At least three of Zumwalt's employees were injured. He's still waiting to hear from a few more.
Although he said his company works with law enforcement and runs active shooter drills, he says there's "nothing you can do" when someone is shooting from another building above the venue.
"We plan for practically everything, but you don't plan for something you can't control, like a guy off-property," Zumwalt said. "That's pretty devastating, and there's just no real reason for that kind of insanity."
Zumwalt and others credited police for responding promptly to the situation.
The security measures that law enforcement took minimized the total number of casualties, said Bruce McIndoe, president of iJet International, which performs as many as 400 hotel security audits each year.
He noted that the Las Vegas Metropolitan Police Department has a 24-hour SWAT team available, one of only a few such teams in the country.
"If it were a typical stand-off situation, where you have to get a SWAT team mustered, how many more people would have died," he said in an interview. "The preparations and the system that they had in place worked."
Sunday marked the latest mass shooting at a concert venue, a so-called soft target.
Nearly two years ago, gunmen stormed an Eagles of Death Metal concert at the Bataclan theater in Paris, killing nearly 100 people. Earlier this year, a suicide bomber detonated an explosive vest at an Ariana Grande concert in Manchester, England, killing close to two dozen people.
Concerts are not necessarily more or less susceptible than other public gathering spaces like malls, said Chris Robinette, president of Prevent Advisors, a subsidiary of Oak View Group that provides security consulting for clients in industries including sports and entertainment.
Concerts naturally garner media attention, he said, making them potentially attractive targets for those trying to instill fear in people and deter them from going about their day-to-day life. The key is creating security environments that make it difficult to carry out attacks and thus deter people from trying.
There was "very, very little" event security could have done to prevent or deter the situation in Las Vegas, Robinette said in an interview. Security experts have already discussed ways to protect outdoor events, especially in urban spaces. Sunday's attack will likely accelerate those discussions.
"This is [a situation] that now live entertainment, especially concert venues and promoters, are definitely going to have to more thoroughly think through now," he said. "The problem is here. It's real, and it has consequences."
Live Nation, the company behind the music festival, is "heartbroken over the tragedy," a spokeswoman said in a statement. The company thanked its employees and first responders, while vowing to do everything in its power to support the victims and their families in the aftermath of the shooting.
Zumwalt said his team will continue to work with police departments to plan for future events. Sunday's incident raises the bar and will force his team to consider another level of extremes.
"You can't stop life," he said, "but obviously any time something like this happens, it now has to be part of the criteria to analyze and to think about and to consider."
— CNBC's Tucker Higgins contributed to this report.