Europe’s Micro-Jihadist Surge
Online Radicalization, Low-Tech Attack Readiness, and the Italian Exposure
Executive Alert
Europe is entering a renewed phase of low-threshold jihadist threat, driven less by centrally directed Islamic State attack planning and more by rapid online radicalisation, personal grievance, imitation dynamics, and lightweight operational connectivity through social media and encrypted messaging. The recent cases in Italy, Austria, Spain and Switzerland indicate a threat environment in which the distinction between propaganda consumption, ideological mobilisation, recruitment contact and attack readiness is narrowing. This is the main point: the operational cycle is becoming shorter, less visible and harder to disrupt before the final behavioural shift.
Italy is directly exposed. The recent arrests in Brianza, Bologna/Reggio Emilia and the earlier Modena case show a pattern that should not be treated as isolated. The recurring indicators are young male suspects, Moroccan or broader North African background in several cases, open support for Islamic State, online glorification of martyrdom, contact with suspected recruiters or ideological facilitators, and references to low-complexity attacks using vehicles or knives. The tactical profile is not sophisticated, but that is precisely the problem. Low-tech plots require minimal preparation, limited logistics, no formal cell structure and very short mobilisation windows.
At the European level, the same pattern is visible. Spain has reported a significant number of jihadist arrests in 2026, including multi-province networks and young suspects allegedly fascinated by mass-casualty attacks. Austria’s recent operation suggests continued pressure on Islamist communication spaces and propaganda ecosystems. Switzerland’s Winterthur stabbing shows the persistence of lone-actor or near-lone-actor violence around known radicalisation environments. The Netherlands case involving alleged ISIS propaganda on TikTok reinforces the platform shift: jihadist exposure is no longer confined to Telegram, Rocket. Chat or legacy encrypted spaces. It is increasingly blended into mainstream attention economies, especially TikTok, Instagram and short-form video ecosystems.
The threat should be assessed as tactically elevated but strategically fragmented. There is no evidence, based on the available information, of a coordinated Islamic State campaign in Europe comparable to the 2015–2017 external operations architecture. The more accurate assessment is that the Islamic State’s residual brand, global propaganda, and online supporter ecosystems are enabling dispersed mobilisation among vulnerable or ideologically receptive individuals. This creates a persistent attack surface across European urban environments, especially transport hubs, public squares, religious sites, police or military targets, Jewish and Christian targets, and crowded civilian spaces.
For Italy, the key risk is not the emergence of a large organised jihadist network in the short term. The key risk is a successful micro-attack conducted by an already visible but only partially understood radicalised subject, possibly after online encouragement, imitation of another incident, or perceived personal humiliation. The Brianza and Reggio Emilia/Bologna cases are particularly relevant because they combine propaganda, personal signalling, willingness to act and potential external encouragement. That combination is often more important than formal organisational membership.
The operational warning is clear: the European jihadist threat is shifting toward compressed radicalisation-to-action pathways. Preventive policing remains effective, but the margin for disruption is shrinking. Monitoring must therefore prioritise behavioural acceleration indicators: sudden martyrdom language, farewell-style posts, fixation on recent attacks, direct references to knives or vehicles, requests for religious justification, contact with recruiters, deletion of accounts, creation of backup channels, and public statements about “doing the right thing” or “making the country better.” These are not generic signs of radical opinion. In this context, they may indicate a shift from ideological consumption to operational intent.
📌 Inside This Assessment
Why This Matters Now
Italy as a Near-Term Exposure Zone
European Pattern, Spain, Austria, Switzerland, Netherlands
Modus Operandi, knives, vehicles, social media, Telegram, martyrdom framing
The Online Acceleration Problem
Forecast 30–60 Days
Indicators to Watch
Policy and Security Implications
Final Analytical Line.
Why This Matters Now
This matters now because the current threat picture is moving faster than the traditional counter-terrorism categories used to describe it. The recent cases in Italy and Europe do not point to a single coordinated campaign. Still, they do show a convergence of risk factors that, taken together, increase the probability of a successful low-tech attack. The pattern is not spectacular operational sophistication. It is repetition, speed, imitation and low entry cost.
The first factor is the compression of the radicalisation-to-action cycle. In several recent cases, suspects were young, highly active online, exposed to Islamic State material, and moved quickly from ideological signalling to apparent operational intent. This is a different threat environment from the foreign fighter mobilisation phase of 2013–2017, when travel to Syria or Iraq often created a more visible logistical footprint. Today, the operational pathway can remain domestic, digital and fragmented. A subject can consume propaganda, declare allegiance, interact with recruiters or sympathisers, select a low-tech method and signal intent within days or weeks. That reduces the window available to intelligence and law-enforcement agencies.
The second factor is the normalisation of low-threshold attack methods. Knives, vehicles and improvised targeting do not require training camps, weapons procurement networks or cross-border facilitation. This makes the threat less dependent on formal Islamic State command structures. A failed or partially disrupted plot can still inspire another individual elsewhere. The operational ecosystem becomes cumulative: every arrest, attack, video, martyrdom post, or media report can serve as raw material for imitation. This is especially relevant for Italy after the Modena, Brianza, and Reggio Emilia/Bologna cases, because the domestic environment now includes recent reference points that online supporters can reinterpret as proof of momentum.
The third factor is the platform shift. Jihadist mobilisation is no longer confined to Telegram channels, password-protected forums or closed encrypted groups. Those spaces remain important, but the early-stage radicalisation layer increasingly interacts with mainstream platforms, especially TikTok, Instagram and short-form video ecosystems. This matters because mainstream platforms reward emotional intensity, repetition, identity performance and visual simplification. A user does not need to enter a jihadist archive to encounter grievance narratives, martyrdom aesthetics, anti-Western messaging or glorified violence. The pathway can begin in semi-open content environments and then move toward private chats, encrypted channels, or direct contact with recruiters.
The fourth factor is the age profile. The repeated presence of teenagers and men in their early twenties is operationally significant. Younger suspects can be more vulnerable to identity fusion, status-seeking, grievance amplification and performative radicalisation. They also tend to live in high-visibility digital environments, where ideological commitment is often expressed through posts, stories, reposts, memes, captions and short videos. This creates more open-source warning signals, but also more noise. The analytical challenge is distinguishing provocation, fantasy and ideological theatre from actual attack trajectory. The cases now emerging suggest that some of these signals are not empty performance. In specific contexts, they can be pre-operational leakage.
