Overall knife crime in some Australian states is at a 20-year low. ASIO’s current caseload for individuals under 16 suspected of radicalisation is growing. Both statements are true at the same time.
That tension defines the active armed offender (AAO) planning challenge right now. Security teams that read only the incident data will conclude there’s no crisis and underinvest. Teams that follow media narratives will overcorrect into visible hardening that doesn’t match the actual threat. Neither position produces resilience.
What the Australian threat actually looks like
AAO attacks in Australia are structurally different from the scenarios that dominate international coverage. Firearms are harder to access. The dominant attack profile is a lone actor, using an edged weapon or vehicle, targeting a crowded public place. Low-cost. Low-planning. Sometimes ideologically motivated, sometimes not.
The Westfield Bondi Junction attack in April 2024 killed six people and hospitalised twelve. The Wakeley Church attack two days later was ideologically motivated — a teenager stabbing a bishop. Different motivation, different target, similar method, within 48 hours. That sequence matters: successful attacks can fuel follow-on incidents within short time spans. Media coverage that speculates about motivation before facts are established can accelerate that cycle.
BOCSAR data shows overall knife crime in NSW is at or near 20-year lows. Youth knife crime is an area of ongoing focus, but not evidence of a broader crisis. The security media personalities running knife crime crisis content are not citing the same sources.
What the upstream conditions are telling us
Here’s where incident rate data and threat environment data diverge — and why both matter.
The post-COVID cohort has entered the threat window at exactly the wrong moment. Studies tracking psychological outcomes from the pandemic and associated lockdowns document increased depression, anxiety, and PTSD symptoms across multiple age groups, including children and adolescents (Wolf & Schmitz, 2024; Cataldo et al., 2023). For those already socially isolated, in the process of radicalisation, or prone to violent behaviour, these stressors are not benign background noise. They create fragility.
The cost of living context compounds this. Research into the relationship between economic insecurity and radicalisation is consistent: countries with higher rates of poverty see more domestic terrorism, and perceived inequality reliably increases radicalised attitudes regardless of ideological direction (Dialogue About Radicalisation and Equality, 2018). Housing insecurity and financial stress erode the sense of belonging and fairness that act as social buffers. As social cohesion fractures, vulnerable individuals may find significance in fringe spaces, where radicalisation is more likely to take hold.
The speed of online radicalisation is accelerating. ASIO’s Director General has stated this publicly. The pathway from initial exposure to an extremist ideology through to potential action is shorter than it was five years ago — and it is increasingly affecting minors. The caseload for individuals aged 16 and under is increasing, and online radicalisation driving extreme nationalism and right-wing terror is also rising.
The incident rates are holding. The conditions that produce future attackers are deteriorating. These are different signals, and they warrant different planning responses.
Where most organisations get this wrong
There are two common failure modes.
The first is dismissal: “the numbers don’t support the hype, so we don’t need to change our security posture.” This draws the wrong conclusion from correct data. A low base rate is not a low threat. The Bondi attack was one incident. It killed six people in approximately two minutes. Most deaths in AAO events occur before law enforcement can respond. You cannot manage that consequence profile by citing crime statistics.
The second is overcorrection: visible hardening, uniformed presence, access controls that signal threat rather than reduce it. For crowded places in particular, heavy securitisation can displace an attacker to a softer target rather than eliminating the risk. And in a community already experiencing post-COVID anxiety and social fragmentation, security measures that communicate danger rather than safety can worsen the conditions they’re meant to address. The research on crime generators and displacing effects is clear on this.
Good AAO planning does neither. It works across three integrated domains: the physical design of your premises, the security culture and training of your people, and the coordination of your response with emergency services. These are not parallel workstreams. They reinforce each other or they don’t work.
What proportionate planning looks like in the Australian context
For organisations managing crowded places, the priority investments are detection capability and response speed — not barrier hardening at the perimeter.
Events can resolve in as little as two minutes. The relevant design question is not “can we stop an attacker from entering?” but “how quickly can we detect, communicate, and get people away from harm?” That means CCTV systems with analytic capability that detects crowd anomalies in real time — not just records events for review after the fact. It means public address and emergency warning systems that are accessible and usable under high-stress conditions. It means evacuation routes designed for actual crowd volumes. It means access control systems configured for site-wide lockdown, with controls located in the security control room.
Training matters as much as infrastructure. Staff who understand Escape. Hide. Tell. as a practised response — not a poster on the wall — change outcomes. Frontline staff who are trained to make decisions based on their immediate situation, rather than waiting for instructions, reduce casualty counts. Security culture distributes awareness in ways technology cannot replicate.
Under Work Health Safety Law, security officers cannot be directed to confront an active attacker — the legal and ethical obligation is to preserve life until police arrive. Training programs that focus on direct intervention misunderstand the legal framework and set staff up to fail. The focus belongs on detection, communication, evacuation, and casualty care.
A note on the media environment
Our whitepaper flagged something organisations rarely build into their planning: post-attack media speculation is itself a threat multiplier. Unfounded attribution of motive or background before facts are established can drive community division, stigmatise specific groups, and create conditions for follow-on incidents. Research cited in our work is explicit on this: media and social media responses to an attack can, in worst-case scenarios, push vulnerable individuals toward extremist ideologies.
This has a direct operational implication. Your incident response plan should include media monitoring and communication management, not just physical and operational response. Who is responsible for monitoring media coverage in the hours after an incident? What is your communication protocol? What do you say publicly, to whom, and when? These are security decisions, not just PR decisions.
The planning obligation
I’m not of the view that there is an imminent crisis of AAO attacks in Australia. The data doesn’t support that. But I do believe the conditions that produce future attackers are deteriorating, and that most organisations are either dismissing the threat or responding to the wrong version of it.
The right response is sensible, scalable investment informed by the actual Australian threat profile: low-cost, lone-actor, edged-weapon, crowded-place. Design your premises to detect and delay. Train your people to respond. Exercise your plans before you need them. Understand the social environment your organisation sits within, and monitor it.
Plan now. The response once an event is in motion is almost always too late to change the outcome.
Core42’s Active Armed Offender whitepaper provides a reference guide for AAO planning in the Australian context, including the Deter-Detect-Delay-Respond framework, design recommendations, and training guidance. Download the whitepaper →