Cover & Classification Note
Document Type: Executive Intelligence Briefing
Scope: Global Jihadist, Insurgent & Hybrid Warfare Threat Assessment
Time Horizon: Rolling Forecast (30–90 Days)
Reference Period: September- November 2026.
This document is an independent analytical product intended for professional use by analysts, policy planners, security practitioners, and decision-makers.
Intended Audience & Use
This Executive Intelligence Briefing is intended for use by intelligence analysts, policy planners, military and security decision-makers, international organisations, and applied academic researchers concerned with the threat dynamics of jihadist, insurgent, and hybrid warfare.
The document supports strategic awareness, forward-looking risk assessment, and prioritising monitoring over a rolling 30–90-day horizon. It is not intended to provide tactical-level tasking, real-time operational guidance, or event-specific prediction. Use the briefing as a decision-support and situational-awareness tool to inform planning, posture adjustment, and analytical focus, not immediate response.
📌 Inside this Executive Intelligence Briefing
This briefing includes:
Executive Overview – Strategic Context
Key Judgments
Global Threat Posture
Global Structural Assessment
Africa, Middle East & Asia, Transnational Networks & Secondary Threat Environment.
Operational Actor Assessment
Africa: ISWAP, IS-Sahel, IS-Somalia, ISM, ISCAP, JNIM, al-Shabaab, Boko Haram, Lakurawa.
Middle East & South Asia: IS Syria/Iraq, AQAP, AQIS, ISKP, ISPP, ISEAP, TTP, Ittehad-ul-Mujahidin Pakistan.
Cognitive & Hybrid Battlespace
Narrative Competition and Strategic Legitimacy, Al-Qaeda’s Wider Narrative Adaptation, Palestine as a Cross-Ecosystem Mobilisation Narrative, Capability Dissemination and Operational Enablement, Digital Ecosystem Evolution, Iranian-Aligned Cognitive and Digital Architecture, Ansar Allah and the Weaponisation of Strategic Geography, Hamas and Post-Conflict Cognitive Survival.Forward Assessment (30–90 Days)
Forecast Framework, Europe and the Western Threat Environment, Hybrid Actors and European Strategic Exposure, Strategic Risk Assessment, Escalatory Scenario, Strategic Shock Scenario, Early Warning Indicators.Strategic Risk Assessment
Strategic Risk Hierarchy, Escalation Triggers, Cross-Theatre Risk Interaction, Executive “So What?”
Intelligence Monitoring
Priority Indicators, Key Intelligence Questions.
Confidence, Assessment & Intelligence Gaps
This assessment is produced with moderate to high confidence regarding structural trends, theatre-level operational logic, tempo modulation patterns, and the most likely 30 to 90-day trajectories, based on systematic analysis of incident data, propaganda monitoring, and pattern continuity across regions to ensure methodological transparency.
Confidence is highest in assessing Africa as the primary kinetic centre of gravity, Pakistan as a high-endurance attrition theatre, and the broader ecosystem’s reliance on below-threshold operational logic, while acknowledging that intelligence gaps in remote or contested areas introduce moderate confidence levels.
Key limitations remain:
In some theatres, especially remote or contested areas, incident visibility is structurally uneven.
Quiet months or reduced media output may reflect risk management and force preservation rather than degradation. Conversely, concentrated claim density may serve reputational objectives without a proportional increase in kinetic expansion.
Assessments of intent are based on pattern analysis, target-selection logic, propaganda framing, and behavioural shifts rather than confirmed insider access.
The dissemination of training material, UAV manuals, and cumulative infographics signals capability socialisation, but the conversion rate from dissemination to operational activation is difficult to measure in advance.
Attribution ambiguity in decentralised ecosystems complicates the accurate linking of online enablement, local facilitation networks, and offline incidents, particularly in transnational secondary environments.
These gaps do not alter the central assessment of continuity, resilience, and distributed attritional logic. They reinforce the need to prioritise qualitative shifts over quantitative fluctuations, including changes in target class, geographic clustering, claim behaviour, technical enablement signals, and evidence of HUMINT degradation.
Ongoing monitoring should therefore focus less on monthly totals and more on behavioural anomalies, corridor reactivation, escalation in target salience, and the intersection between cognitive signalling and operational execution.
Methodological Note
This briefing is based on:
systematic monitoring of primary jihadist propaganda (statements, videos, magazines, claims);
analysis of reports from field sources, local media, and military publications/statements
analysis of OSINT, IMINT, Digital HUMINT, and SOCMINT
comparative temporal analysis to distinguish short-term variation from structural trends;
explicit separation between observation, assessment, and judgment.
Forecasting judgments are probabilistic, not predictive, and are designed to inform preparedness and decision-making rather than to anticipate specific events.
Scope Exclusions
This briefing operates within clearly defined analytical boundaries.
It does not include classified, law-enforcement–sensitive, or restricted government information, and is based exclusively on open-source intelligence and structured analytical assessment.
It does not assess domestic extremism in Western states except where relevant to transnational jihadist cognitive and influence dynamics.
It does not attempt to predict specific attacks, timelines, or targets; instead, it focuses on probabilistic trends, threat configurations, and early warning indicators.
It does not provide policy prescriptions or normative recommendations, limiting its scope to assessment, implications, and monitoring priorities.
Executive Overview – Strategic Context
The global jihadist, insurgent and hybrid threat environment entering September–November 2026 is characterised by operational resilience, selective acceleration and increasing threat density rather than a single systemic escalation.
Africa remains the principal centre of gravity. JNIM has demonstrated exceptional surge capacity across the central Sahel and is increasingly positioned to convert military persistence into economic and political pressure. Al-Shabaab has recorded the strongest recent operational acceleration, expanding from 48 attacks in June to 152 in August while simultaneously increasing activity in Kenya. Islamic State’s African provinces have declined in aggregate activity but retain substantial geographic resilience across Nigeria, eastern DRC, Mozambique, Somalia, Niger and Cameroon.
Pakistan represents the most intense counter-state insurgency environment. TTP’s 406 attacks in August confirm that exceptionally high operational tempo has become structural, while IMP adds a secondary layer of pressure against many of the same security institutions. The principal escalation mechanism remains the Afghanistan–Pakistan border, where a major militant attack and subsequent cross-border retaliation could rapidly expand a domestic insurgency into a wider political and security crisis.