The fifth factor is the weakening of the boundary between the lone actor and the networked actor. Many suspects appear operationally isolated, but ideologically and psychologically connected. They may not belong to a structured cell, yet they can receive encouragement, validation, tactical suggestions or symbolic framing from online contacts. This creates a grey zone between autonomous radicalisation and remote facilitation. From a threat assessment perspective, this grey zone is more important than the label. A subject who receives encouragement from a recruiter, discusses target-country options, requests financial support, or records a pledge-style video is no longer simply an isolated consumer of propaganda. He has entered a more dangerous stage of mobilisation, even if no formal command-and-control relationship exists.
For Italy, the timing is particularly relevant because recent incidents show three concurrent vulnerabilities.
First, there is a domestic pool of young radicalised individuals already visible to law enforcement. Second, there are online pathways linking Italian-based suspects to broader Islamic State supporter ecosystems. Third, there is an emerging environment of imitation, in which one case can provide narrative fuel for another. Italy remains less exposed than France, Germany, Belgium or the United Kingdom in terms of historical jihadist attack volume, but lower historical exposure should not be misread as structural immunity. The current threat is not built around large cells requiring deep local infrastructure. It is built around small, fast, low-cost mobilisation.
At the European level, the issue is broader than Italy. Spain’s recent arrests indicate persistent jihadist activity across multiple provinces. Austria’s operation points to active Islamist communication spaces and networks for the dissemination of propaganda. Switzerland’s Winterthur attack demonstrates that known radicalisation milieus can still generate violence after years of monitoring pressure. The Netherlands case involving TikTok propaganda shows the relevance of mainstream digital platforms in supporter mobilisation. These are not identical cases, but they belong to the same threat environment. The common denominator is not organisational uniformity. It is decentralised jihadist activation under the residual Islamic State brand.
The strategic implication is that the Islamic State does not need to rebuild its former external operations architecture to pose a risk in Europe. It only needs to keep its brand alive, maintain a basic propaganda tempo, circulate examples of individual action, and preserve enough online connectivity among supporters to validate would-be attackers. That is a lower requirement than command-directed terrorism. It is also harder to eliminate. Even when the organisation is degraded territorially, its symbolic utility remains operationally relevant.
This matters for security policy because prevention cannot rely only on detecting weapons acquisition, travel plans or structured cells. The warning indicators are now more behavioural and digital: abrupt escalation in language, martyrdom framing, fascination with previous attacks, direct or indirect pledge-making, search for religious justification, operational fantasies involving knives or vehicles, contact with external facilitators, and public statements that resemble farewell messaging. The problem is that many of these indicators appear in open digital environments before becoming actionable for criminal purposes. This creates a narrow space between early warning and legal intervention.
The near-term risk is therefore not a mass-casualty campaign, but a sequence of attempted or disrupted low-tech plots, with a persistent probability of one successful attack. The most likely targets are soft, symbolic and accessible: transport nodes, streets around nightlife areas, police or military personnel, churches, synagogues, Christian or Jewish community sites, public events and crowded civilian spaces. The highest-risk profile is a young male already consuming jihadist content, socially unstable or personally frustrated, digitally expressive, attracted to martyrdom status, and connected either directly or indirectly to online Islamic State sympathisers.
The core assessment is straightforward: Europe is not facing a return to the 2015 model. It is facing a more diffuse, faster and less structured jihadist risk environment. That makes the threat less strategically spectacular but more operationally persistent. For Italy, the question is no longer whether the threat exists. It does. The question is whether the next case is disrupted before the final move from signalling to action.
Italy as a Near-Term Exposure Zone
Italy should be treated as a near-term exposure zone for low-complexity jihadist violence. Not because there is evidence of a mature Islamic State operational network on Italian territory, but because the recent cases show a concentration of warning indicators that are difficult to dismiss: young suspects, open pro-ISIS signalling, online propaganda activity, contact with suspected facilitators, references to knives or vehicles, and a visible move from ideological expression toward possible operational availability.
The central risk is not a large cell. The central risk is the individual or micro-cluster that moves quickly from online radicalisation to action, with limited preparation and limited need for external support. This is exactly the type of threat that can survive even when formal jihadist networks are degraded. Italy’s exposure is therefore tactical, urban and time-sensitive.
The recent Italian cases suggest three layers of risk.
The first layer is domestic radicalisation. The Brianza case shows the relevance of open-platform propaganda, especially Instagram and TikTok, where pro-ISIS narratives, martyrdom glorification and hostility toward Christians and the West can circulate in simplified, emotionally charged formats. These platforms are not only dissemination tools. They are identity environments. A young radicalised subject can use them to signal belonging, test reactions, escalate rhetoric, and construct a public self-image as a future actor. When this is combined with references to recent attacks or statements resembling pre-attack justification, the risk profile changes.
The second layer is remote facilitation. The Reggio Emilia/Bologna case is more concerning because it reportedly includes communication with a suspected ISIS-linked recruiter or intermediary through messaging applications. This does not automatically prove command direction, but it does indicate movement beyond passive consumption of propaganda. Once a subject discusses possible action, receives encouragement, considers target geography, requests or expects support, or records a pledge-style video, the case enters a higher-risk category. The operational significance is not the sophistication of the plot. It is the transition from ideological sympathy to availability for violence.
The third layer is imitation. The Modena vehicle attack, regardless of the final judicial classification and operational depth, has already become part of the domestic reference environment. When a later suspect celebrates or invokes a recent local incident, the incident acquires secondary operational value. It becomes an example, a script, a proof of feasibility. This is the mechanism that matters. In the current information ecosystem, even a crude or failed attack can become a model for another subject, especially if framed online as courage, martyrdom, revenge or religious duty.
Italy’s vulnerability is also geographic and social. The highest-risk areas are not necessarily those with the largest Muslim communities, a crude and analytically weak indicator. The relevant exposure points are major urban corridors, transport hubs, symbolic targets, crowded pedestrian zones, religious sites, police or military presences, and cities with recent law-enforcement activity. Milan, Bologna, Rome, Turin, Naples, Reggio Emilia and other northern or central urban nodes deserve attention because they combine mobility, population density, digital connectivity, symbolic visibility and accessible targets.
