School safety is often evaluated by what a school has: cameras, locked doors, emergency plans, communication tools, resource officers, drills, and other safeguards intended to protect students and staff. Those measures matter, but an inventory of protections tells us surprisingly little about whether a school’s safety system will actually work when it’s needed.
In high-hazard industries, safety is designed around performance. Engineers begin by identifying what could go wrong, how harm could occur, and what the system must accomplish to interrupt that sequence. Individual safeguards are then selected, integrated, and tested against those requirements.
Schools can use the same discipline. Prevention by design means treating school safety as a system that must perform across credible threat scenarios, normal operating conditions, and the inevitable imperfections of human behavior. The result is a more useful standard than simply asking whether recommended security measures are present.
Safety Begins with Defining What the System Must Accomplish
A school cannot meaningfully evaluate its safety system until leaders have defined the functions that system must perform.
Consider the scenario that begins with an unauthorized entry. The objective sounds straightforward: keep an attacker out of the building. In practice, that broad goal involves several distinct functions. The system may need to detect an attempted forced entry or entry through an unlatched or propped open door, prevent or delay access, communicate the threat, protect occupants in vulnerable areas, and support intervention before the attacker can reach them.
Those functions need to be understood before specific solutions are selected. Otherwise, a school can spend heavily on access control without knowing whether the investment materially changes the outcome of a credible scenario.
This is one of the disciplines I bring from high-hazard environments into Principled Safety®. In those settings, a safeguard is tied to a defined safety function. Its purpose is known, the conditions under which it must work are understood, and its performance can be evaluated. That creates a clear line between the hazard being managed and the control being used to manage it.
School safety benefits from the same traceability. A camera, reinforced door, alarm, communication platform, or staffing decision should have a specific job within the larger system. Once that job is defined, leaders have a basis for determining whether the safeguard is adequate.
One example from my high-hazard experience involved a safety function that sounded simple: protect workers from exposure if a tank containing a toxic solution leaked or overflowed. In practice, achieving that outcome reliably required multiple safeguards working together.
Normal process controls regulated the flow of material into and out of the tank. Independent level monitoring provided early indication of changing conditions, while a high-level alarm warned operators as the tank approached an unsafe level. If the level continued to rise, an automatic shutoff stopped additional material from entering. And if those measures still failed to prevent a release, a containment berm provided a final physical barrier between the toxic material and workers.
No single safeguard was expected to carry the entire burden of protection. Instead, each performed a distinct function: control the process, detect a developing problem, alert people, limit the event automatically, or contain the consequences if prevention failed. Together, those layers created a system designed to remain protective even when one safeguard was insufficient.
That same logic is the basis of defense-in-depth: no single safeguard should be expected to prevent harm on its own. Originating in nuclear facility safety, the concept uses multiple, complementary layers so that if one control is ineffective, degraded, or bypassed, others can still interrupt the path from hazard to harm.
Applied to schools, defense-in-depth reinforces prevention by design: begin with a credible assault scenario, define the safety functions needed to change its outcome, and integrate layers of detection, delay, communication, protective action, and response around those functions. The measure of protection is therefore not how many safeguards are present, but whether they work together and remain protective when one layer is insufficient. This model is developed further in Chapter 2 of Before the Next Tragedy: Preventing Harm in School Shooting Scenarios, where it is applied to credible assault scenarios targeting schools.
The number and strength of those layers depended on the reliability of the individual safeguards and on how well they were maintained and tested. Less reliable safeguards required additional layers—or more robust ones—to achieve the same level of protection. That principle translates directly to school safety: The question is not simply how many safeguards are present but whether the safeguards, taken together, can reliably perform the safety functions the situation demands.
The Interfaces Between Safeguards Matter as Much as the Safeguards Themselves
Many weaknesses in complex systems appear at the points where one component interacts with another.
A surveillance system may detect a threat effectively, but its value drops if the information does not reach the person responsible for acting on it. A secure door may prevent unauthorized entry while also creating complications for emergency access. A communication system may send an alert quickly, but staff still need clear procedures for interpreting and acting on that alert.