Syria remains strategically important despite limited Islamic State attack volume. The principal concern is clandestine regeneration during political and security transition rather than renewed territorial control. Urban facilitation, detention instability and selective attacks against politically consequential targets would provide more meaningful indicators of Islamic State recovery than aggregate attack statistics.
Europe has become the priority external threat environment. Recent counterterrorism cases indicate continued movement by a limited number of subjects from ideological exposure toward technical research, external training intent, reconnaissance and attack preparation. There is insufficient evidence of a restored centrally directed jihadist campaign against Europe. The more immediate threat comes from self-initiated actors, micro-networks and partially facilitated individuals whose operational development may occur largely within digital environments.
Europe simultaneously faces persistent hybrid pressure. Russia-linked sabotage and hostile intelligence activity increasingly rely on deniable methods, low-cost technologies and disposable intermediaries. Iranian-aligned networks retain a separate latent external capability whose activation will depend heavily on escalation in the Middle East. These threat systems remain organisationally distinct, but their simultaneous presence creates growing pressure on European intelligence and protective-security resources.
The information environment increasingly operates as a capability layer across these theatres. JNIM integrates communications with insurgent legitimacy and governance. Al-Qaeda-aligned networks exploit Gaza, Iran, Yemen and other conflicts to maintain ideological coherence. Islamic State supporters continue distributing attack-enabling material. Hezbollah, Ansar Allah and Iranian-linked structures combine information activity with deterrence, proxy warfare and strategic coercion.
The 90-day outlook therefore favours continuity with selective escalation. The most consequential development would not necessarily be an increase in global attack numbers. It would be evidence that persistent activity is beginning to generate durable strategic effects: restricted state access in the Sahel, degraded Pakistani local intelligence, structured external facilitation into Europe, urban Islamic State regeneration in Syria, or sustained hybrid disruption of European critical infrastructure.
Key Judgments
Africa will remain the principal global centre of gravity of jihadist insurgency through November. Confidence is High. The central Sahel, Somalia, Lake Chad, eastern DRC and northern Mozambique contain resilient organisations capable of maintaining military activity despite persistent counterterrorism pressure. The primary strategic deterioration risk is increasingly the erosion of state access and local security architecture rather than conventional territorial conquest.
JNIM is evolving toward a more politically consequential insurgent model. Confidence is High. Its July surge and sustained August activity demonstrate force-generation capacity. Still, its longer-term significance lies in combining military attrition with economic pressure, information warfare, coercive governance and progressive restriction of state movement.
Al-Shabaab currently displays the strongest upward operational trajectory among major African jihadist actors. Confidence is High. The increase from 48 attacks in June to 152 in August, accompanied by expanding Kenyan activity, indicates substantial operational depth. Whether August represents a durable new baseline remains uncertain.
Pakistan will remain the highest-tempo counter-state insurgency environment. Confidence is High. TTP’s operational density is now structural, while IMP compounds pressure against the same military, police and intelligence ecosystem. The principal strategic risk is escalation across the Afghanistan–Pakistan border following a major militant attack.
Islamic State remains resilient despite uneven regional trajectories. Confidence is Moderate–High. Declining aggregate activity in Africa and limited attacks in the Middle East do not demonstrate systemic degradation. The organisation operates multiple geographically separated systems and a transnational information architecture that supports regeneration and external mobilisation.
Europe is now the priority external jihadist threat theatre. Confidence is Moderate–High. The principal concern is not evidence of a centrally directed campaign but the accumulation of cases involving increasingly operational behaviours. Continued arrests are likely to exceed successful attacks, but this reflects both active mobilisation and effective disruption, not an absence of threat.
The Western jihadist threat is becoming more behaviourally significant while remaining organisationally fragmented. Confidence is Moderate–High. Digital radicalisation, younger subjects, ideological hybridisation, technical material and transnational online interaction are shortening the distance between propaganda consumption and attack preparation.
Hybrid pressure against Europe will persist below the threshold of conventional conflict. Confidence is High. Sabotage, reconnaissance, cyber operations and recruitment of intermediaries offer hostile states significant strategic effects while preserving ambiguity and limiting escalation risk.
The cognitive domain is increasingly inseparable from operational capability. Confidence is High. Information operations are being used not simply to publicise violence but to shape legitimacy, distribute knowledge, mobilise supporters, sustain organisational resilience and influence adversary decision-making.
The principal strategic risk for September–November is cumulative rather than convergent. Confidence is High. There is no evidence that jihadist organisations, Iranian-aligned actors and hostile states are forming a common operational system. The risk derives from their ability to impose simultaneous pressures on different parts of the same security architecture.
Global Threat Posture
September–November 2026
The global threat posture is assessed as Very High, with substantial regional variation and no indication of uniform worldwide escalation.
Central Sahel: Very High / Increasing. JNIM remains the principal driver. The threat increasingly derives from strategic isolation, economic disruption, territorial influence, and attacks against the security architecture rather than attack volume alone.
Somalia and Kenya: Very High / Increasing. Al-Shabaab’s August acceleration and simultaneous increase in Kenyan operations constitute the clearest short-term deterioration signal in East Africa.
Lake Chad Basin: Very High / Stable. ISWAP remains the dominant structured threat while Boko Haram/JAS retains meaningful local resilience. Persistent military pressure has not eliminated either ecosystem.
Eastern DRC: Very High / Stable–Increasing. ISCAP retains operational depth across Ituri, Haute-Uélé and North Kivu. Civilian targeting and geographic persistence remain central indicators.
Northern Mozambique: High / Stable–Increasing. Lower attack numbers conceal geographic elasticity. Foreign commercial interests and expanding operational geography remain strategically important.
Northwestern Nigeria: High / Increasing. Lakurawa-associated violence and the wider interaction between jihadist militancy, border insecurity and armed economies warrant elevated monitoring. Attribution and organisational relationships remain less certain than in established theatres.
Pakistan: Critical / Increasing. TTP’s August tempo, IMP activity and the vulnerability of local security structures create the highest-volume insurgent environment currently monitored. Cross-border escalation with Afghanistan remains the primary strategic trigger.
