Jacksonville is a useful case study because it shows what happens when routine public life meets poor risk awareness and no layered defenses. The 2018 mass shooting at a Madden video game tournament at the Jacksonville Landing exposed predictable weaknesses: a semi-public venue, crowds with predictable movement, limited screening, and organizers who treated the event as a community hangout rather than a potential risk node. The shooter was a participant, returned with a handgun, and opened fire inside a cramped restaurant space that doubled as an event site. That dynamic made escape difficult and casualties inevitable.

Soft targets are not just undefended spaces. They are public spaces where the mission or purpose of the venue requires openness. Retail stores, places of worship, small entertainment venues, community events, and informal gatherings are soft targets by definition because they must be accessible. Attackers study that accessibility. The most dangerous actors are those who combine simple weapons and opportunistic access with premeditation. Examples from the last decade show a consistent pattern: attackers self-radicalize or fixate, conduct surveillance, choose a venue with high symbolic or demographic value, and then carry out a low-complexity, high-casualty attack. Looking at El Paso, Christchurch, Pittsburgh and Buffalo makes the point. Each attacker used accessible weapons, rehearsed or surveilled the site, and in several cases distributed a manifesto or livestream to amplify impact.

That pattern matters because it is cheap to copy and hard to predict. The online ecosystem amplifies risk. Public manifestos, livestreams, and fringe platforms create both incentive and operational playbooks for newcomers. Platforms function as multiplication engines for propaganda and tactical tips. Christchurch and El Paso demonstrated how a single actor can weaponize live streaming and a posted manifesto to maximize terror and inspire imitators. Those amplification mechanics turn localized attacks into national security problems.

If you run a venue, event, or faith community in Jacksonville or any mid-sized city, three blunt truths should guide your posture. First, prevention is not a single action. It is a program. Second, tactical friction at entry, not permanent militarization, reduces attacker success rates. Third, information matters. The private sector sees the site every day. Law enforcement sees it episodically. Those gaps must be closed. The federal government has built practical resources for that gap. CISA and DHS have a suite of guidance aimed at securing soft targets and crowded places. Those materials prioritize risk assessment, staff training, liaison with local law enforcement, and affordable physical mitigations. Use them.

Operational priorities for operators and managers

1) Conduct a realistic threat and vulnerability assessment. Map ingress, egress, chokepoints, likely lines of fire, and choke points where patrons bottleneck. Prioritize fixes that change attacker calculations: move registers, reconfigure queuing, improve sightlines, and add locking options to internal doors. Begin with simple, low-cost measures and exercise them.

2) Train staff to detect, deter, and delay. Teach employees simple reporting steps, suspicious-behavior indicators, and non-confrontational de-escalation. Train staff to enact a lockdown or directed evacuation and to communicate quickly with patrons and first responders. Rehearse these plans on a quarterly cycle.

3) Create friction without theater. Visible security for its own sake creates a perception of safety but often zero operational benefit. Instead, add targeted friction: strategic placement of staff, supervised bag checks at large events, hostile vehicle mitigation for parking lots, and reinforced glazing or partial ballistic barriers in high-value chokepoints. These measures make simple attack plans fail or reduce their impact.

4) Build public-private communications with police and fusion centers. Share access-control plans, event manifests, and surveillance camera feeds when appropriate. Protective Security Advisors and local law enforcement can help with tailored assessments and exercise design. Those partnerships also close the intelligence loop when concerning social media indicators emerge.

5) Treat online indicators as operational intelligence. Extremist actors frequently leave digital footprints: scouting posts, rehearsed timelines, manifestos, or hints on fringe forums. Organizations should have a policy to report credible threats to local law enforcement and, when appropriate, to federal tip lines. Public and private entities must resist normalizing troubling online behavior and instead escalate where there is reasonable cause.

Policy and resource realities

Funding and capability are real constraints for smaller venues. Federal grant programs exist to help jurisdictions prioritize soft-target protection. Use available grant guidance and CISA tools to leverage limited funds for the highest return on investment: training, signage, low-cost physical hardening and communication systems. Tactical investments that change attacker calculus are the best use of scarce dollars.

What law enforcement should do differently

Stop treating every soft-target threat as either a campus problem or a private-sector problem. Intelligence-driven prevention requires granular, local threat assessments fed by fusion centers and private-sector reporting. Local chiefs must run realistic exercises with venues, not tabletop meetings dressed as readiness. Quick wins come from routing, lighting, staffing models, timed deliveries, and bag policies. These are operational tasks, not academic debates.

Final point

Soft targets will never be perfectly secure. They are part of ordinary life. That is why resilience must be ordinary, built into daily practice rather than reserved for the rare security budget line. Jacksonville’s past attack at a public gaming event is a reminder: attackers prefer easy, visible gains. Deny them predictability and access, train people to react effectively, and build practical public-private partnerships that turn everyday accessibility into managed risk. Do the basics well and you reduce the odds that a lone actor converts grievance or ideology into mass harm.