefore challenges the simple assumption that groups will inevitably respond with panic and self-interest alone. As an analysis of a single event, however, it cannot provide a universal prediction for every environment.

An experimental study involving 80 participants likewise found that decisions to leave were not determined solely by individual characteristics. A person’s position relative to the attacker and the behaviour of people nearby influenced whether and how quickly they moved. For those responsible for safety planning, this leads to a practical requirement: alerting systems, route guidance and assigned roles must enable people to make safer decisions despite incomplete information.

For bystanders, assistance does not have to mean physical confrontation. Warning others, creating distance, guiding people away, contacting the police, closing doors or providing first aid after the immediate danger has ended are frequently more effective contributions. Tasks should be assigned directly: “You in the blue jacket, call the police and give them the name of this entrance” is more reliable than a general call for someone to contact the emergency services. Anyone accompanying children, people with reduced mobility or visitors unfamiliar with the premises must expressly consider their ability to move, without unnecessarily entering the immediate danger area themselves.

Organisations must recognise that a hostile attack may require different movement decisions from a fire. A general evacuation towards familiar assembly points could, in some circumstances, direct people towards the threat or into an exposed area. International protective-security guidance therefore distinguishes between evacuation, moving people into protected internal areas and temporarily closing or locking down particular zones. The appropriate option depends on the attacker’s location and direction of travel, the building layout, the reliability of available information and the requirements of responding emergency services.

A credible emergency plan must therefore provide more than a single alarm and a single route. It needs clear and, where possible, direction-specific communication, defined decision-making authority and alternatives for situations in which the normal route cannot be used. Employees need to know who raises the alarm, how information is verified, which doors should close during an incident, where protected alternative areas are located and how police and ambulance services will be directed on arrival. People with disabilities, language barriers or additional support needs must be included during planning rather than considered for the first time during the incident.

Responsibility of employers and operators

For German employers, prevention begins with the workplace risk assessment required by Section 5 of the Occupational Safety and Health Act. This covers not only structural conditions, work equipment and processes, but also qualifications, instruction and psychological pressures. Section 10 requires arrangements for first aid, firefighting and evacuation, as well as the appointment of suitable employees. Under Section 12, instruction must be tailored to the workplace and the employee’s duties. This does not mean that every business must prepare for one prescribed attack scenario. Where the work creates a recognisably elevated risk of violence, however, that risk must be properly assessed and addressed through suitable measures.

The German Social Accident Insurance identifies several possible risk factors, including handling cash or valuables, performing inspection or enforcement duties, contact with distressed or aggressive groups and working alone in publicly accessible areas. Relevant settings can include transport operators, public-facing authorities, social services, retail, healthcare, educational institutions, security services and certain areas of justice and public administration. The specific assessment is determined not by the sector label alone, but by actual duties, accessibility, previous incidents, working hours and local conditions.

Prevention should prioritise structural, technical and organisational safeguards instead of transferring responsibility exclusively to individual employees. A personal-safety seminar may be useful, but it is not a substitute for safe workplace design, reliable alerting, adequate staffing or effective post-incident support.

Senior managers should distinguish between a plan on paper and genuine operational capability. An alarm button is not a reliable safeguard if no one understands where its signal goes. A lockable door helps only if authorised people can operate it under stress and no one is thereby trapped inside the danger area. An emergency card is ineffective if new staff, contractors and temporary workers have never seen it. Protective measures must therefore be tested, evaluated and adapted following changes to premises, staffing or organisational arrangements.

Professional preparation also requires a clear interface with the emergency services. Which address and entrance will be given during the emergency call? Who can direct responding officers without placing themselves in danger? Are building plans, keys or access information available? How will the organisation prevent unverified descriptions of an offender from circulating internally? These questions may appear unspectacular, but during a real incident they are often more important than general appeals to courage or public intervention.

What credible training must achieve

Training is professionally useful when it connects perception, decision-making and action. A person who practises only a fixed defensive sequence against a known attack primarily learns how to solve a prearranged task. Real violence may involve an ambiguous approach, transitions between communication and attack, different distances, active use of the offender’s free hand, spatial restrictions and the need to stop an action that has already begun.

A study published in 2021 compared a more linear training approach with a variable, nonlinear approach to defending against armed attacks. The participants were 20 German police recruits trained over a three-week period. During a later test, the variably trained group was struck less often, solved the tasks more quickly and achieved a higher success rate. In the qualitative data, participants in this approach also reported uncertainty because fixed techniques were absent as a point of reference. The small sample, specialist population and specific training design do not support a blanket claim about which method “works” for every person or organisation. The findings do, however, support an important principle: adaptability and decision learning deserve greater emphasis than perfect reproduction of a single choreography, while open tasks still require expert structure and clear guiding principles.

Credible training begins by distinguishing the roles and tasks involved. Staff at a municipal public-service office require different scenarios from event security personnel, retail employees or teachers. Capabilities also differ within a single organisation: reception staff, technical services, managers, security personnel and first aiders hold different roles, information and positions in the building. A serious programme therefore begins with the risk assessment and the organisation’s actual working practices, not with a universal collection of techniques.