Afghanistan: High / Stable. Direct attack volume is lower, but ISKP capability, militant sanctuary questions and the relationship between Afghanistan and Pakistani insurgent networks preserve substantial regional significance.
Syria: High / Stable–Increasing. Official Islamic State claim volume remains low, but this may significantly understate actual activity. Recent incidents and previous UN assessments indicate that IS has deliberately left attacks unclaimed to preserve operational security and conceal network depth. The principal risk is therefore clandestine urban regeneration rather than visible quantitative escalation.
Iraq: Medium / Stable. Islamic State retains residual capability but currently lacks indicators of sustained strategic recovery. Syrian spillover remains the principal external variable.
Europe: High / Increasing. The rating reflects persistent jihadist mobilisation, increasingly operational arrest profiles, transnational digital facilitation, and simultaneous exposure to hostile-state hybrid activity. Europe is the principal external security priority for the forecast period.
North America: Medium / Stable. The principal risk remains self-initiated or digitally influenced violence against symbolic, governmental, religious or public targets. Organised external attack architecture remains less visible than in the European threat environment.
Hybrid Threat to Europe: High / Increasing. Sabotage, hostile intelligence activity, cyber operations, critical-infrastructure reconnaissance and use of deniable intermediaries are likely to persist.
Global Cognitive Domain: High / Increasing. Jihadist and state-aligned information ecosystems increasingly integrate narrative warfare with mobilisation, tactical dissemination, coercion and organisational resilience.
Overall Strategic Assessment
The global threat system remains operationally fragmented but strategically cumulative. No jihadist organisation currently possesses the combination of territorial control, transnational command and external operational capability associated with Islamic State at its territorial peak. That comparison, however, increasingly fails to capture contemporary risk.
The present environment is characterised instead by resilient regional insurgencies, decentralised external mobilisation, distributed digital capability and hybrid coercion. These systems can generate significant strategic effects without achieving territorial dominance or organisational centralisation.
The central intelligence judgement for September–November is therefore that the threat is not moving toward a single global centre. It is becoming more distributed, more adaptive and more demanding of simultaneous state response.
Africa and Pakistan will generate most kinetic pressure. Syria will remain a regeneration risk. The cognitive domain will continue connecting local conflicts to transnational audiences. Europe will represent the most complex external security environment because jihadist mobilisation and hostile-state hybrid activity increasingly coexist within the same protective-security space.
The principal indicator of deterioration during the next 90 days will not be a global increase in attacks. It will be evidence that one or more adversaries are converting persistent activity into durable restrictions on state freedom of action, stronger operational facilitation or sustained strategic disruption.
Overall Threat Level: Very High
Trajectory: Increasing
Primary Operational Centres of Gravity: Africa and South-Central Asia
Priority External Threat Environment: Europe
Overall Assessment Confidence: High
1. Global Strategic Environment
Rolling Forecast, September–November 2026
Africa
Africa remains the principal centre of gravity of global jihadist violence, but the threat is becoming more differentiated. The central Sahel, Lake Chad Basin, eastern Democratic Republic of Congo, northern Mozambique and Somalia now represent distinct insurgent systems with different levels of organisational maturity, territorial influence and strategic ambition. The common denominator is no longer simply weak governance. It is the growing capacity of jihadist organisations to exploit political fragmentation, degraded local intelligence, illicit economies and cross-border mobility while progressively integrating military pressure with coercive governance and information control.
The central Sahel remains the most consequential theatre. JNIM has moved beyond the phase in which its strength could be measured primarily through attacks against isolated military positions. The organisation increasingly combines corridor interdiction, economic warfare, pressure against population centres, targeted violence against local auxiliaries and attacks against strategic infrastructure. Its objective is not immediate conventional control of Bamako, Ouagadougou or Niamey. A more realistic interpretation is that JNIM is attempting to reduce the practical radius of state authority, progressively separating national capitals from peripheral regions and making government access dependent on increasingly expensive military protection. The continued use of blockades and pressure against transport and fuel systems supports this assessment.
This trajectory has grown more significant as the group’s financial base has expanded. A ransom estimated at approximately $50 million, reportedly paid in late 2025, appears to have materially strengthened JNIM’s capacity to finance operations and broader al-Qaeda-linked activity. This matters because the organisation is already assessed to field several thousand fighters and does not need to transform the entire ransom into weapons to produce strategic effects. Financing can sustain salaries, compensation to families, logistics, vehicles, procurement, bribery and local political relationships, thereby increasing endurance rather than merely attack volume.
The most important geographic development is the continuing transformation of the Niger, Benin and northwestern Nigeria borderlands. JNIM and Islamic State Sahel Province are increasingly operating across an environment that was previously treated as the southern edge of the Sahelian conflict. That distinction is becoming obsolete. Northern Benin and the wider littoral frontier now form an active security belt in which militants test state responses, establish local contacts and exploit commercial routes linking Sahelian and coastal economies. The threat to Togo and the wider Gulf of Guinea is therefore best understood as progressive operational embedding, not necessarily a sudden southward offensive.
Niger deserves particular attention entering the September–November window. The failed mutiny attempt in Niamey in late August adds a new political variable to an already deteriorating security environment. Even where jihadist organisations are not directly involved in elite military disputes, internal instability creates opportunities by distracting security forces, degrading command confidence and reinforcing narratives of regime weakness. The combination of IS Sahel Province pressure, JNIM reach, insurgent activity near the capital, and political uncertainty increases the likelihood of selective strategic attacks designed to produce political rather than purely military effects.
The Lake Chad Basin remains a separate high-intensity system. ISWAP continues to maintain a more coherent insurgent architecture, while Boko Haram/JAS retains enough manpower, mobility, and territorial familiarity to prevent the conflict from becoming a single-actor contest. The most important development is the durability of violence despite years of sustained Nigerian and regional military pressure. The region has seen a sharp increase in fatalities over the past year, and the broader African trend now exceeds 20,000 militant-Islamist-linked deaths annually for the fourth consecutive year. The Lake Chad Basin, Somalia and the Sahel together account for most of that burden.