The likely attack profile in Italy remains low-tech. The most plausible scenarios are knife attacks, vehicle ramming, attempted assaults against police or soldiers, threats against Christian or Jewish sites, or attacks on crowded civilian areas. Firearms-based plots remain less likely because they require higher access capability and a more visible procurement chain. Explosives are possible but have a lower probability in the near term, unless there is stronger evidence of technical guidance, precursor acquisition, or external facilitation. The realistic concern is a fast, improvised act by a subject already visible online but not necessarily embedded in a structured network.
The Italian security services and Digos have so far shown strong preventive capacity. The recent arrests demonstrate surveillance, digital monitoring and early intervention capability. But preventive success should not produce complacency. The problem with this threat category is that the gap between warning and action can be very narrow. A subject can move from online declaration to physical attack with a knife or vehicle in hours. That compresses the operational decision cycle and increases dependence on behavioural detection, platform monitoring, community reporting and rapid legal thresholds for intervention.
The demographic profile is also relevant. Several recent cases involve young men of North African origin or mixed European-North African background. This should be handled carefully but not avoided. The analytical point is not ethnicity. The analytical point is the intersection between identity conflict, social marginality, online ideological exposure, grievance narratives, and the Islamic State’s continuing ability to offer a simplified heroic role to isolated or unstable individuals. Some cases may include mental instability, personal frustration or criminal background. These factors do not negate terrorism. They can accelerate it. In contemporary jihadist mobilisation, ideology and personal dysfunction often reinforce each other.
Italy also has a specific symbolic profile. It is a NATO member, a central Mediterranean state, host to the Vatican, an important logistical node for European security, and a country involved in counter-terrorism, migration control, Middle East diplomacy and military missions. For Islamic State supporters, Italy offers multiple symbolic frames: Christianity, Rome, Western military alignment, perceived hostility to Islam, and proximity to Mediterranean migration narratives. This does not mean Italy is the top European target. It means Italy is targetable within the Islamic State ideological universe.
The European context increases the near-term exposure. Arrests and incidents in Spain, Austria, Switzerland and the Netherlands show that Italy is not facing an isolated domestic problem. The same digital currents cross borders. A young suspect in Italy can be influenced by an attack in Switzerland, an arrest in Spain, propaganda from Syria, an ISIS supporter in Turkey, or a TikTok ecosystem hosted elsewhere. National threat assessments must therefore treat the online layer as transnational by default. The operational actor may be local, but the ideological environment is not.
For Italian policymakers, the key issue is early disruption before operational crystallisation. Monitoring should focus less on formal membership and more on escalation indicators: sudden increase in pro-ISIS content, martyrdom language, direct praise for recent European attacks, fixation on knives or vehicles, statements about imminent action, private-channel migration, contact with recruiters, requests for money, pledge-style videos, and abrupt behavioural changes. These indicators should be weighted cumulatively. One signal may be noise. Five signals in sequence may be pre-attack leakage.
For site readers and security stakeholders, the judgment should be clear: Italy is not in a panic scenario but in a warning phase. The number of successful attacks does not define the threat level. It is defined by the number of interrupted trajectories and their similarity to one another. When multiple cases show comparable online behaviour, ideological reference points and low-tech attack interest, the correct assessment is elevated exposure.
The most likely short-term development is more arrests, more preventive measures and more cases involving online ISIS support. The most dangerous short-term development is a successful knife or vehicle attack by a young self-radicalised or remotely encouraged subject, especially in a northern or central Italian urban area. The greatest concern is not the sophisticated operative. It is the visible, unstable, digitally expressive sympathiser who decides to act before authorities can close the gap.
European Pattern, Spain, Austria, Switzerland, Netherlands
The European picture does not point to a single, centralised, and fully coordinated campaign by the Islamic State. It points to something less visible but more persistent: a sequence of jihadist micro-trajectories, often youth-based, digital, and fragmented, with rapid transitions from propaganda to action or operational readiness. The issue is not ISIS’s organisational strength in Europe. The issue is the residual capacity of the ISIS brand to generate mobilisation, imitation, and a willingness to engage in violence, even without a territorial or logistical structure comparable to that of the 2014-2017 cycle.
Spain is currently one of the most significant indicators. The operation at the end of May 2026, with at least ten arrests in Alicante, Malaga, Barcelona, Murcia, and Madrid, reveals a network spread across multiple provinces, with a radicalised profile and violent orientation. This is significant because it is not a single, isolated individual but a broader constellation, consistent with an environment of radicalisation, contact, propaganda, and potential facilitation. The case of the eighteen-year-old arrested in Tarifa, Cadiz, also falls within the same ecosystem. He was described as having pledged allegiance to ISIS and was obsessed with mass jihadist attacks in Europe. Furthermore, Spain has already recorded dozens of arrests for jihadism in 2026, a sign of heightened investigative pressure but also of the persistence of the militant or sympathising base.
The Spanish case is useful for Italy because it highlights two parallel levels. First, the network level: loose networks, contacts, propaganda, and radicalised environments in multiple cities. Second, the individual level: young people attracted by the idea of a lone attack, a copycat massacre, and symbolic loyalty to ISIS. This combination is dangerous because it allows the jihadist ecosystem to function even without a single command. A network can radicalise, normalise, validate, and push; the individual can act with minimal means.
Austria confirms another element: the connection between public events, youth radicalisation, and mainstream platforms. The recent nationwide operation against Islamist groups, involving six suspects, searches, and the seizure of phones, laptops, knives, extremist-themed written materials and clothing, indicates an investigative focus on communication, propaganda, incitement, and glorification rather than on a fully developed attack plan. This is important because it demonstrates a logic of preemptive intervention: targeting communication spaces before they become operational spaces.
Austria had already demonstrated vulnerabilities in 2024 and 2025. The plot against Taylor Swift’s concerts in Vienna, which subsequently resulted in a 15-year sentence for a 21-year-old Austrian, remains one of the most revealing cases: radicalisation, swearing allegiance to ISIS, propaganda, instructions for explosives, and interest in attacks with a high symbolic impact. Furthermore, in 2025, Austrian authorities arrested a 14-year-old suspected of planning to attack Vienna’s Westbahnhof station. He was radicalised online and active on TikTok and carried a knife, extremist material, attack sketches, and bomb instructions. These precedents are not marginal: they show that Austria is already in the European cycle of accelerated radicalisation, whether among minors or young people, digital or low-tech.
