Counter-Terrorism Awareness Course (UK): Lessons 2026

Lesson 1: The UK threat levels

The UK uses five threat levels to show how likely a terrorist attack is. The national threat level is set by the Joint Terrorism Analysis Centre (JTAC). There is also a separate threat level for Northern Ireland-related terrorism in Northern Ireland, which MI5 sets.

Niveau	Signification
LOW	An attack is highly unlikely
MODERATE	An attack is possible, but not likely
SUBSTANTIAL	An attack is likely
SEVERE	An attack is highly likely
CRITICAL	An attack is highly likely in the near future

MI5 says the threat levels do not by themselves require a set response from the public. The key message is that vigilance matters at every level. The level changes from time to time, so check the MI5 website for the current one.

Lesson 2: Hostile reconnaissance and reporting

Hostile reconnaissance is purposeful watching to collect information for planning a hostile act. Attackers may research online, visit a site, or use inside knowledge. They want to know how strong the security is, whether they will be noticed, and where the weak spots are.

Behaviour that may be suspicious

Close interest in entrances, exits, CCTV cameras, security features or staff
Pretending to take a photo, or photographing something other than what they claim
Hanging around in restricted or non-public areas
Asking unusual questions or hiding their face
Vehicles parked out of place, left abandoned, or driving the same route again and again

Alert, engaged security staff and well-placed CCTV with active operators make hostiles worried about being caught. After a quick dynamic risk assessment, you can politely ask a person to explain what they are doing. The See, Check and Notify (SCaN) programme teaches staff to see hostile reconnaissance, check what to do about it, and notify: know who to tell and what to tell them.

Who to tell

Situation	Report to
The person is still there and you need police now	999
The person has left, or some time has passed	Anti-Terrorist Hotline 0800 789 321, online, or 101

Give the date and time, the place, a detailed description of the person or vehicle, the direction they went, why it seemed suspicious, and what you did. It is always better to call police while the person is still at the scene.

Security staff observe, deter and report, which fits the See, Check and Notify approach.

Observe: watch for behaviour that seems out of place.
Deter: be visible and engage with people.
Report: tell the police and your control room, with clear details.

Lesson 3: Unattended and suspicious items

Not every unattended item is suspicious, but no unattended item should be ignored. Each one should be assessed in a sensible, proportionate way. Staff use the HOT questions to decide whether an item is suspicious:

Hidden: was it hidden on purpose or placed out of view?
Obviously suspicious: can you see wires, circuit boards, batteries, tape, liquids or putty-like material? Was it found after suspicious behaviour?
Typical: is this the kind of item you would expect to find in this place? Ask people nearby.

If the item is suspicious, follow the 4 Cs in order:

Confirm that the item has suspicious features, using HOT.
Clear the area. Do not touch the item. Move people away and out of its line of sight.
Communicate: call 999 and tell your control room or supervisor. Do not use radios or mobile phones within 15 metres of the item.
Control the area so nobody can get near until it is declared safe. Keep eyewitnesses for the police, or take their contact details.

Élément	Minimum distance to clear
Small item, such as a rucksack	100 metres
Small vehicle or large item, such as a car or wheelie bin	200 metres
Large vehicle, such as a van or lorry	400 metres

Shelter people behind solid cover such as brick or concrete, away from glass and parked vehicles. Nobody goes back into the area until the police say it is safe.

Lesson 4: Bomb threats

Most bomb threats are hoaxes meant to cause alarm and disruption. But every threat is a crime and must be reported to the police.

Threat by phone

Stay calm and let the caller speak.
Write down exactly what is said.
Try to find out where the device is, when it will go off, and who the caller is.
When the call ends, dial 1471 if your phone system allows it, to try to get the caller's number.

Threat by email or social media

Do not reply to, forward or delete the message. Keep a record: print the email, or note the app and the username for a social media message. Then report it.

Lesson 5: Weapons attacks: Run, Hide, Tell

Run, Hide, Tell is the public advice from Counter Terrorism Policing for a weapons or firearms attack.

Step	Que faire
Run	If there is a safe route, leave. Urge others to come, but do not let them slow you down. Leave belongings behind. Do not try to film.
Hide	If you cannot run, find cover that can stop gunfire. Cover from view does not mean you are safe: bullets can go through glass, brick, wood and metal. Lock and barricade yourself in, move away from the door, and silence your phone with vibrate off.
Tell	Call 999 when it is safe. Say what is happening, where, where the attackers are, and describe them, their weapons and any casualties. If it is safe, stop others from going into the building.

If you cannot speak on the 999 call, listen to the call handler and follow their instructions.

For businesses and their staff, ProtectUK also publishes Guide, Shelter, Report (GSR), a set of response principles that organisations can build into their own procedures. Your employer will tell you how it applies at your site.

Lesson 6: Martyn's Law and your role

The Terrorism (Protection of Premises) Act 2025, known as Martyn's Law, received Royal Assent on 3 April 2025. It applies across the UK. The Security Industry Authority (SIA) will be the regulator. The government expects an implementation period of at least 24 months, and the duties do not apply until they are brought into force.

Tier	Who	Main duties
Voie standard	Premises where 200 to 799 people may be present at the same time	Tell the SIA, and have public protection procedures, so far as reasonably practicable
Enhanced	Premises and qualifying events with 800 or more people	The standard duties plus security measures, written records given to the SIA, and a senior individual where needed

The four procedures

Evacuation: moving people out of the premises, away from danger.
Invacuation: moving people away from danger to a safer place inside the premises.
Lockdown: securing the premises so people cannot enter or leave.
Communication: making sure people at the premises get the information they need.

The Act has no legal requirement for specific training, but staff with a role must be told about the procedures and their part in them. The free ACT e-Learning course from ProtectUK takes about an hour and is open to everyone.

This course is awareness only. If you do contracted security work, such as guarding or door supervision, you usually need an SIA licence. For a front line licence, the SIA requires a licence-linked qualification before you can apply.