Kidnapping remains strategically relevant because it operates at the intersection of terrorism, insurgent finance and governance erosion. Recent estimates indicate that thousands of Nigerians were abducted over twelve months and that substantial ransom revenue accrued to armed groups, with Boko Haram accounting for a disproportionate share of reported payments. The strategic effect extends beyond financing. Persistent abductions disrupt schooling, agriculture, movement and local commerce, while demonstrating that state protection remains unreliable even after repeated counterterrorism campaigns.
Eastern DRC remains one of the most lethal Islamic State-linked environments. ISCAP/ADF continues to exploit a highly fragmented battlespace characterised by weak state reach, regional military intervention, militia competition and large displaced populations. The group’s resilience does not depend on controlling major urban centres. It depends on preserving access to forested sanctuary, rural supply networks and vulnerable communities where civilian massacres generate both fear and displacement. The continued targeting of villages in Ituri and North Kivu demonstrates that violence against civilians remains a deliberate method of territorial influence rather than a by-product of combat.
Northern Mozambique is showing a different pattern. Counterinsurgency pressure around Macomia has forced Islamic State Mozambique elements to shift south and west, but the result has not been simple contraction. It has produced geographic diffusion toward Quissanga, Meluco, Ancuabe, Chiúre, Montepuez and potentially Niassa. This creates a paradox for the Mozambican state: tactical pressure in the insurgency’s core areas can displace rather than eliminate the threat, widening the number of districts requiring military protection and exposing transport, mining and humanitarian corridors.
At the same time, the insurgency continues to cultivate a more selective relationship with communities inside parts of Cabo Delgado. In some coastal areas, reduced indiscriminate violence has been accompanied by religious pressure, coercive regulation and attempts to position the movement as an alternative authority. This is analytically significant. A jihadist organisation that can vary violence according to local political utility is more dangerous than one dependent exclusively on terror. It can combine intimidation with selective legitimacy and use state abuses or weak protection as proof that its own presence is unavoidable.
Somalia remains the most institutionally mature jihadist theatre in Africa. Al-Shabaab retains an advantage that attack statistics cannot adequately measure: embedded governance, taxation, local intelligence, and the ability to exploit political fragmentation. The deepening confrontation around Baidoa and the wider South West political dispute creates the environment in which the organisation has historically performed best. Even where al-Shabaab is not directly responsible for intra-government fighting, disputes among federal authorities, regional actors and local armed constituencies divert security resources and weaken the coherence of counterinsurgency operations.
The key African judgement for September–November is therefore not simply that jihadist violence will remain high. The more serious issue is that multiple organisations can increasingly shape the operating environment beyond the immediate battlefield. JNIM uses economic pressure and strategic reach, ISWAP combines attrition with local governance, ISCAP weaponises civilian vulnerability, IS Mozambique uses geographic diffusion and selective coercion, and al-Shabaab exploits political fragmentation while maintaining institutional depth. The threat is becoming more political without becoming less violent.
Analyst Bottom Line
Africa remains the principal global theatre because jihadist organisations are increasingly capable of transforming military persistence into structural influence. The decisive risk during the next 90 days is not the fall of a national capital, but the progressive reduction of state freedom of movement, intelligence access and economic control across increasingly connected peripheral regions. Current indicators favour continued insurgent consolidation, with the central Sahel and the Niger–Benin–Nigeria border system representing the most important expansion front.
Middle East & Asia
The Middle East and South-Central Asia remain strategically significant for a different reason. The region contains lower aggregate jihadist attack volumes than Africa, but significantly greater potential for interstate escalation, symbolic mobilisation and transnational projection. Pakistan is the main kinetic pressure point, Syria is the most sensitive organisational opportunity space, Afghanistan remains the key sanctuary and cross-border variable. At the same time, Yemen and Iraq preserve latent jihadist infrastructures that can regenerate under changing conditions.
Pakistan now represents one of the clearest examples of sustained insurgent pressure against a functioning state security system. TTP’s campaign has become sufficiently durable that individual monthly fluctuations have limited analytical value. The relevant question is whether repeated attacks are degrading Pakistan’s ability to maintain policing, intelligence coverage and political authority beyond fortified military positions. The August suicide bombing at Kabal in Swat is particularly significant because Swat carries historical and political weight beyond the immediate casualty count. TTP’s ability to strike a police-linked gathering there demonstrates that the insurgency can still generate effects outside its principal Waziristan depth.
The Pakistan–Afghanistan border is now the main escalation mechanism. In early September, Pakistani forces reported killing militants attempting to cross into North Waziristan from Afghanistan, while subsequent operations in Balochistan targeted both TTP-linked militants and separatist actors. Islamabad continues to frame Afghan sanctuary as a decisive driver of domestic instability, while Kabul rejects the accusation. This creates a strategic trap. Pakistan may assess cross-border action as necessary to disrupt militant infrastructure, but repeated strikes risk increasing Afghan political resistance, civilian backlash and retaliatory mobilisation by TTP and aligned actors.
The wider militant architecture compounds the problem. TTP is not operating in isolation. AQIS continues to retain networks in Afghanistan, while the United Nations has assessed that al-Qaeda remains a service provider and multiplier for other militant groups, particularly through training and advice to TTP. Concerns have also persisted regarding AQIS’s interest in external operations and the role of umbrella or associated structures such as Ittehad-ul-Mujahideen Pakistan. This does not imply unified command. It shows how ideological validation, expertise, facilitation, and operational branding can move between organisations without a formal merger.
ISKP remains the most strategically sensitive Islamic State node in the region even when its visible attack volume is lower than TTP’s. Its significance derives from target selection, multilingual propaganda, transnational recruitment and capacity to exploit political shocks. The combination of persistent ISKP pressure, TTP escalation and Afghan sanctuary disputes means that Pakistan faces several distinct threat streams simultaneously, each imposing different intelligence requirements.
Syria is undergoing a potentially more consequential transition. The dissolution and integration of the SDF into the Syrian state architecture removes one of the most important independent counter-IS military structures developed during the previous decade. Integration can ultimately strengthen national coherence, but the transitional phase creates inevitable security gaps, uncertainty over detention responsibilities and changes in local intelligence networks.