Switzerland adds the most disturbing step: the failure of final prevention. The Winterthur attack on May 28, 2026, in which three people were stabbed at the train station, was classified by authorities as a terrorist act. The suspect, a 31-year-old Swiss-Turkish citizen, had already been identified in 2015 for spreading Islamic State propaganda. He had lived in Turkey for approximately two years and had been released from a psychiatric facility the previous day after being deemed not dangerous. This case contains almost all contemporary dilemmas: previous radicalisation, possible mental instability, return from abroad, stabbing, accessible target, minimal execution time.
Winterthur is also relevant to Swiss jihadist memory. The city had already been associated, during the Syrian peak, with radicalisation networks and departures for ISIS. The operational fact is not that Winterthur is now a structured jihadist hub, but that some local environments can maintain symbolic and relational value over time. This confirms a useful lesson for Italy as well: places of radicalisation do not necessarily disappear after the acute phase. They may remain dormant, fragmented, and less visible, but can be reactivated by personal triggers, international propaganda, or imitation.
The Netherlands, on the other hand, demonstrates the transformation of the information domain. On February 10, 2026, Dutch police arrested 15 people suspected of spreading propaganda of the Islamic State on TikTok and attempting to persuade others to commit terrorist crimes. This case is crucial. It’s not just about “online propaganda.” It’s about a mainstream platform being used as a space for incitement, soft recruitment, and the normalisation of violence. Dutch police confirmed that the suspects used TikTok to push others toward terrorist crimes.
The European pattern is therefore composed of four converging dynamics.
The first dynamic is the youthification of the threat. Spain, Austria, the Netherlands, and Italy show subjects in their teens or early twenties. This is not a demographic detail; it is an operational variable. Young subjects are more exposed to status seeking, performative identity, imitation, dependence on online validation, and the rapid transition from violent fantasy to action. In this environment, violent acts can be perceived as an identity shortcut.
The second dynamic is the platformization of radicalisation. TikTok, Instagram, Telegram, and other apps do not perform the same function. TikTok and Instagram can trigger the phases of exposure, aesthetics, outrage, belonging, and imitation. Telegram and encrypted messaging can serve for contact, ideological reinforcement, instructions, pledges, requests for support, and the transition to more closed channels. The trajectory is not linear, but the pattern is recognisable: open platforms for attraction and performance, closed spaces for consolidation and potential facilitation.
The third dynamic is the centrality of low-tech. Knives, vehicles, stations, public events, crowded streets, and religious symbols are at the heart of the threat because they lower operating costs. Reducing costs increases the potential number of actors. An arsenal is not necessary. A cell is not necessary. Extensive preparation is not necessary. All that’s needed is sufficient conviction, a trigger, an accessible target, and a few minutes of operational freedom.
The fourth dynamic is the hybridisation of personal distress, instability, and ideology. Some cases involve psychological fragility or marginalisation. This does not automatically reduce the terrorist element. In many cases, it reinforces it because ideology provides language, justification, and a heroic framework for already unstable or frustrated individuals. The rigid distinction between “mental illness” and “terrorism” is often analytically flawed. The correct question is whether jihadist ideology has guided, justified, or made the violence imitable.
For Italy, these European cases are a direct warning. The threat doesn’t come only from a potential internal network. It also comes from European information synchronisation. An arrest in Spain, a stabbing in Switzerland, a conspiracy in Austria, and a wave of propaganda on TikTok in the Netherlands can fuel radicalised individuals in Italy. The contagion isn’t organisational; it’s narrative and behavioural.
The operational assessment is clear: Europe is not returning to the complex attacks model of 2015, but is entering a phase in which multiple micro-trajectories can produce a high volume of alerts, arrests, and attempted attacks. Authorities’ capacity remains high, but the window for disruption is narrower. The success of prevention will depend less and less on detecting large networks and more and more on the ability to read weak signals, behavioural patterns, and digital pathways before they become physical actions.
Modus Operandi, Knives, Vehicles, Social Media, Telegram, Martyrdom Framing
The modus operandi emerging from recent cases in Italy and across Europe is consistent with a low-complexity jihadist threat, characterised by rapid decision-making and low logistical dependence. A structured cell is not required. Military training is not required. Access to explosives or firearms is not required. The most realistic operational profile is that of the individual actor, or micro-cluster, who moves from digital radicalisation to physical violence through common tools, knives, vehicles, social media platforms, and an ideological framework centred on martyrdom, revenge, and imitation.
The knife remains the most likely vector. It is accessible and inexpensive, does not require a procurement network, does not necessarily raise alarms before an attack, and can be used against random or symbolic targets. In terms of urban security, it is the most difficult method to prevent when the perpetrator has not yet committed any obvious preparatory acts. The attack can be decided very quickly and carried out in ordinary places: stations, streets, squares, markets, pedestrian areas, places of worship, and military or police stations. The damage may be limited compared to an explosives attack, but the psychological, media, and political impact remains high, especially if the action is claimed, glorified, or linked to ISIS.
The vehicle is the second most significant vector. Here, too, the key is not sophistication, but availability. Cars, vans, or work vehicles can be transformed into weapons of attack without the need for complex criminal or terrorist networks. The Modena case fits this logic as a domestic reference: the vehicle becomes an immediate weapon, with strong imitative value. For a radicalised individual, a local precedent lowers the psychological threshold for action. He doesn’t have to invent anything. He simply has to replicate a previously seen model, perhaps reinterpreted as an act of courage or sacrifice.
Knives and vehicles are not fallback options. They are the operational core of this phase. The Islamic State, in its propaganda cycle following the loss of territory, has repeatedly emphasised individual action conducted with simple means. The implicit operational message is clear: don’t wait for orders, don’t wait for capabilities, don’t wait for perfect conditions. Act with what you have, where you are. This logic shifts the threat’s focus from technical capacity to psychological availability.
The role of social media is crucial because it precedes, accompanies, and, in some cases, replaces organisational structure. TikTok, Instagram, Facebook, and other open platforms are not just propaganda channels. They are environments for exposure, selection, and self-representation. A radicalised individual can consume jihadist content, interact with anti-Western narratives, build a public identity, test their language, gain approval, and progressively increase the level of radicalism of shared content. This produces a form of performative radicalisation, where jihadist identity is also constructed through visibility.
The critical transition occurs when open propaganda is combined with more closed channels. Telegram remains central, not because it is the only jihadist platform, but because it allows for continuity, archiving, redistribution of material, direct contact, backup channels, and rapid migration after removals or bans. In many cases, mainstream platforms serve as surfaces of attraction, while Telegram and other messaging apps become spaces of consolidation. The typical path is not necessarily linear, but the sequence is recognisable: exposure on open platforms, increased radicalisation, contact with more extreme content or individuals, migration to closed channels, possible discussion of action, pledges, support, instructions, or encouragement.
