Manhattan Attack 2025 July 28: Lessons Learned
By TorchStone Senior Analyst, Ben West
The active shooter attack that took place on July 28 at a high-rise office building in Manhattan and killed five people (including the shooter) emphasized important lessons in responding to armed attacks. This analysis will study the attack itself, as well as what went right and what went wrong. As we pointed out in our June 24, 2025, The Watch article, Active Shooter Attack Decline, security measures in place and effective responses from employees likely kept the death toll low. The attack proved that even ineffective assaults against prepared targets can still be lethal. There are always lessons to be learned from incidents like these.
The July 28 shooting followed a discernible attack cycle. As the investigation continues, we will certainly learn more about the shooter’s actions—especially the critical Planning & Preparation phase where perpetrators are vulnerable to detection and interception. It is always better to prevent an attack before it begins than to respond to one that is already underway.
In this case, the details of the assault available so far fill in the attack cycle as follows:
Target Identification and Selection: Evidenced by a note found on the shooter, he appears to have been targeting the NFL due to a grievance surrounding a condition known as Chronic Traumatic Encephalopathy (CTE) that has been linked to football-related injuries. His note indicated that the shooter had self-diagnosed as having CTE (possibly linked to his high school football career) and that he blamed the NFL for “covering up” the danger of CTE. It’s unclear how long the shooter held this grievance, but since the only way to confirm the presence of CTE is an autopsy on the brain of the deceased person, this grievance may have developed into suicide ideation. Other former NFL players have committed suicide in a way that preserved their brains for CTE examination. It is also noteworthy that the shooter had a history of mental health problems, and some reports indicate he struggled with psychotic episodes. His mental illness could have contributed to his belief that he had CTE.
Planning & Preparation: It is at least certain that the shooter identified the NFL’s Manhattan offices through basic open-source searches. However, it remains unclear how specifically he prepared to access the NFL’s specific floor. This article will cover that in more detail in the following sections.
Weapons Acquisition: A picture is developing of how the shooter acquired the weapon and the vehicle from his supervisor, whom investigators are focusing on to determine how the attacker’s preparations went unreported. Based on reports of recent, suspicious large ammunition purchases, there may have been a missed opportunity to intervene in the attack cycle during the weapons acquisition phase.
Deployment: In this case, the shooter deployed at least two days before the attack by driving cross-country from Las Vegas to New York. Public records suggest that he likely left Nevada on Saturday, July 26, and arrived in New York two days later. The details of his journey will likely yield further clues.
Attack: The attack itself suggested a lack of preparation on the gunman’s part beyond identifying the NFL’s building. Three of the four fatalities occurred within the initial moments of the attack, as he entered the lobby and while he still maintained an element of surprise. However, as people responded by either evacuating or barricading themselves in place, the attacker’s plan began to unravel. The fourth and final fatality of the attack appears to have been avoidable.
The attack culminated in the shooter’s apparent suicide, which was likely his intent from the beginning, based on his comments about CTE.
Exploitation: While the shooter’s motive remains under investigation, it appears that he carried out the attack to draw public attention to CTE and attempt to link the condition to the NFL. In this regard, the attack could be considered successful, at least preliminarily, as public discussion of CTE has dramatically increased since the attack.
What Went Right
First, while protective security measures did not prevent the attack, they likely made it less deadly and deterred the attacker from his intended target: the National Football League offices located in the building.
As our Vice President of Protective Intelligence, Scott Stewart, observed in a WTOP interview, “the attacker didn’t understand the layout of the building — how the elevators work or how to get up to the targeted floors.” While the attacker was able to identify the building that NFL offices are in through basic open-source searches, he does not appear to have been able to access the specific floor where the offices are located. Instead, the shooter ended up on the floor containing offices for building management. It is unclear whether he simply did not know the floor the NFL was located on or if elevator access systems prevented him from accessing the floor. Either way, he did not have an effective plan to reach his target beyond the building’s lobby. At this point, there is no indication that the shooter conducted physical surveillance of the building or had developed a strategy to access NFL offices. Instead, his strategy was to shoot his way in, which was obviously still lethal, but did not allow him to achieve his objective. His inability to reach his intended target likely contributed to his decision to end the attack when he did, possibly saving lives.