The scale of that vulnerability is significant. The most recent UN assessment estimated that Islamic State retains up to 3,000 fighters in Syria and has increasingly shifted away from the central desert toward urban environments, prioritising hit-and-run attacks against religious, political and military targets. The same reporting indicates that several plots targeting President Ahmed al-Sharaa and other senior officials have been disrupted. More importantly, thousands of former al-Hol residents and Islamic State detainees remain unaccounted for after major changes to camps and detention systems. More than one thousand missing individuals are assessed to have joined Islamic State or other armed groups.
This fundamentally changes the Syrian forecast. The primary risk is no longer a return to large territorial formations. It is an urbanised clandestine insurgency capable of combining assassination attempts, attacks against security officials, infrastructure disruption and sectarian provocation. A smaller Islamic State network embedded in transitional urban environments may present a harder intelligence problem than larger desert formations exposed to persistent surveillance.
Political normalisation simultaneously raises the stakes. Washington’s removal of Syria from the state sponsors of terrorism list increases the prospects for investment, financial reintegration and diplomatic consolidation. These gains create new targets for actors seeking to show that the new political order cannot guarantee security. An attack against foreign commercial interests, senior government officials or symbolic reconstruction infrastructure would therefore generate strategic effects far beyond its immediate tactical value.
External military pressure adds another destabilising variable. Israeli strikes against Syrian military sites and continued operations in the south increase friction between Damascus, Israel and Turkey and complicate the Syrian government’s attempt to centralise security authority. These actions do not automatically strengthen jihadist organisations. Still, they expand the narrative space available to Islamic State and al-Qaeda-aligned actors by portraying the new government as unable to defend national sovereignty.
Iraq remains more contained. Islamic State retains residual networks but shows no credible signs of strategic recovery. The main danger is spillover from Syrian instability and renewed exploitation of border corridors rather than autonomous Iraqi resurgence. Yemen similarly remains a latent rather than dominant theatre. AQAP continues to preserve ideological output, local contacts and the organisational memory necessary for reactivation, but the near-term threat remains primarily linked to selective local attacks and transnational incitement rather than sustained territorial expansion.
The wider regional environment is also becoming more volatile because of renewed direct tension involving Iran and the United States. Direct military exchanges at the end of August underline how quickly a broader geopolitical crisis could alter jihadist and proxy calculations. Such confrontation would not automatically produce jihadist alignment with Tehran. Still, it would create new propaganda opportunities, increase pressure on Western assets and potentially activate parallel proxy systems across the region.
Analyst Bottom Line
Pakistan is the principal kinetic theatre, Syria the most important organisational opportunity space and Afghanistan the central escalation variable. The September–November risk is not regional jihadist convergence but simultaneous pressure across several overlapping systems: cross-border militancy in Pakistan, clandestine Islamic State regeneration in Syria, al-Qaeda facilitation networks and geopolitical shocks capable of creating short-lived but high-value operational openings.
Transnational Networks & Secondary Threat Environment
The transnational threat environment entering September–November 2026 deserves greater analytical weight than in previous assessments. Europe and North America are not primary jihadist theatres, but the distinction between core theatre and external environment is becoming progressively less useful for preventive intelligence. A growing body of arrests and disrupted plots indicates that the main external threat has shifted from large, centrally directed networks to dispersed micro-cells, self-initiated actors, online facilitators, and hybrid networks that can progress rapidly from ideological exposure to operational behaviour.
The European picture is increasingly defined by fragmentation. The latest EU terrorism assessment records 45 terrorist attacks across ten Member States, including 22 completed attacks, 20 foiled attempts and three failed incidents. Of 486 terrorism-related arrests, 71 % involved jihadist offences. The more important qualitative finding is that digital environments are widening the pool of potential perpetrators, including individuals whose identity may combine jihadist material, other extremist content, violent subcultures and personal grievance rather than following a traditional linear ideological pathway.
This matters because the observable warning cycle is shortening. European security services increasingly face suspects with limited or no previous physical connection to established extremist milieus. The August arrest of a 16-year-old in northern Italy illustrates the problem clearly. The suspect allegedly used VPNs and other anonymisation tools, accessed Islamic State propaganda, maintained jihadist and antisemitic material, interacted with individuals considered organic to Islamic State and possessed material concerning improvised explosive devices. The case also included simultaneous jihadist, neo-Nazi and antisemitic content, reinforcing the wider trend toward ideologically hybridised violent identities rather than clean organisational affiliation.
The strategic significance of such cases is not that minors are becoming a dominant terrorist demographic. It is that digital ecosystems can accelerate behavioural progression before conventional intelligence indicators appear. An individual without prior police visibility can move through propaganda consumption, encrypted interaction, operational curiosity and technical material without joining a formal cell. This places greater importance on behavioural indicators and network interactions than on membership-based threat models.
Spain remains one of Europe’s most active disruption environments. Arrests in Madrid, Barcelona, Ceuta, Toledo and other locations have repeatedly involved young individuals engaged with Islamic State propaganda and, in some cases, intent to travel toward conflict-linked environments. A July operation involving four suspects demonstrated that online social relationships can connect individuals across geographically separate Spanish cities while sustaining common jihadist identity and mobility aspirations.
Turkey remains the critical external filter between Europe, Syria, Iraq, Central Asia and the broader Islamic State ecosystem. The scale of August counterterrorism operations remains substantial. More than one hundred suspected Islamic State-linked individuals were detained across thirty provinces in a single operation, with investigations involving financial support, social-media propaganda and alleged membership. The persistence of such cases after years of counterterrorism activity indicates that Turkey remains simultaneously a target environment, transit space, financial node and disruption hub.
The implication is important for Europe. Turkish arrests should not be read simply as evidence of domestic extremist presence. They often represent the disruption of networks located at the geographic junction between external conflict theatres and European movement systems. Monitoring travel, financial transfers, document facilitation and platform administrators in Turkey therefore remains central to European external operations prevention.
North America presents a lower-volume but equally instructive threat model. The August case involving an alleged Islamic State-inspired plot against the New York State Capitol demonstrates a mature progression from online radicalisation to physical reconnaissance and attempted acquisition of an explosive device. The target was political and institutional rather than merely civilian, indicating an intention to generate systemic political impact.