This hybrid architecture makes the concept of the “lone wolf” increasingly less useful. Many actors act alone physically, but they are not alone cognitively, emotionally, and digitally. They may be autonomous in execution, yet connected in radicalisation. They may not receive direct orders, but they do receive validation, encouragement, examples, religious formulas, martyrdom narratives, and operational models. For threat analysis, this distinction is fundamental: an actor can be logistically solitary yet ideologically networked.
Martyrdom framing is the ideological multiplier. Without a martyrdom framework, the gesture can remain individual anger, deviance, or disorganised violence. With the jihadist framework, violence becomes mission, sacrifice, purification, revenge, and belonging. This is the shift that makes some digital signals dangerous. When a subject begins to speak of martyrdom, paradise, revenge against unbelievers, defence of the Ummah, the blood of Muslims, the punishment of Christians, or the need to “do something,” it isn’t necessarily planning an attack. Still, it’s entering a language that can justify the action.
Martyrdom reduces the psychological cost of violence. It allows the individual to reinterpret their death, arrest, or marginalisation as a success. Particularly for vulnerable, isolated, or frustrated young people, martyrdom offers a shortcut to identity: from peripheral individual to fighter, from personal failure to religious proof, from social invisibility to symbolic recognition. This doesn’t mean that all radicalised individuals are psychologically unstable. It does mean that the jihadist framework can exploit personal vulnerabilities and convert them into operational readiness.
The most dangerous sequence occurs when these elements combine: intensive consumption of propaganda, public escalation on social media, interactions with sympathisers or facilitators, praise of recent attacks, the language of martyrdom, the choice of a low-tech method, and ambiguous or explicit declarations of imminence. At this stage, the gap between ideation and action can be minimal. A family argument, a humiliation, news from Gaza, an arrest in Europe, an ISIS video, a discussion with a recruiter, or seeing a previous attack can act as triggers.
Operationally, the most likely pattern involves five stages.
First, exposure. The individual comes into contact with jihadist or para-jihadist content, often through open platforms, re-shared accounts, short videos, memes, sermons, content about Muslim suffering, anti-Western or anti-Christian narratives.
Second, identification. The individual no longer simply watches. They begin sharing, saving, commenting, imitating aesthetics, using symbols, editing bios, following extremist accounts, and expressing religious or political hostility.
Third, consolidation. The trajectory shifts toward more closed channels—Telegram, private groups, direct chats, propaganda channels, and contacts with more radical individuals. Here, ideological density increases and exposure to dissent decreases.
Fourth, availability. The individual begins to speak of action, martyrdom, attack, defence of Islam, revenge, targeting Christians, police, military, Jews, Western civilians, or symbolic places. They may ask for advice, search for material, record videos, prepare messages, erase traces, or purchase trivial tools.
Fifth, action or disruption. The attack is carried out with a knife, vehicle, or other simple means, or is interrupted by the authorities in the immediately preceding phase.
The critical point is that the first three stages can appear ambiguous and glossed over by freedom of expression, provocation, immaturity, or discomfort. But in the fourth stage, the remaining time can be very short. The challenge for intelligence and law enforcement is therefore to construct cumulative, not atomistic, assessments. A single post can be noise. A post, plus a Telegram contact, plus a praise of martyrdom, plus a reference to a knife, plus a remark of imminence, plus account deletion, is another matter.
In Italy, this reading is essential. Recent cases should not be interpreted merely as separate judicial episodes. They should be read as indicators of a possible normalisation of low-tech repertoire in the domestic radicalised pool. The risk is not that all online sympathisers will take action. That would be an incorrect conclusion. The risk is that, within a broader audience of propaganda consumers, a small but sufficient number develop intent, target selection, and timing.
The communicative dimension of the attack is just as important as the physical dimension. A stabbing or a car crash doesn’t just seek victims. They seek visibility, fear, polarisation, imitation, and recognition. Even an attack with limited damage can have a strategic effect if it is absorbed by the jihadist information ecosystem and relaunched as proof that ISIS is still alive in Europe. In this logic, every action also involves content. Every arrest can become propaganda. Every trial can become narrative martyrdom.
This is why the state’s communicative response matters. Media overexposure, excessive detail about the attacker’s methods and profile, sensational headlines, and repetition of the attacker’s name can increase the potential for imitation. At the same time, minimising or dismissing the ideological motive too quickly can prevent a proper understanding of the risk. The best response is sober, precise, and factual: recognise the underlying cause when there are elements involved, avoid amplification, protect sensitive operational details, and explain the risk without panic.
The assessment for the next 30-60 days is that the most likely modus operandi in Europe remains knife attacks or vehicle ramming, with possible opportunistic targets.
The Online Acceleration Problem
The central problem is not simply that radicalisation occurs online. This has been known for years. The current problem is that the digital environment compresses time, lowers thresholds, shortens the distance between propaganda and action, and makes it more difficult to distinguish promptly among ideological consumption, provocation, symbolic belonging, and operational availability.
Online acceleration works because it combines three elements: continuous exposure, algorithmic reinforcement, and migration to closed spaces. TikTok, Instagram, and mainstream platforms act as entry surfaces. Telegram, private chats, and encrypted channels act as spaces of consolidation. The individual is not necessarily born within an extremist channel. They can arrive there after a progressive trajectory made up of content about war, Muslim victimisation, Gaza, anti-Westernism, images of martyrdom, militant aesthetics, sermons, memes, short videos, and approving comments.
This is the most important point: contemporary radicalisation no longer requires prolonged ideological immersion in traditional jihadist environments. It can start with emotionally powerful, politically ambiguous, or seemingly inoperative content. The shift from anger to jihadist identification occurs when the individual finds a framework that organises everything: the world is hostile to Islam, the West is the enemy, Muslims are under attack, violent action becomes defence, martyrdom becomes success. From that moment, propaganda no longer needs to convince from scratch. It simply needs to address an already active frustration.
European data confirms this transformation. Jihadism remains the most dangerous form of terrorism in the EU, and the majority of terrorism arrests still involve jihadism. The most relevant data for this analysis are the combination of lone actors, digital propaganda, and young individuals, because it reduces dependence on structured networks and increases the difficulty of prevention.