Each component can perform correctly on its own while the larger system still fails to achieve its objective.
This is why prevention by design requires leaders to examine interfaces. School safety measures should be evaluated as connected parts of a system rather than separate purchases or programs. In my experience, some of the easiest vulnerabilities to miss are created by ordinary operations rather than unusual events. The analysis has to consider how information, people, procedures, and physical protections actually work together from the first indication of a threat through intervention.
This systems perspective is especially important because schools have dynamic environments. Hundreds or thousands of people move through buildings every day. Doors open for deliveries and activities. Visitors arrive. Students change classes. Staff members supervise multiple spaces. After-school programs alter normal traffic patterns. A safeguard designed without accounting for these interactions may perform very differently once it’s placed into daily operation.
The hidden risk is often not a failed component. It’s an unexamined connection between otherwise reasonable components.
A lockdown provides a useful example. Locking doors can create an important layer of protection, but the effectiveness of that safeguard depends on what happens around it. If responders don’t know where the threat is, where occupants are sheltering, or where injured people need assistance, a protective action intended to isolate people from danger can also complicate the response. The weakness isn’t necessarily the lockdown itself. It may be the interfaces between lockdown, situational awareness, communication, and responder access.
Prevention by design requires those interfaces to be treated as part of the safety system. If surveillance is expected to provide situational awareness, for example, it must do more than record an event. The system must be capable of detecting and tracking a developing threat, and useful information must reach the people responsible for acting on it. If secured doors are intended to delay unauthorized entry, the system must also provide a reliable means for authorized responders to gain access when seconds matter. And if classrooms are expected to shelter occupants, communication systems must allow staff, dispatchers, incident commanders, and responders to exchange the information needed to make informed decisions about sheltering, evacuation, and intervention.
The same principle applies to camera placement, communications coverage, access credentials, emergency procedures, and the roles assigned to school resource officers and other personnel. Each safeguard has a defined function, but its performance also depends on the safeguards and people connected to it. A camera without a reliable path for communicating what it detects, an alert without a clear response action, or a secured door that responders cannot quickly access can leave a critical gap even when every individual component appears to be working as designed.
This is the systems perspective at the heart of prevention by design. The goal is not simply to add more security measures or technology. It’s to design the connections among detection, communication, access control, protective actions, and response so that the system as a whole can interrupt the path from threat to harm.
A Safety System Has to Work with Human Behavior
Safety systems are sometimes designed around an ideal version of human behavior. Procedures assume doors will always be secured, communications will always be understood, staff will always remember the correct response, and equipment will always be used exactly as intended.
That isn’t a realistic design basis.
High-reliability organizations assume that people will occasionally make mistakes, become distracted, misunderstand information, or develop workarounds when a process interferes with getting the job done. The system is designed with those realities in mind.
Schools should pay particular attention to workarounds because they reveal valuable information. If staff routinely prop open a door, bypass a check-in procedure, or use an unofficial communication method, the first response should include understanding why. Repeated deviations often indicate that the formal process conflicts with operational reality. When the same workaround appears again and again, it should be treated as evidence about the design of the system, not merely as a series of unrelated compliance failures.
That doesn’t make the unsafe behavior acceptable. It makes the behavior useful diagnostic information.
A well-designed safeguard should be practical enough to sustain during ordinary school operations and resilient enough that a predictable human mistake doesn’t immediately create a critical vulnerability. Where possible, the system should make the safer action easier to perform consistently.
This is an important distinction between writing a procedure and designing protection. Procedures depend heavily on compliance. Effective systems consider the conditions that shape compliance in the first place.
Prevention Requires Testing the System Before a Crisis Does
A safety measure that’s never been evaluated under realistic conditions remains partly an assumption.
Installation confirms that equipment is present. Training confirms that information has been provided. Documentation confirms that a procedure exists. None of those steps, by itself, demonstrates that the safety function will be achieved when conditions become difficult.