This case follows an earlier US investigation involving three individuals in Kansas and California accused of financial support to Islamic State, discussion of violent attacks and interest in obtaining drones and heavier weapons. The geographic separation of the suspects illustrates how online networks can substitute for conventional physical cells, enabling operational aspiration across multiple states without requiring a common local environment.
The transnational threat therefore increasingly depends on distributed enabling functions. Financing, translation, propaganda production, cryptocurrency, encrypted communication, travel planning and technical guidance can each be performed by different individuals. No single participant needs to possess the full operational picture. This compartmentalisation increases resilience and complicates attribution, particularly when an organisation inspires an actor but receives only partial facilitation rather than direct tasking.
The external threat is also expanding beyond jihadism. Europe’s hybrid security environment increasingly includes state-sponsored sabotage, cyber operations, covert influence and proxy recruitment. This is analytically relevant to an EIB focused on jihadist, insurgent, and hybrid threats because many operational methods overlap: low-cost intermediaries, clandestine procurement, deniable logistics, encrypted communication, and symbolic targeting.
The attempted drone attack at Leipzig/Halle Airport and subsequent sabotage investigations in Germany have elevated the hybrid threat from theoretical concern to an operational security issue. German and EU authorities have publicly treated the Leipzig incident as having the characteristics of state-sponsored terrorism and linked it to Russia, while Moscow denies involvement. Separate attacks and attempted sabotage against German energy infrastructure have further increased concerns over critical infrastructure vulnerability.
The strategic relevance lies in the convergence of methods rather than actors. A drone carrying explosives against an airport, a jihadist improvised device, an Iran-linked proxy arson attack and a criminally recruited saboteur present different attribution problems but impose similar requirements on protective intelligence. Western services increasingly need to identify intent and sponsorship after detecting behaviour, rather than inferring likely behaviour from known affiliation.
Russia-linked sabotage networks also demonstrate growing reliance on disposable or deniable intermediaries. A German conviction in August concerned activity linked by the court to a Russian state-directed sabotage effort using individuals operating outside traditional intelligence-service structures. The broader European response increasingly recognises recruitment of criminals and ordinary citizens as part of hybrid operations.
This further complicates counterterrorism because criminal, state-proxy, and extremist networks can use the same logistical ecosystems. Weapons procurement, false documentation, cryptocurrency, transport, encrypted communications and local criminal contacts are not ideologically specific infrastructures. Their reuse across threat categories means organised crime intelligence, counterterrorism, and counterintelligence increasingly need to be fused rather than assessed separately.
Critical infrastructure has become a common vulnerability. Energy systems, airports, telecommunications, undersea cables, transport networks and government institutions provide high strategic return because disruption can generate economic cost, public anxiety and political pressure without mass casualties. The EU increasingly treats sabotage, cyberattacks, airspace violations, disinformation and the weaponisation of migration as components of a broader hybrid campaign against European resilience.
For NATO and EU security planners, this produces an attribution dilemma. The tactical signature of an attack may no longer reveal the strategic sponsor. A low-capability actor can act for ideological reasons, financial compensation, criminal opportunity or foreign state direction. Premature attribution risks escalation; delayed attribution can undermine deterrence. The Leipzig case illustrates how quickly a seemingly isolated drone event can become a question of alliance security and state-sponsored terrorism.
Iran-linked and Hezbollah-associated infrastructures remain a parallel concern. The immediate likelihood of a broad Hezbollah external operations campaign remains lower than the jihadist-inspired threat. Still, the combination of renewed direct US-Iran confrontation, European efforts to strengthen the Lebanese Armed Forces and continuing pressure to disarm Hezbollah increases the potential value of deniable external networks. The principal risk is selective activation, surveillance, intimidation, financial facilitation or the use of intermediaries rather than an overt centrally attributed attack campaign.
The external environment is therefore no longer best described simply as a “terrorist threat to the West.” It is becoming a contested security space where jihadist mobilisation, state-sponsored hybrid activity, organised crime and digital subcultures coexist without necessarily cooperating. They share vulnerabilities, infrastructure and target sets even when their political objectives are entirely different.
The principal forecast for September–November is continued high disruption activity rather than a sustained wave of successful attacks. European arrests are likely to remain elevated because the threat ecosystem itself is active and because European collection has improved. North America will continue to face fewer cases but potentially higher-impact self-initiated plots against symbolic government, military, Jewish or public targets. Turkey will remain the most important external facilitation filter. At the same time, Russia-linked sabotage and broader hybrid activity are likely to increase pressure on European critical infrastructure, forcing counterterrorism and counterintelligence resources to compete for overlapping investigative capacity.
Analyst Bottom Line
The transnational threat is becoming less organisationally coherent and more operationally complex. Europe faces the highest density of overlapping risks: jihadist micro-networks, radicalised minors and young adults, ISKP-linked facilitation, Turkey-connected transit structures, Iran-aligned latent networks, state-sponsored sabotage and criminal intermediaries. North America remains primarily vulnerable to self-initiated mobilisation, but the Albany case demonstrates that ideological intent can progress to reconnaissance and attack preparation without a mature external command structure.
The decision-relevant issue for September–November is therefore not whether a new centrally directed external campaign is emerging. Current evidence does not support that judgement. The greater danger is the continued shortening of the distance between digital mobilisation and operational behaviour, combined with an attribution environment in which terrorist, proxy and criminal actors increasingly employ similar low-cost methods. Western intelligence advantage will depend on integrating counterterrorism, cyber, criminal, financial and counterintelligence collection quickly enough to identify the actor before the incident defines the narrative.
Overall Strategic Assessment
The September–November 2026 environment is best assessed as one of persistent multi-theatre pressure with rising strategic interconnectedness but limited evidence of unified operational coordination. Africa remains the strongest jihadist operational ecosystem, Pakistan the principal high-tempo state-attrition theatre, Syria the most important regeneration risk, and Europe the most complex secondary security environment.
