Holiday crowds are an operational advantage for an attacker. They bring predictability, concentration, and distraction. That combination makes seasonal markets, transit hubs, houses of worship, retail centers, and workplace parties attractive soft targets for lone offenders who want high visibility and low planning cost.
This is not theoretical. Attacks aimed at holiday or celebratory gatherings are a proven tactic. The 2015 San Bernardino massacre targeted a county holiday event and illustrates how a workplace celebration can become a mass-casualty scene. The 2016 Berlin Christmas market truck attack and the New Year attack on Istanbul’s Reina nightclub in 2017 show how vehicle ramming and indiscriminate shootings capitalize on crowded, festive settings. These incidents are operational templates that copy easily because they require little specialized equipment and exploit predictable human behavior.
Who is doing this now and why. Federal law enforcement has repeatedly warned that lone actors and homegrown offenders are more likely to choose soft, familiar targets. These actors are often self-radicalized or grievance-driven and act with limited operational tradecraft, which reduces the chance of complex plotting but raises the risk of sudden, lethal action against easy targets. That trend is the core of current domestic and counterterrorism guidance.
What the research says about lone actors. Academic and government studies find there is no single psychological profile, but there are common behavioral patterns. Many lone offenders show long lead times between first preparatory activity and attack, leak intent in social circles or online, and display grievances or personal crises before violence. Some have prior criminal histories or mental health issues; others are ideologically motivated. Crucially, many are detectable to somebody who pays attention to changes in behavior. Prevention depends on spotting those indicators and having clear, low-friction reporting channels.
Tactics and tools. Expect low-cost, high-effect methods: vehicles used as kinetic weapons, edged weapons, small arms, simple explosive devices, and commercially available drones. These methods are chosen because they are accessible, familiar, and leave little technical signature. Soft target guidance from DHS and S&T emphasizes that these attack modes are foreseeable and that mitigation is fundamentally about denying simple opportunities and reducing casualties if an attack occurs.
What owners and operators must do now. Measures should be proportionate but practical. Focus on three lines of effort: prevent, detect, and respond.
Prevent. Conduct a rapid vulnerability assessment that prioritizes vehicle access control, predictable choke points, and symbolic features that attract crowds. Install temporary or permanent vehicle barriers where foot traffic and parked vehicles intersect. Harden entry points for indoor venues and limit unobserved access to back-of-house areas. Build simple visitor flow plans for peak hours and staff them. Leverage grant programs and Protective Security Advisors for funding and technical help.
Detect. Train staff to spot behavioral indicators and to report without fear of bureaucratic friction. Use layered detection: visible staff, low-cost CCTV with clear fields of view, and designated staff radios or phones for fast escalation. Public messaging that encourages citizens to report suspicious behavior is both a deterrent and a source of detection. Remember that lone offenders often ‘leak’ intent in advance; information sharing matters.
Respond. Drill simple, survivable actions: run, hide, fight; shelter-in-place; and rapid reunification plans. Ensure medical trauma kits and bleeding control training are available at high-density, public-facing sites. Coordinate with local law enforcement and first responders to confirm arrival times and access routes. Post-incident recovery plans that address communications and business continuity shorten the window an attacker has to cause strategic damage.
Operational posture for the holidays is not about paranoia. It is about low-cost friction placed opportunistically. Moves that are inexpensive and visible increase attacker risk and reduce public casualties: a row of planters and temporary bollards, trained door staff, and a short pre-event security checklist will beat a hardened but invisible countermeasure every time.
Finally, treat the human element as the decisive factor. Technology and barriers help but good intelligence, prompt reporting, and routine training are the things that make soft targets less soft. Lone actors depend on complacency and predictable patterns. Change those patterns and you change the calculus of attack. Be visible. Be prepared. Keep crowds safer.