The Dutch case of February 2026 is a very concrete indicator. Authorities arrested 15 people suspected of spreading Islamic State propaganda on TikTok, inciting terrorist crimes, and, in some cases, participating in a terrorist organisation. Some posts reportedly exceeded 100,000 views, and even minors were among the suspects. This shows that the platform is not just a place for consumption but also for amplification, soft recruitment, and imitative pressure.
The dynamic is dangerous because TikTok and Instagram don’t function like old jihadist forums. They don’t require active research, passwords, trust networks, or prior ideological affiliation. Content is delivered based on user affinity, emotion, engagement, and behaviour. If a young person watches videos about war, humiliation, religion, violence, or identity, the ecosystem can push them toward increasingly extreme content. A recruiter isn’t needed in the initial phase. The algorithm can act as a cognitive accelerator. The recruiter, or the most radical sympathiser, comes later.
This evolution is documented in the European context, linking platforms like TikTok and Instagram to the radicalisation of lone attackers after October 7, 2023. These platforms accelerate exposure, imitation, belonging, and the normalisation of violence, especially among young people already vulnerable to narratives of revenge or victimisation.
The second component is platforms like Telegram, Signal, and similar. They should not be described as simple propaganda channels. They are an infrastructure of continuity. They enable the archiving of materials, reposting after removals, the creation of backup channels, direct contact, micro-communities, transfer to private chats, and the dissemination of videos, claims, manuals, manipulated religious texts, nasheeds, posters, and behavioural instructions. Where TikTok and Instagram attract, Telegram and other platforms stabilise. Where short-form content generates emotion, Telegram and similar platforms provide ideological density.
The operational problem arises when the subject shifts from consumption to relationship. Watching propaganda is one thing. Another is searching channels, commenting, saving material, requesting contacts, migrating to Telegram, speaking with a facilitator, receiving encouragement, discussing an attack, registering a pledge, or preparing a message. The transition can be rapid and not always visible from the outside. This is the heart of acceleration: the time between identification and operational readiness can become too short for a standard response.
The problem doesn’t just concern adults already involved in militant networks. Still, adolescents and young people with rapid digital trajectories are often oriented towards low-tech methods and a strong imitative component.
Young people are particularly vulnerable for four reasons: greater digital immersion, greater susceptibility to social validation, a still-unstable identity, and a reduced ability to assess real consequences. Jihadist propaganda exploits these factors precisely: it offers belonging, status, a mission, an enemy, moral purity, and the promise of recognition. For an isolated, frustrated, or marginalised individual, this can be more powerful than lengthy doctrinal indoctrination.
The transition from content to behaviour often occurs through digital leaks. Before the action, many individuals leave traces: praise of previous attacks, martyrdom language, farewell phrases, allusions to “doing something,” images of knives, references to vehicles, sudden changes in bio, deletion of content, opening new accounts, sharing nasheeds, hostility toward Christians, Jews, the police, the military, or “unbelievers.” Taken individually, these signals can be noise. In sequence, they become a risk profile.
The most serious analytical error would be to wait for a formal operational order. At this stage, the order may never arrive. The actor can activate himself after sufficient exposure, validation, and imitation. Contemporary digital jihadism doesn’t always need to be directed. It can suggest, legitimise, celebrate, and allow the actor to complete the final stretch on his own. This produces a more resilient threat model because it doesn’t depend on a single chain of command.
For Italy, this point is crucial. Recent cases show that the risk doesn’t arise only from deep clandestine channels. It also arises from the combination of open platforms, ISIS propaganda, messaging contacts, references to martyrdom, and the availability of simple methods. A radicalised young person can be intercepted on Instagram or TikTok in the expressive phase, but becomes much more dangerous when he migrates to Telegram or private chats. The challenge is recognising the moment when ideological expression becomes an operational trajectory.
The Israeli-Palestinian conflict, and the Gaza narrative more generally, acts as a thematic accelerator. Not because every pro-Palestinian mobilisation is jihadist—that would be false and analytically incorrect. But because the jihadist ecosystem exploits images of civil suffering, moral outrage, and anti-Western polarisation to channel anger into a violent religious framework. The same image can be used in different political environments, but in the jihadist circuit, it is reinterpreted as evidence of the obligation to seek revenge.
Jihadist propaganda works precisely on this conversion: from victim to avenger. The subject must not only feel anger. They must be convinced that anger has a sacralized solution. This is the breaking point. When the narrative shifts from “Muslims suffer” to “I must strike here,” radicalisation is no longer merely ideological. It is pre-operational.
Online acceleration also changes the concept of target selection. In the past, a target could be chosen based on strategic value, planning, accessibility, and instructions received. Today, for a low-tech actor, the target can be opportunistic: a station, a patrol car, a church, a synagogue, a crowded street, a public event, a club, a shopping mall. Propaganda provides the general framework, but the location can be chosen at the last minute. This increases unpredictability.
The imitative dimension is equally central. An arrest, an attack, a claim of responsibility, a news item, or a video can produce a replication effect. The perpetrator doesn’t need detailed instructions. It’s enough to see that someone else has acted. Imitation lowers the psychological threshold, especially when the gesture is interpreted as martyrdom or a demonstration of loyalty. In this sense, every European case becomes potentially transnational. An attack in Switzerland can influence a perpetrator in Italy. An arrest in Spain can become a narrative of persecution. A Dutch video on TikTok can reach users in multiple countries.
The problem for authorities is that platforms generate volume: too much content, too many accounts, too many languages, too many ambiguous signals. The point is not simply to remove content. Removal is necessary but insufficient. We need to understand trajectories: those who move from consumption to production, from production to contact, from contact to pledge, from pledge to preparation. The unit of analysis should not be the single post, but the behavioural sequence.
The public response must avoid two opposing errors. The first is digital panic: treating every radical piece of content as an imminent threat. This saturates the system and produces false positives. The second is underestimation, that is, viewing online content as adolescent outbursts or propaganda with no physical impact. European cases demonstrate that some digital trajectories reach the attack threshold. Not all, but enough to make the problem a priority.
For analysts, the most relevant indicators are cumulative. A sudden increase in the frequency of extremist content. A shift from generic content to explicit jihadist content. Use of martyrdom vocabulary. Praise for recent attacks. Interest in knives, vehicles, stations, police, or places of worship. Searching for contacts on Telegram. Changing accounts or migrating to closed channels. Phrases of imminence. Recording videos. Requests for religious justification. Breaking up with family or school and preparing final messages. None of these signals is decisive in itself. Their sequence is the data.
