AMOK (active assailant situation)

The term derives from the Malay word mengamuk and became established in Central European, particularly German-language, security practice for attacks in schools, healthcare, public institutions and companies. In English operational terminology it corresponds to 'active shooter' and 'active assailant', which stress two points: the event is ongoing, and the weapon need not be a firearm — the same pattern occurs with a blade, a vehicle or an incendiary device. It differs from terrorism in that the definition does not rest on a political or ideological motive, and from targeted violence against an individual in the intent to harm as many people as possible.

Analyses of past cases show that a large share of incidents ends within minutes, often before or just as police arrive. The outcome therefore depends on what the people present do in those first minutes: the internationally established guidance is to leave first, to conceal and secure the room if leaving is impossible, and to resist only as a last resort. Equally important are an unambiguous alarm signal, rapid notification of emergency services with usable information, and a pre-made decision on evacuation or lockdown.

The same analyses show that such attacks rarely arise spontaneously. They are usually preceded by a longer pathway involving a sense of grievance, development of intent, its direct or indirect disclosure to others, acquisition of means and preparation. Prevention therefore rests on multidisciplinary threat assessment: a clear route for reporting concerning behavior, a team that assesses the case professionally, and case management that combines restrictive measures with help and support for the person concerned.

For organizations this is also a legal obligation. Under Slovenian occupational health and safety legislation, employers must adopt measures to prevent, eliminate and manage violence, mobbing and harassment and other psychosocial risks in the workplace. Preparedness for the event itself — plans, drills, communication, aftercare for those affected and continuation of operations — is part of the wider security system and of business continuity planning.