In 2011, Mr. Cano, then 17, laid out a strategy to detonate bombs at Freedom High School in New Tampa, Florida, and then shoot teachers and students in an attack that he had hoped would surpass the school shooting at Columbine High School in 1999.

“I plan to just walk into the parking lot and just shoot anyone there,” Mr. Cano said in a cellphone video posted online.

Mr. Cano never carried out the attack.

Police arrested him, and in December 2015 he was sentenced to 15 years in prison for threatening and attempting to discharge a destructive device.

Mr. Cano’s case is an example of how employers and organizations must “instill awareness” of potential threats to prevent violent scenarios, said Sean Ahrens, practice leader at consulting firm Jensen Hughes Inc. in Chicago.

Mr. Ahrens and other experts say prevention is a crucial component in protecting people from active shooter situations and other types of violence. However, they say many companies tend to focus on dealing with such scenarios when they’re in progress or during the aftermath.

“It’s a multidisciplinary problem, so there are multiple people that become involved with managing this type of incident,” Mr. Ahrens said. “Everyone has a specific role in preventing something from occurring, and I think that arguably that’s what we should be thinking about: prevention.” Active shooter or active assailant incidents have been making headlines in recent years with the 2012 Sandy Hook Elementary School shooting in Sandy Hook, Connecticut, and, more recently, the mass shooting at Pulse nightclub in Orlando, Florida, in June.

An FBI report released in 2013 said there were 160 active shooter incidents in the United States between 2000 and 2013, with an average of 6.4 incidents occurring in the first seven years studied and an average of 16.4 occurring in the last seven years studied. Seventy percent of these incidents occurred in either a business or educational setting, the FBI study said.

Anthony Mangeri, director of strategic relations for fire services and emergency services with the American Public University System in Charles Town, West Virginia, warned “risk is everywhere” when it comes to people who could potentially become violent.

“We’re not just talking terrorists,” he said. “We’re talking about disgruntled employees, previous employees, people who have temporary restraining orders against themselves or others who are suspected of wanting to do … harm.”

“What you’re getting is a lot of copycatting … where one tactic is working and having high impact” in terms of violent scenarios, said Julian Davies, head of consulting, risk services with S-RM Intelligence & Risk Consulting in London. “You’re starting to see blurred lines between sole perpetrators, criminals, terrorists. This is quite an interesting and unsettling development, whereas perhaps in the past it was easier to draw distinct lines between those very different threat actors.”

Ben Tucker, head of U.S. terrorism and political violence at XL Group Ltd. in New York, said a lot crisis management that he sees does not plan for preventing violence.

Companies have “broad policy guidelines,” he said, “but the very basic question I ask clients when I’m working with them is, ‘Can you pick up your plan and use it as a guideline step-by-step to make something happen?’ And a lot of times the answer is no.”

The U.S. Department of Homeland Security’s guidelines on active shooters state that human resource departments should conduct effective screening and background checks when hiring employees, create a system for reporting signs of potentially violent behavior and make counseling services available to employees to prevent employees becoming violent.

Mr. Mangeri also suggests that companies create concrete plans for preventing and dealing with violence.

“The risk management side of business has to start addressing this as a concern,” Mr. Mangeri said.

“Training, in my opinion, is one of the most important things in an insurance and business environment, even if you have an hour conversation with your staff,” he said.

“Sit down and have an hour safety brief with your staff that includes workplace violence. Then document it, document it, document it.”

If the session isn’t written down, he said, “it didn’t happen.”