The key point is that online is not a dimension separate from the attack. It is part of the attack before the attack. It constructs the perpetrator’s identity, selects the audience, provides language, normalises the method, offers precedents, produces validation, and prepares the post-event narrative. A knife attack or vehicle ramming does not necessarily begin the moment the perpetrator picks up the weapon or gets into the car. They often begin when the perpetrator publicly or privately accepts the idea that the act is right, necessary, and salvific.
The assessment for Italy and Europe is therefore clear: online risk is no longer a subset of propaganda. It is a structural component of the threat. Propaganda isn’t just used to recruit fighters for a foreign theatre. It’s used to transform local individuals into minimal operational vectors. ISIS mustn’t directly control every actor. It must maintain an ecosystem capable of generating availability.
The final verdict is clear. The Online Acceleration Problem is the true multiplier of the European threat. Without this acceleration, many individuals would remain marginal consumers of propaganda. With this acceleration, some of them could become operational risks in a short time. Therefore, in the short term, prevention must focus less on targeting large networks and more on the timely identification of digital trajectories that are entering the phase of availability for violence.
Forecast 60 – 90 Days
Over the next 60 to 90 days, the most likely scenario in Italy and Europe is a continuation of preventive arrests, searches, expulsions, precautionary measures, and investigations of individuals radicalised online, especially young people, linked to jihadist propaganda, TikTok/Instagram content, and martyrdom rhetoric.
The main risk is not a coordinated 2015-2017-style campaign. The main risk is a sequence of jihadist micro-trajectories that are difficult to predict, with individuals rapidly transitioning from consuming propaganda to becoming operationally available. The threat remains tactical, urban, decentralised, and low-tech.
The most likely scenario is this: more similar cases in Brianza, Reggio Emilia/Bologna, Spain, Austria, and the Netherlands. Young individuals, jihadist propaganda, encrypted messaging, martyrdom content, contacts with sympathisers or facilitators, interest in knives, vehicles, public places, police, military, Christians, Jews, or Western civilians. Many will be intercepted before the attack. This does not reduce the risk. Indeed, it confirms the mobilisation pool.
The most dangerous scenario is a successful knife or vehicle attack in a European city. In Italy, the most plausible profile is an individual actor, radicalised online, already visible for extremist content, who decides to attack an accessible target: a military or police patrol, a station, a square, a church, a synagogue, a pedestrian zone, a public event, a tourist site, or a commercial space. The physical damage may be limited, but the psychological and media impact would be significant.
The probability of complex attacks involving explosives or firearms remains lower in the short term, unless more robust indicators emerge: procurement, technical contacts, money transfers, operational instructions, precursor materials, criminal connections, or experienced facilitators. Today, the core of the threat remains simpler: a bladed weapon, a vehicle, an opportunistic target, a message of martyrdom, and online amplification.
Italy should be considered to be in a phase of high exposure, but not in a systemic emergency. The point is not that the country is the main European target. The point is that Italy today presents three simultaneous vulnerabilities: the presence of recent cases, the accessibility of symbolic and urban targets, and exposure to transnational digital radicalisation. Rome, Milan, Bologna, Turin, Naples, Reggio Emilia, and the metropolitan areas of the North deserve priority attention, not because they are “jihadist zones,” but because they concentrate mobility, visibility, symbols, infrastructure, communities, and soft targets.
In the next two to three months, the risk will increase in conjunction with public events, religious holidays, political demonstrations, high-tension pro-Palestine protests, news stories perceived as anti-Muslim, military operations in the Middle East, new jihadist propaganda campaigns, or successful attacks in other countries. The trigger may be local, but the mobilisation can be transnational.
The operational judgment is clear: the most likely risk is disruption, the most serious risk is a successful low-tech attack. The decisive variable will be time. If the subject shifts from propaganda to action within hours or days, even an efficient prevention system can be too late.
Indicators to Watch
The indicators to monitor should not be read individually. The analytical value comes from the sequence. An extremist post can be noise. An extremist post followed by a Telegram contact, martyrdom language, praise of a recent attack, and references to knives or vehicles is a different profile.
The first indicator is linguistic escalation. A shift from general religious or political content to explicit hostility against Christians, Jews, “unbelievers,” the police, the military, Italy, Europe, the West, or “enemies of Islam.” The critical factor is the change in intensity, not the individual phrase.
The second indicator is martyrdom framing. References to shahada, paradise, sacrifice, revenge, the blood of Muslims, religious duty, the need to “do something,” the desire to die a martyr, farewell phrases, video testaments, images of ISIS flags, or content celebrating previous attackers.
The third indicator is imitation. Praise for Modena, Winterthur, the French attacks, Vienna, London, Brussels, the Bataclan, Nice, or other European cases. When someone doesn’t simply comment on an attack but presents it as an example to follow, the risk changes.
The fourth indicator is digital migration. The shift from TikTok, Instagram, or Facebook to Telegram, WhatsApp, Signal, and Rocket.Chat, Element, or other closed channels. Migration is not evidence of an attack, but rather indicates a desire to enter a more protected, ideologically dense space, less exposed to moderation.
The fifth indicator is the relationship with facilitators. Contacts with individuals who encourage, validate, offer advice, request videos, solicit pledges, promise money, suggest targets, discuss travel, or talk about “action.” This is one of the most sensitive indicators. The individual is no longer just a consumer of propaganda.
The sixth indicator is interest in low-tech methods. Knives, cars, vans, stations, crowded places, churches, synagogues, patrols, barracks, institutional headquarters, public events. Even banal searches can take on value when combined with ideology, timing, and declarations of intent.
The seventh indicator is temporal compression. Phrases like “soon,” “the time has come,” “I’ll do what I have to,” “I can’t wait any longer,” “everything changes today,” or sudden cancellations, account closures, family isolation, drastic changes in routine. Here, the risk is the imminent transition.
The eighth indicator is polarisation over Gaza or other Muslim theatres transformed into a local operational obligation. Not every mobilisation in Gaza is jihadist radicalisation. But when the narrative becomes “strike here to avenge there,” the ideological shift is serious.
The ninth indicator is behavioural disruption. Sudden abandonment of school, work, or family, isolation, aggression, radical change in friendships, militant religious obsession, violent rejection of the social environment, increased digital secrecy, use of multiple accounts or secondary devices.