The principal shift is qualitative. Armed groups increasingly seek strategic effects without requiring conventional territorial control or mass-casualty escalation. They degrade mobility, intelligence, legitimacy, economic activity and public confidence while maintaining enough decentralisation to absorb counterterrorism pressure. At the same time, the external security environment is becoming harder to compartmentalise as jihadist networks, hybrid actors, and criminal facilitators exploit shared technological and logistical infrastructures.
For the next 90 days, the most important indicators will therefore be qualitative rather than numerical: sustained jihadist embedding in coastal West Africa, repeated strategic infrastructure attacks in the Sahel, wider TTP penetration beyond established strongholds, urban Islamic State network reconstruction in Syria, behavioural acceleration among Western-based supporters, and the continued use of deniable intermediaries against European critical infrastructure. Those developments would represent genuine strategic change. A simple increase in monthly attack totals would not.
2. Operational Actor Assessment
September–November 2026 Rolling Forecast
The operational environment entering September 2026 is characterised less by uniform jihadist expansion than by simultaneous acceleration across a limited number of high-pressure theatres. The most consequential developments are currently concentrated in the Sahel, Somalia and Pakistan, where insurgent organisations are demonstrating the ability to sustain or rapidly regenerate operational tempo despite persistent counterterrorism pressure.
This distinction is important. Attack volume alone does not define the present threat environment. What matters is the combination of operational density, geographic persistence, target selection, force regeneration and the ability to impose repeated security costs on state forces. On these criteria, JNIM, al-Shabaab and TTP currently constitute the most consequential insurgent actors within the monitored ecosystem. Islamic State branches in Africa remain structurally significant, but their trajectory is more heterogeneous. IMP continues to reinforce the fragmentation of the Pakistani threat environment. At the same time, Islamic State activity across the Middle East and South Central Asia remains numerically limited but strategically relevant because of the organisation’s residual transnational potential.
AFRICA
JNIM
Operational Evolution
JNIM remains the principal driver of jihadist pressure across the central Sahel. The transition from 52 attacks in June to 158 in July, followed by 93 in August, should not be interpreted simply as a July spike followed by contraction. The more relevant indicator is that August activity remained substantially above June despite the inability, or lack of requirement, to reproduce July’s exceptional tempo.
July was particularly significant because 89 attacks occurred in Mali and 65 in Burkina Faso, demonstrating simultaneous operational capacity across multiple fronts rather than concentration against a single vulnerable security sector. August subsequently shifted the balance toward Burkina Faso, where 58 of 93 recorded attacks occurred.
This suggests operational elasticity. JNIM can intensify one theatre, redistribute pressure and maintain violence elsewhere without abandoning its broader geographic architecture.
Geographic Trajectory
The geographic footprint remains extensive. In Mali, activity across Gao, Sikasso, Kayes, Mopti, Timbuktu, Ségou and Kidal connects several operational environments that were previously treated more discretely. July additionally included Koulikoro and the Bamako area, reinforcing the importance of monitoring the southern and western approaches to the capital.
Burkina Faso remains equally important. Activity extending across Yatenga, Soum, Oudalan, Loroum, Bam, Namentenga, Séno, Gourma, Poni, Mouhoun and other provinces demonstrates that the insurgency cannot be reduced to the northern border belt. The network retains pressure across northern, eastern and western corridors.
Operations in Tillabéri, and in July also in Dosso, preserve the Niger dimension. Four attacks per month appear quantitatively marginal compared with Mali and Burkina Faso. Still, their strategic relevance lies in maintaining cross-border connectivity and testing security pressure along the western Nigerien axis.
Capability Evolution
JNIM increasingly combines tactical violence with operational shaping. Attacks against national armed forces, VDP units, Dozo militias and Russian Africa Corps personnel serve several purposes simultaneously: attrition of state-aligned forces, degradation of local security networks, deterrence of civilian collaboration and progressive restriction of government mobility.
The July surge is therefore more important as evidence of mobilisation capacity than as a monthly statistical record. Generating 158 attacks across three countries requires distributed command, logistics, weapons availability, intelligence collection and local support or coercive access. The organisation is demonstrating that it can generate operational mass without abandoning decentralisation.
30–90 Day Outlook
JNIM is assessed as High threat with High confidence. The baseline through November is sustained pressure in Burkina Faso and Mali, with episodic operational surges rather than a continuous reproduction of July’s tempo. Particular attention should remain on western and southern Mali, the approaches to Bamako, the Burkina Faso borderlands and the Tillabéri corridor.
The principal escalation indicator would not necessarily be another record attack count. More consequential would be coordinated pressure on transport corridors, sustained interdiction around major urban centres, increasingly complex attacks against defended positions, or a measurable expansion into areas where JNIM can convert temporary access into persistent influence.
Harakat al-Shabaab al-Mujahidin
Operational Evolution
Al-Shabaab presents the clearest upward trajectory in the African theatre. Activity increased from 48 attacks in June to 97 in July and 152 in August. The August total represents more than a threefold increase over June. More importantly, the escalation was accompanied by a wider operational distribution rather than being driven by one isolated campaign. Somalia accounted for 128 attacks in August, but Kenya rose from 14 attacks in July to 24. This shows simultaneous intensification inside Somalia and increased cross-border pressure.
Geographic Trajectory
Lower Shabelle remains the core pressure zone, with repeated activity around Qoryooley, Jaanale, Bariire, Awdheegle, Afgooye, Bulo Merer and associated corridors. However, the organisation’s operational reach extends considerably beyond this axis. Middle Shabelle, Lower Juba, Bay, Gedo, Bakool, Hiraan and Banaadir were all affected during August. Mogadishu therefore remains embedded within a broader insurgent system rather than constituting an isolated terrorism problem. The Kenyan trajectory deserves particular attention. Activity now spans Garissa, Mandera, Wajir and Lamu counties. The addition of multiple areas in Lamu during August indicates that the Kenyan dimension should be assessed as an active extension of the Somali insurgency rather than an occasional external theatre.
Capability Evolution
The current acceleration indicates substantial force regeneration and operational coordination. Al-Shabaab continues targeting Somali intelligence and military forces while simultaneously attacking Ethiopian, Ugandan and Kenyan personnel, Ma’awisley militias and other government-aligned forces. The breadth of this target architecture demonstrates the organisation’s ability to contest several layers of the Somali security system simultaneously. The most important indicator, therefore, is not simply the August attack count. The organisation’s ability to maintain pressure across Lower Shabelle while operating in central and southern Somalia and expanding activity across four Kenyan counties.
