After the WSSU shootings, campus security teams are asking the wrong questions first

When the second shooting was reported at Winston-Salem State University on Saturday night, the first one was only 36 minutes old.

Two separate incidents. Two separate shooters. No connection between them — that detail was confirmed by Winston-Salem Assistant Chief Jason Swaim. A 19-year-old WSSU student, Peyton Izaia Patterson, was killed and three others were injured during homecoming weekend. According to NBC News (https://www.nbcnews.com/news/us-news/shootings-winston-salem-state-university-campus-rcna608082), Ziyaire Antonyo Spinks, 20, was charged with murder, assault with intent to kill, and felony possession of a firearm on an educational campus. Neither person arrested in connection with the shootings was a current WSSU student.

Campus security after-action reviews will inevitably focus on how those individuals got in. That is the right question — but it is the second question. The first one is harder: what did security teams do in the 36 minutes between incidents, and what did their written protocols tell them to do?

The gap between a response and a protocol

There is a meaningful difference between a security team that responds to an incident and one that follows a written escalation protocol. Responding means reacting — moving toward the problem, calling it in, waiting for direction. A protocol means every post on the deployment receives an automatic status update, entry points shift to a defined posture, roving teams reposition to cover the response gap, and a supervisor is running a checklist, not improvising.

When the first WSSU shooting was reported at 9:46 p.m., something happened at every other post on that campus. Some guards heard about it quickly. Some may not have heard for several minutes. Some knew what to do next; some were waiting to be told. That variation — not any single person's decision — is where the second incident found its opening.

Multi-location escalation protocols exist specifically for this scenario. They answer the question before the question gets asked: if something happens at Point A, here is what changes at Points B, C, and D within the next five minutes. Without a written protocol, the answer to that question depends on whoever is on shift and how much sleep they got.

Communication breakdown at scale

Large campus events — homecoming in particular — create a temporary operational environment that most campus security teams have not specifically trained for. The footprint is bigger than a normal school day. The crowd is denser and less predictable. The number of active posts is higher, which means more communication nodes and more chances for a message to arrive late, incomplete, or not at all.

Radio discipline matters more than most event security briefs acknowledge. When an incident is called in, secondary traffic on the same channel can delay critical updates to other posts by 60 to 90 seconds. That sounds minor. At an event with several thousand attendees and active perimeter points, a 90-second communication delay after a shooting is enough time for a second threat to move across the campus footprint undetected.

A tiered communication model — incident channel separate from general operations — is standard in event security for venues that have invested in it. It is not standard on most university campuses, which typically run a single-channel system designed for a quieter operational day.

The 90-minute window no one briefs

Security teams running large campus events are most focused on two moments: doors open and closing time. Both are legitimate high-risk windows. But there is a third window that most event briefs skip entirely: the period immediately following a reported incident anywhere on the event footprint.

That window is when crowd behavior becomes least predictable. Some attendees move toward the incident out of curiosity. Some move away from it in panic. Some stand still, confused about what is happening. Each of those behaviors creates a different kind of pressure on security posts that are now understaffed because personnel have shifted toward the incident location.

Briefing teams on this scenario — here is what a crowd looks like after a reported shooting, here is what your job is in the first ten minutes — costs nothing and takes about four minutes to cover. It also gives security personnel a mental model to work from when things start moving fast, which is exactly when mental models matter most.

XGuard builds post-incident crowd behavior scenarios into event security briefings because the evidence from multiple campus incidents shows that the second threat window opens during the response to the first, not after it closes.

What written protocols actually need to cover

A multi-location escalation protocol for a campus event does not need to be long. It needs to answer five questions in writing, in advance, before the event starts:

Who calls the escalation? One person, by title, not by name. If that person is unavailable, one backup, also by title.

What does escalation mean for each post? Entry points, interior positions, and roving teams each need a defined posture shift — not "increase awareness," but a specific behavioral change.

What is the communication sequence? Which channel, in what order, to which posts. Written out. Practiced once before the event opens.

What is the lockdown threshold? At what point does the event close, and who makes that call? Waiting until the second incident to answer this question is waiting too long.

Where does the crowd go? If the event closes under emergency conditions, where does a crowd of several thousand people move, and who is managing that flow? This question has injured people at events where it was left unanswered.

WSSU's homecoming drew the kind of crowd where all five of those questions mattered. Most of the campuses hosting similar events this fall have not written the answers down.

Pro tip: Run a five-minute tabletop on your escalation protocol with every security post lead before any large campus event opens. Ask them: if you hear a shooting reported on the radio right now, what do you do in the next 60 seconds? If the answers vary significantly between posts, the protocol needs another revision before the crowd arrives — not after.

The right timeline to focus on

Patterson was killed on his own campus during homecoming. The question of how two unconnected armed non-students reached two different locations on that campus in the same night is worth answering, and those answers will come through the investigation.

But the question that every campus security director can answer right now — without waiting for an investigation — is whether their team has a written, practiced, post-incident escalation protocol ready for the next large event.

Thirty-six minutes is a long time when no one knows what they are supposed to do next.

Need protection where you are? XGuard connects you with licensed, vetted security operators in minutes — for events, residences, retail, executive protection, and fire watch. Available globally.

Source: us-nbc-news — 2026-11-08