In brief: 121 vehicle-as-a-weapon incidents from 2010–2024 were analysed and clustered into six empirically derived threat archetypes. Only ~25% of incidents involved any barrier being surpassed. Light commercial vehicles (N1-class vans) are the deadliest on average, not heavy trucks. Motive is a poor predictor of barrier engagement. Mixed-mode and sequential behaviour is material. "One-size-fits-all HVM" does not match the evidence. The research has been peer-reviewed and published in Crime Science.
Public places are designed to be open. Vehicle-as-a-weapon attacks exploit that openness. For most of the last decade, HVM has been designed to counter them using assumptions — about vehicle type, about motive, about how attacks unfold. This research examines what actually happened in 121 incidents, and what that means for how protective design should work.
This research was designed for the people who carry the real burden of HVM outcomes — infrastructure owners and operators, venue and precinct security managers, urban designers, planners, and project directors working inside budget constraints, public-realm expectations, and regulatory scrutiny.
Why we did this research
Most HVM is designed from assumptions: "design for the truck", "motive predicts behaviour", "a line of bollards equals protection". The reality is messier, and the consequences are severe.
The public domain lacked a systematic, evidence-led analysis of what vehicles are actually used in attacks, how often barriers are encountered and how they fail, how incidents resolve (crash, stopped, escape), the growing pattern of mixed-mode attacks, whether ideology predicts behaviour in the way current guidance assumes, and how spatial context shapes outcomes.
Without that evidence base, HVM specification has defaulted to worst-case assumptions: heavy-vehicle design basis, perimeter-first logic, crash-rated barriers as the only defensible response. The cost has been disproportionate protection at sites facing a different threat profile entirely, hostile public realm where design quality was displaced by compliance, and no framework at all for the threats that appear most often in the data.
What we did
Core42 compiled and analysed a global dataset of 121 vehicle-as-a-weapon incidents (2010–2024), using systematic open-source research. The dataset continues to grow.
Dataset and analysis covered:
- Incident outcomes — deaths, injuries, resolution pattern (crash, interdicted, escape)
- Vehicle classification — aligned to ISO 22343-1:2023
- Barrier interaction — overcome vs circumvented vs not encountered
- Motive classification — ideological vs non-ideological
- Mixed-mode indicators — vehicle with secondary weapons, follow-on violence
- Spatial verification — multi-source triangulation and Street View validation where feasible
A statistical cluster analysis was then applied to move beyond the generic "access type" heuristics that dominate current guidance, deriving a six-archetype model that reflects real-world patterns of vehicle selection, context, crowd dynamics, and barrier engagement. The results have been peer-reviewed and published in Crime Science.
What we found
Six patterns surfaced consistently across the dataset. Each one points to the same underlying observation: current guidance is calibrated to a minority of what actually happens.
Most incidents occur where no barriers were encountered
Only ~24–25% of attacks in the dataset involved any barrier being surpassed (overcome or circumvented). In most incidents, barriers were not encountered at all, or the encounter was unclear. Exposure is the norm, not the exception.
When barriers fail, casualties rise sharply
Where barriers were surpassed, incidents averaged ~7 fatalities versus ~1.8 fatalities where barriers were not encountered. Poor placement and incomplete coverage can create false confidence with disproportionate consequences. Partial protection is not always better than no protection.
The most lethal vehicles are not what most plans optimise for
N1-class light commercial vehicles (vans, light trucks) were the deadliest on average, at ~5.1 fatalities per incident, ahead of heavier classes. This challenges the common assumption that "design for the biggest truck" is always the right optimisation. The design basis vehicle should come from the data, not from a default.
Motive is a poor predictor of barrier engagement
Barrier engagement rates were essentially identical across ideological and non-ideological incidents (~25.7% vs ~25.5%). The deciding factors were opportunity, layout, vehicle characteristics, and spatial conditions — not motive labels. Threat assessments anchored primarily to ideology will miss most of the pattern.
Mixed-mode and sequential behaviour is material
A significant portion of incidents involved secondary weapons or follow-on violence. Static protection alone is not a complete answer. Design must pair with response planning and operational readiness, particularly at sites that host events or dense gatherings.
"One-size-fits-all HVM" does not match reality
The six-archetype model shows vehicle-ramming attacks cluster into distinct profiles: heavy vs light vehicles, opportunistic vs premeditated, protest-related, ambient urban. This supports archetype-based planning rather than generic access-type heuristics. The same protective response cannot be appropriate for every site.
What it means for design and governance
The research points to three strategic shifts.
- Archetype-based threat modelling. Move from generic "access approach" methods to context-led, scenario-specific analysis grounded in the six observed attack patterns.
- Layered protection, not single hard lines. Reduce circumvention opportunities and create fallback resilience through depth, not a single rated perimeter.
- Compound and sequential behaviour in scope. Plan for mixed-mode incidents, particularly at event-based and protest-prone locations, where vehicle phase may precede or follow other attack modes.
The underlying reframe: treat HVM as a civic safety function — like accessibility, fire safety, or road safety — requiring standards, coordination, and design literacy to keep public spaces open and resilient. The current framing, HVM as counter-terrorism overlay, is the thing producing the mismatch between specification and observed reality.
Benchmark your site against the data
The 6 Profiles HVM Scorecard is built directly from this research and verified through peer review. Five minutes returns a tailored snapshot: which of the six threat archetypes apply to your site, where the protection gap sits between the threats you face and the measures in place, and proportionate next moves at your current position.