Recognising the Terrorist threat

There is a serious and sustained threat from both international and Irish-related terrorism to the UK and UK interests overseas.

1. Threat levels

You can check the current threat levels:

The most significant terrorist threat comes from al-Qa’ida and associated networks. As the coordinated attacks on London in July 2005 showed, attacks may be mounted without warning.

Northern Ireland-related terrorism continues to pose a threat. Dissident republican terrorist groups (such as the Real IRA and the Continuity IRA) have rejected the 1998 Good Friday Agreement. They still aspire to mount attacks within the UK mainland and have conducted attacks within Northern Ireland.

2. Firearms threat

Although attacks involving firearms and weapons are still infrequent, it is important to prepare a plan. The essentials are to stay safe:

  • under immediate gun fire: take cover initially, but leave the area as soon as possible, if safe to do so
  • nearby gun fire: leave the area immediately, if it is safe to do so.
  • leave your belongings behind
  • do not congregate at evacuation points.

If you cannot escape, you should consider locking yourself and others in a room or cupboard. Barricade the door, then stay away from it. If possible, choose a room where escape or further movement is possible. Silence any sources of noise, such as mobile phones.

2.1 Planning

When you are planning for a firearms or weapons incident, you need to consider:

  • how you would communicate with staff, visitors, neighbouring premises
  • what messages you would announce
  • how you would secure important parts of the building to hinder the movement of the gunmen

You should integrate this firearms incident plan into your wider emergency planning and briefings. Test your plan annually. For further advice, liaise with your local CTSA.

2.2 See, tell, act

If your organisation or an organisation in the area has been attacked, the more information you can pass to police the better. 


Do not risk your own safety or that of others to get information. Use CCTV to check the area. You should think about:

  • the exact location of the incident
  • the number of gunmen 
  • descriptions of the gunmen
  • the firearms they are using (for example, long-barrelled or handguns)
  • what they are carrying
  • their communication methods
  • the number of casualties
  • the number of people are in the area


Call the police immediately. Provide them with the information you have gathered. Use all channels of communication available to inform staff, visitors, or neighbouring premises of the danger.


Secure your local area and other vulnerable areas. Ensure people stay out of public areas, such as corridors and foyers. Move away from the door and remain quiet until told otherwise by appropriate authorities, or if you need to move for safety reasons, such as fire.

Armed police

In an ongoing attack, the police may not be able to distinguish you from the gunmen. They may point guns at you. Follow their instructions and keep your hands in view. Avoid pointing, screaming or shouting, or any quick movement towards the police.

3. Vehicle-borne improvised explosive devices (VBIED)

VBIEDs can be highly destructive. Not only can the bomb blast be lethal, but flying debris, such as glass, can present a hazard.

VBIEDs can carry a large quantity of explosives to a target and cause a great deal of damage. The device can be delivered at a time of the terrorist’s choosing, with reasonable precision (depending on defences). It can be detonated from a safe distance using a timer or remote control, or can be detonated on the spot by a suicide bomber.

The UK has a history of VBIED-based terrorist attacks which used fertiliser-based explosives dating back to the early 1970s. In 1998 in Omagh a device containing agricultural fertiliser (ammonium nitrates) was detonated, killing 29 people and injuring hundreds. In 1996 in Manchester, a device made from a mixture containing agricultural fertiliser devastated the city. 

Find out more about how to store hazardous materials safely and how to Secure your fertiliser

3.1 Planning

Vehicle access controls

Use robust physical barriers to keep all but authorised vehicles at a safe distance. You should ensure you have effective controls, particularly at goods entrances and service yards:

  • do not allow unchecked vehicles to park in underground car parks or service areas directly below public areas or where there is a risk of structural collapse 
  • demand that details be provided in advance for any contract vehicles and the identity of the driver and passengers coming to your goods or service areas. 
  • deny access to any vehicle that arrives without prior notice.

Ask your local CTSA for advice on further measures, such as electronic surveillance (for example, automatic number plate recognition software) or options for protection from flying glass.

Physical security

Do what you can to make your premises blast resistant - paying particular attention to windows. You could have the structure checked by a qualified security or structural engineer.

You will need to balance the installation of physical barriers (for example, bollards) against safety requirements. Check your fire safety risk assessment and the planning regulations.

Personnel security

Organise and rehearse bomb threat and evacuation drills. In a VBIED incident, windowless corridors or basements may be safer than outside assembly points.

Train and rehearse staff in identifying suspect vehicles, and in receiving and acting upon bomb threats. Key information and telephone numbers should be prominently displayed and readily available. 

The CPNI provides advice on hostile vehicle mitigation and NacTSO has published Integrated security: a public realm guide for hostile vehicle mitigation.

4. Suicide attacks

Suicide bombing is a very effective method of delivering an explosive device to a specific location. Suicide bombers may use a vehicle as a bomb or may carry or conceal explosives on themselves. The most likely targets are symbolic locations, key installations, VIPs or crowded places.

Explosions using homemade explosive devices have caused fatalities, injuries, and damage on a massive scale. The suicide bombers in the 2005 London attacks used precursor chemicals (in particular peroxide-based explosives) and killed 52 people and injured hundreds, many severely.

4.1 Planning

When planning protective measures for your site, you should consider:

  • placing your vehicle access control point at a distance from the site
  • briefing staff to look out for anyone behaving suspiciously or for suspicious-looking vehicles
  • ensuring that all visitors have their identities checked
  • installing a CCTV system

5. Chemical, biological and radioactive threats

There have only been a few examples of terrorists using CBR materials. The most notable were the 1995 sarin gas attack on the Tokyo subway and the 2001 anthrax letters in the United States. In 1996 in the US, an al-Qa’ida operative was sentenced for conspiracy to murder for his part in planning attacks using ‘dirty bombs’, which contained radioactive material.

The impact of a CBR attack would depend heavily on the success of the chosen method and the weather conditions at the time of the attack. The first indicators of a CBR attack may be the sudden appearance of powders, liquids or strange smells within the building, with or without an immediate effect on people.

Remember to apply personnel security standards to contractors, especially those with frequent access to your site.

6. Insider threat

Occasionally threats to companies and organisations come from within. Whether it is from a disaffected member of staff or an employee that has misrepresented themselves, there is more opportunity to disrupt or cause damage (whether physical or reputational) from the inside.

The risks posed by the insider threat can be lessened by carrying out thorough pre-employment checks and by having a strong security culture. The CPNI provides detailed guidance on personnel security.

7. Cyber threat

In the 21st century, one of the greatest threats to a company or organisation is from cyber attacks. The effects can often be devastating: the loss of crucial data, or a reduction in operating efficiency, or even closure.

Your senior management must assess the risk appetite of the company or organisation. But it is vital that everyone in your workplace understands the risks posed by cyber attacks.

A cyber attacker may not reveal themselves or even the nature of the attack. An attack may have no obvious adverse effects, but will extract information or data from your networks. 

Read the advice on cyber security on the CPNI website.

8. Further information