The tenth indicator is the independent production of propaganda. Not just sharing, but also the creation of videos, posters, messages, translations, subtitles, repost accounts, celebratory content, or threats. Those who produce propaganda are often more involved than those who consume it.
Policy and Security Implications
The first implication is that prevention must shift from the logic of the cell to the logic of the trajectory. Targeting only structured groups is no longer enough. The most likely threat comes from small, mobile, digital, hybrid actors, with weak ties but sufficient to generate action.
The second implication is that online monitoring must become more behavioural and less content-based. Counting extremist posts isn’t enough. We need to understand the sequence: exposure, identification, migration, contact, martyrdom, method, target, imminence. Individual evidence says little. The chain says a lot.
The third implication concerns platforms. TikTok, Instagram, and Telegram must be treated as different parts of the same ecosystem. Open platforms are often the gateway. Telegram and private chats are often the consolidation. The response must address both phases: removal, tracking, preservation of evidence, identification of relaunch networks, and faster cooperation with authorities.
The fourth implication concerns Italy. Greater integration is needed between intelligence, DIGOS (Italian Special Operations Unit), postal police, counterterrorism, prosecutors, schools, local services, and local communities. The point is not to engage in indiscriminate surveillance. The point is to build early-warning channels when serious signs emerge: martyrdom, ISIS, contacts, threats, interest in bladed weapons or vehicles, and behavioural disruptions.
The fifth implication concerns public communication. We must avoid both minimisation and hysteria. Minimisation weakens understanding of the risk. Hysteria amplifies the jihadist message. The correct approach is: precise information, few operational details, no glorification of the attacker, no spectacularization of the method, and clear recognition of the origins when the evidence allows.
The sixth implication concerns soft targets. Transportation, religious sites, public events, tourist areas, patrols, and pedestrian areas must be viewed as opportunistic targets. There is no point in militarising cities. We need to increase visible deterrence capacity, behavioural control, rapid response, training for both public and private personnel, and simple procedures for reporting anomalous behaviour.
The seventh implication concerns the management of radicalised minors and young adults. Here, a purely repressive response often comes too late. Hybrid tools are needed: monitoring, family intervention, psychological support, selective deradicalisation, judicial oversight when necessary, expulsion where applicable, preventive measures for non-citizens, and effective follow-up after the initial intervention.
The seventh implication concerns the management of radicalised minors and young adults. Here, a purely repressive response often comes too late. Hybrid tools are needed: monitoring, family intervention, psychological support, selective deradicalisation, judicial oversight when necessary, expulsion where applicable, preventive measures for non-citizens, and effective follow-up after the initial intervention.
The eighth implication concerns the relationship between mental health and terrorism. The presence of psychological fragility should not automatically rule out ideological factors. In contemporary cases, ideology and instability can coexist. The correct question is: has jihadist propaganda provided language, a target, justification, or a model for action? If so, the terrorist dimension remains relevant.
The ninth implication concerns the risk of imitation. After every arrest or attack, a 7- to 21-day window of vulnerability should be expected, during which others may react, celebrate, threaten, or attempt to emulate them. This is especially true when the case receives heavy media coverage or circulates through jihadist channels.
The tenth implication concerns European cooperation. These cases are not national. They are local in their execution, transnational in their ecosystem. Italy, Spain, Austria, Switzerland, the Netherlands, France, Germany, and the United Kingdom must interpret these events as interconnected signals. The same narrative, video, channel, or facilitator can span multiple jurisdictions.
The final verdict is clear: in the next 60-90 days, the priority is not to seek out the “large jihadist conspiracy.” The priority is to intercept the small actor before it becomes operational. The threat is lower in sophistication, but higher in speed. This is the real problem for Italy and Europe.
Final Analytical Line
The reemergence of a large-scale external operational structure of jihadism does not define the current jihadist threat environment in Europe. It is defined by the persistence of an ideological ecosystem capable of generating mobilisation without direct command, operational intent without organisational affiliation, and violence without sophisticated preparation.
Recent cases in Italy, Spain, Austria, Switzerland, and the Netherlands point to the same underlying reality. The centre of gravity has shifted from structured networks to accelerated individual pathways. Radicalisation is increasingly digital, mobilisation is increasingly personal, and attack planning is increasingly compressed. The operational challenge is no longer identifying large-scale conspiracies, but recognising when a seemingly fragmented process is approaching the threshold of violence.
For Italy, the primary concern is not the existence of a nationwide clandestine jihadist infrastructure. The primary concern is the convergence of three factors: a persistent online propaganda environment, the availability of low-tech attack methods, and a pool of young people exposed to narratives of martyrdom, resentment, and ideological vengeance. In this context, even a small number of mobilised actors can generate disproportionate security, political, and psychological effects.
The most significant development observed in recent months is the growing role of digital acceleration. Social media platforms, encrypted messaging apps, and transnational ecosystems of supporters are narrowing the gap between ideological exposure and operational readiness. The result is a threat landscape in which warning indicators may still exist, but the time available to identify, assess, and counter them is shrinking.
This does not indicate an imminent wave of large-scale attacks across Europe. The available evidence does not support such an assessment. What it does indicate is a continuing risk of low-complexity but high-impact incidents, perpetrated by individuals requiring minimal resources, limited logistical support, and only a short window of opportunity to decide whether to act.
The strategic danger lies precisely in this asymmetry. A weakened organisation can still inspire violence. A broken network can still spawn imitators. A failed plot can still become a model. The cumulative effect of repeated arrests in several European countries suggests that security services are successfully intercepting a significant number of trajectories before execution. At the same time, these interventions reveal a broader mobilisation context that remains active, adaptable, and geographically dispersed.
The central intelligence assessment is therefore clear: Europe is entering a phase in which the jihadist risk is becoming less hierarchical, less visible, and more behaviorally driven. The threat is less organizationally complex than it was ten years ago, but potentially more difficult to predict tactically. For Italy, the decisive variable in the coming months will not be the strength of the Islamic State as an organisation, but rather the authorities’ ability to identify and stop the next individual who moves from online engagement to physical action before that transition is complete.
🔒 Executive Intelligence Cycle
This assessment is part of a broader analytical cycle.
Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.
© Daniele Garofalo Monitoring - All rights reserved.
Daniele Garofalo is an independent researcher and analyst specialising in jihadist terrorism, Islamist insurgencies, and armed non-state actors.
His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.
ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874