Second, employees working at the building overall demonstrated an effective response once the attack was underway, demonstrating the value of “avoid, barricade, confront”. Employees present in the lobby when the attack began created an escape path for themselves by breaking the glass barriers leading to the elevator area. Employees who had immediate access to the building’s exits evacuated the building with their hands in the air, allowing responding police officers to quickly identify them as non-threatening.
Third, employees who did not have immediate access to the exits employed the second strategy: “barricade” and deny the attacker access to them. Following the attack, images circulated of employees stacking heavy furniture and office equipment against office doors to prevent the shooter from gaining access. This is absolutely the right thing to do and, considering that they did not know the specific scope of the attack or how long it would last, there was nothing excessive about their response. One employee told CNN that she practiced what she had learned in school about how to respond during an active shooter situation. The employees used everything they had at their disposal to protect their lives. Then, they waited in the office quietly, so as not to attract attention, until they received confirmation from law enforcement that it was safe to dismantle their barricade and leave. This is an important lesson to keep in mind for the next section.
What Went Wrong
While the attacker’s lack of preparation prevented him from accessing NFL offices, it did not prevent him from carrying out the attack in the first place, which is security practitioners’ ultimate goal. As the investigation into the attack continues, officials are scrutinizing the shooter’s life in Las Vegas, searching for instances of leaked plans or threats. As of the end of July, there is no indication that the shooter had openly discussed his plans to attack the NFL offices, but the investigation is still in the early days. It will be important to learn who may have known about the shooter’s plans—or at least suspected that something was wrong and that the shooter presented a threat to himself and others.
For example, unnamed sources have told New York’s ABC 7 news that the shooter’s workplace supervisor was the person who sold him the weapon used in the attack and the BMW he used to drive cross-country to New York. Sources told ABC 7 that it was not clear how familiar the supervisor was with his employee’s plans or his past mental health struggles. It is also notable that the same supervisor would have been aware of the shooter’s absence from his scheduled shift on Sunday, July 27—one day before the attack took place.
Another potential red flag emerged in June 2025, when an anonymous source submitted a tip that identified the shooter as the purchaser of a large amount of ammunition at a gun show. However, investigations found no illegal activity, as the purchase was within the scope of the attacker’s permit.
Other important past clues for further investigation include a 2023 arrest at a casino in Las Vegas after the shooter refused to show his ID while trying to collect winnings. He became agitated and was arrested for assaulting a security officer, but prosecutors later dropped the case.
Examining all of the shooter’s actions leading up to the attack will likely point towards some missed opportunities to intervene in the attack cycle. The more we learn about the behavior that leads up to an attack and educate the public on signs to look for, the more empowered the general population will be to “see something, say something” when they notice suspicious activity.
Finally, from a victim response point of view, there is a stark contrast between the employees who survived by barricading themselves in safe havens and the employee who died on the 33rd floor because she left the designated safe-haven too early to check on the status of the attack outside. According to local news reports, employees had barricaded themselves in a locked restroom that doubled as a safe haven by the time the attacker had made it to the 33rd floor. Even though the shooter had fired multiple rounds on the floor, one of the employees sheltering in place left the safe haven to check on the situation. Her movement caught the attacker’s attention, and he shot her, causing lethal injuries. While the employee likely had good intentions, her actions tragically led to her avoidable death. Had she waited in the safe haven until law enforcement confirmed all was clear, she likely would have survived.
Conclusion
Like the attacks that came before it, the July 28 shooting in Manhattan should act as a learning opportunity for companies and individuals. The biggest lesson is the importance of using existing security measures effectively. In this case, that meant using designated safe havens and creating safe havens with the materials available. Also, it is critical to shelter in place in those safe havens until it is clear that it is safe to come out. Do not send a potential victim to “check if the coast is clear.” Hunker down as long as it takes until police or responding authorities confirm it is safe to leave, either directly by responding law enforcement officers, via the building’s public address system, or by cell phone or another communication system.