Testing should therefore be connected to performance requirements. If a communication system is expected to reach designated personnel anywhere on campus, coverage needs to be verified throughout the campus. If responders require immediate access to secured spaces, that capability needs to be demonstrated. If a surveillance system is expected to maintain situational awareness during an attack, its performance should be examined under conditions that challenge visibility, connectivity, and normal operations.
Testing also gives schools an opportunity to find interactions that weren’t apparent during planning. A drill may expose a communication delay. An inspection may reveal that a door no longer latches properly. A routine observation may show that an established procedure is rarely followed because it doesn’t fit the way the building actually operates.
These findings are valuable because they occur while the school still has time to correct them.
Video surveillance illustrates why realistic testing matters. A camera system that performs well during normal school operations may perform differently under the conditions created by an actual violent event. Gunfire, smoke, airborne dust, rapidly changing light, vibration, movement, and disrupted connectivity can challenge the very functions the system is expected to provide when situational awareness matters most.
The relevant question, then, isn’t simply whether cameras are installed or whether they produce clear images during routine operation. It’s whether the surveillance system can continue to perform its defined safety functions under the conditions associated with the credible scenario. Can it provide usable images when visibility deteriorates? Can personnel maintain awareness of a moving threat? Does information remain available to the people responsible for acting on it? And if one part of the system is degraded, are other safeguards available to compensate?
Those questions can’t be answered from equipment specifications alone. Where a surveillance system is assigned a critical safety function, its performance should be validated under realistic and appropriately designed test conditions that represent the stresses the system may encounter, without introducing unnecessary risk. Testing may reveal limitations in camera placement, image quality, communications, power, network capacity, monitoring procedures, or other system interfaces that would remain hidden during normal operation.
That is the purpose of testing in prevention by design: not to prove that a safeguard works under ideal conditions but to discover where protection may break down while there’s still time to strengthen the system.
Good Safety Design Is a Continuing Process
Schools change constantly. Buildings are renovated. Technology is replaced. Personnel turn over. New programs bring people into different areas of the campus. Procedures evolve, sometimes formally and sometimes through everyday habit.
A safety system therefore can’t be treated as finished.
Prevention by design includes periodic reassessment of the scenarios, vulnerabilities, and assumptions that shaped earlier decisions. Leaders need to know whether the system still reflects current conditions and whether safeguards continue to perform their intended functions. A change that seems unrelated to security can alter traffic flow, access patterns, supervision, communications, or emergency response in ways that deserve review.
Principled Safety® provides a structured way to manage that process. The methodology connects credible scenarios to vulnerabilities, safety functions, safeguards, and measurable performance. That structure allows schools to adapt without abandoning disciplined analysis or chasing each new recommendation that enters the market.
The practical benefit is greater clarity. School leaders can explain why a safeguard exists, what it’s expected to accomplish, how it works with other protections, and how they know it continues to perform.
Every school will arrive at a different combination of safeguards because every campus operates under different conditions. What should remain consistent is the discipline used to evaluate them: Understand how harm could occur, define the required safety functions, account for human behavior and system interactions, and verify performance before an emergency puts those safeguards to the test.
Prevention by design moves the work upstream, where weaknesses can still be identified and corrected before they contribute to harm.
Prevention by design is ultimately about asking better questions before a crisis exposes the answers. If you’d like to explore more of the thinking behind the Principled Safety® approach, these related articles examine several challenges school leaders face when evaluating and improving safety:
Why School Safety Needs a Framework, Not Another Checklist
Five Common Mistakes Schools Make When Evaluating Safety Solutions
How the Principled Safety® Framework Would Analyze Parkland and Uvalde
Building Safer Schools Through Principled Thinking
Explore these and other school safety articles.
Take the Free School Safety Assessment. It is designed to help school leaders begin examining that question—identifying potential gaps in existing safety plans and considering whether individual safeguards function together as an integrated system.
For readers who want to go deeper into the methodology, Before the Next Tragedy: Preventing Harm in School Shooting Scenarios provides a more comprehensive examination of applying principled, systems-based thinking to school safety—including the defense-in-depth concepts discussed in this article.