At individual level, exercises should at least reproduce transitions between an unclear approach, a threat, an opportunity to escape, use of a barrier, unavoidable close proximity and the post-incident phase. The exercise objective must not always be to “defend”. Sometimes the correct decision is to leave early, sometimes to communicate, sometimes to close a door and sometimes to stop physical resistance that has already begun. Decision-making is trained only when more than one outcome is permitted.

Realism does not mean maximum physical or psychological intensity. Surprise attacks without informed consent, uncontrolled force or exercises that overwhelm participants are not marks of quality. Safe training weapons, appropriate protective equipment, defined levels of intensity, stop signals, qualified supervision, medical precautions and a structured debrief are required. Previous traumatic experiences and individual limits must be taken into account. Learning should be evaluated against observable criteria: Was the threat identified early enough? Was distance created? Was a better route selected? Did the participant disengage once an escape route opened? Did alerting procedures and assigned roles work?

For organisations, exercises are particularly valuable when they expose system weaknesses. These may include an announcement that cannot be understood in every area, a door that remains open contrary to the plan, missing responsibilities, an obstructed alternative route or an unclear handover to emergency services. The purpose is not to impress participants with a dramatic simulation, but to test decisions and protective arrangements under controlled conditions. Findings must be documented, responsibilities and deadlines assigned, and the improvements subsequently checked.

After contact ends: emergency calls, police contact and medical care

Once immediate contact has ended, a new phase begins. The first requirement is to determine whether the area is genuinely safe enough for further action. The attacker may return, additional people may be involved or a discarded weapon may remain dangerous. No one should pursue the offender. Assistance to casualties begins only when helpers are not required to enter the attacker’s immediate reach.

In Germany, an ongoing threat should be reported to the police on 110. The number for medical emergencies is 112. An effective emergency call briefly states the precise location, nature of the incident, number and condition of casualties, an objective description of the offender, the last known direction of travel and any visible weapons. Assumptions should be identified as such. The caller should not end the conversation independently; the control room may have questions and provide specific instructions.

When police officers arrive, hands should be visible and empty. Mobile telephones, bags, training equipment and especially a weapon lying on the ground should not be picked up. Sudden movements towards the belt or into clothing should be avoided. Police instructions must be followed first, even if they appear abrupt or contradictory. Responding officers do not initially know the roles of the people present and must bring the situation under control under severe time pressure.

Stab and cut injuries can be concealed by clothing. Stress may also prevent a person from immediately recognising pain or the seriousness of an injury. After reaching a safer area, those involved should therefore be systematically checked for bleeding and medically assessed. An object embedded in a wound should not be removed because it may be limiting blood loss and movement could cause additional injury.

For life-threatening external bleeding, European first-aid guidance recommends immediate, firm direct pressure on the wound. A suitable wound or pressure dressing can subsequently maintain that pressure. For deep, heavily bleeding wounds, wound packing with dressing material or haemostatic gauze may be required if suitable equipment and training are available. The ambulance service must be contacted at the same time, or a specific person should be directly instructed to make the call.

Life-threatening bleeding from an arm or leg that cannot be controlled with direct pressure may require an appropriate tourniquet. It is positioned above the wound and not over a joint, tightened until bleeding stops, and the application time is recorded. A tourniquet applied by a first aider must not subsequently be loosened by that first aider. This procedure should be learned practically under qualified instruction; a written description is not a substitute for training. If a person is unresponsive, breathing must be checked. If breathing is not normal or only agonal gasps are present, cardiopulmonary resuscitation should begin in accordance with the emergency dispatcher’s instructions.

Post-incident support does not end when the ambulance leaves. Victims, witnesses and employees who provided assistance may experience serious psychological effects. Organisations need a prepared process for psychological first aid, communication with relatives, documentation, statutory reporting, protection of personal information and access to longer-term care. Requiring an immediate, detailed account of the event in front of a group is not a universally appropriate early intervention. The priorities are safety, orientation, practical support and access to qualified assistance.

A practical decision framework

The following table consolidates the central principles. It is not a checklist to be followed mechanically from top to bottom. Its purpose is to identify the next available safety gain.

For individuals, the principal conclusion is this: the earlier a threatening development is recognised and answered through movement and space, the less personal safety depends on a physical confrontation at close range. For organisations, the conclusion is equally clear: operational capability is not created by a single lecture. It results from combining risk assessment, structural and technical safeguards, clear responsibilities, workplace-specific instruction, controlled exercises and dependable post-incident support.

The professionally honest message remains uncomfortable: there is no method that makes a knife attack safely controllable. There are, however, decisions and operating conditions that can reduce exposure, enable movement, accelerate assistance and limit the consequences. Those are the standards against which prevention, training and leadership should be measured.

Further practical training

The decision-making principles described in this article cannot be converted into dependable behaviour through reading alone. Information about practical, scenario-based knife-defence training is available from Urban Defense.