30–90 Day Outlook
Al-Shabaab is assessed as a Critical/High threat with High confidence. We expect a sustained high operational tempo through September and October, with monthly volatility to be expected. The probability of attacks against Somali security infrastructure, African partner forces and cross-border targets in Kenya remains high. Any convergence between continued high attack frequency and successful penetration of strategically important urban or military targets would represent a significant escalation.
Islamic State (ISWAP, ISCAP, ISM, IS-Somalia, IS-Sahel)
Operational Evolution
The Islamic State’s African branches present a different trajectory. Recorded activity declined from 94 attacks in June to 87 in July and 61 in August. This represents a material reduction in operational volume, but not yet evidence of strategic degradation. The organisation remained active across six countries in both July and August. Nigeria and the Democratic Republic of Congo continued to generate most attacks, while Mozambique, Somalia, Niger and Cameroon remained secondary fronts.
The distinction between operational tempo and geographic resilience is critical here. Islamic State activity declined by about 30% between July and August, yet no major monitored theatre disappeared from the operational map.
Geographic Trajectory
Nigeria remains the largest individual front, with 48 attacks in July and 32 in August, concentrated principally in Borno and Yobe, with Adamawa also affected in July. ISWAP therefore retains its Lake Chad operational core despite fluctuating monthly output. ISCAP remained persistent across Ituri, Haute Uele and North Kivu, recording 26 attacks in July and 22 in August. This comparatively stable operational trajectory indicates continued freedom of action across parts of eastern DRC. Mozambique declined from ten attacks to four, but the geographic pattern deserves attention. Activity moved through Macomia, Mocímboa da Praia, Ancuabe and Muidumbe in July, then Quissanga, Palma, Montepuez and Macomia in August. The targeting of Chinese agricultural interests in August is particularly relevant because it demonstrates that foreign commercial assets remain within the group’s target universe. IS-Somalia and IS-Sahel remained comparatively low tempo.
Capability Evolution
The African Islamic State ecosystem continues to exhibit distributed resilience rather than synchronised escalation. Individual branches operate under markedly different local conditions, but collectively they maintain military, civilian, sectarian and economic target sets.
Christian civilians remain a recurrent target category in both DRC and other African theatres. This matters beyond immediate casualty production because sectarian targeting continues to serve propaganda amplification, population displacement and coercive territorial effects.
30–90 Day Outlook
Islamic State in Africa remains a high threat, with Moderate to High confidence. A return to higher aggregate attack volumes is plausible, but the principal intelligence requirement should be branch level rather than continental. ISWAP and ISCAP remain the most operationally consequential components. At the same time, Mozambique retains disproportionate strategic relevance because relatively small numbers of attacks can affect investment, population movement and state control in Cabo Delgado.
Boko Haram/JAS
Boko Haram/JAS should remain analytically separated from ISWAP. Current evidence indicates the organisation retains meaningful operational resilience, particularly across the Cameroon-facing component of the Lake Chad ecosystem. The Far North of Cameroon has become increasingly important. Insurgent violence increased in Mayo Tsanaga during the preceding period, while local recruitment, access to resources and the growing role of Cameroonian commanders appear to be strengthening JAS’s ability to operate inside Cameroon. Cross-border sanctuary and mobility remain central to this resilience.
The August 8 attack on Kangaleri in Mayo Sava, which killed at least eight people, together with simultaneous reported activity around Tourou, illustrates the continued capacity to conduct raids against vulnerable communities, loot resources and withdraw before sustained security intervention. This pattern should not be interpreted as a return to Boko Haram’s 2014–2015 model. The organisation is substantially different in scale and strategic position. Its relevance lies instead in persistent local embeddedness, exploitation of difficult terrain, cross-border mobility, and continued competition with ISWAP. JAS is assessed as an Elevated threat. Through November, the most probable trajectory is continued raids, civilian targeting, resource acquisition and intermittent attacks against military positions across the Lake Chad border environment, particularly northern Cameroon and adjacent Nigerian areas.
Lakurawa
Lakurawa requires a higher position in the September–November monitoring architecture than in previous assessments. August provided evidence of a more assertive operational posture in northwestern Nigeria. An attack on Girkau in Kebbe LGA killed a police officer and two civilians and destroyed security vehicles. This was followed by a major assault on Kebbe town involving what local reporting described as several hundred armed fighters on motorcycles. Reports of four military fatalities remain less firmly established than the occurrence of the assault itself, which was confirmed by police.
The subsequent attack on Ungushi produced a confirmed death toll of at least 28. The Nigerian Army responded by reassessing its local force posture and strengthening the security architecture around vulnerable communities along the Sokoto-Kebbi axis. The analytical significance lies in concentration. These incidents occurred within a relatively compressed timeframe and geographic area, suggesting that Lakurawa can generate local operational mass rather than merely conducting sporadic border incursions.
Lakurawa remains considerably below ISWAP or JNIM in strategic weight. However, it represents an important warning indicator for the progressive interaction between jihadist militancy, porous border systems, local armed economies and the wider insecurity affecting northwestern Nigeria. Threat level is assessed as Elevated and potentially Increasing, with Moderate confidence because attribution remains inconsistent across the Nigerian northwest.
Middle East & Asia
Tehrik-e-Taliban Pakistan (TTP)
Operational Evolution
TTP currently represents the highest-volume insurgent threat in the monitored global dataset. Activity moved from 336 attacks in June to 315 in July before surging to 406 in August. The August increase of approximately 29% over July is significant because it followed several consecutive months of already elevated activity. The casualty relationship is equally instructive. Reported casualties declined from 781 in July to 646 in August despite the substantial increase in attack frequency. This suggests that the August escalation was driven primarily by operational saturation and distributed pressure rather than a corresponding increase in lethality per attack. This does not reduce the threat. It indicates a different operational function, imposing persistent costs on the security apparatus through repeated engagements across a wide battlespace.
Geographic Trajectory
South and North Waziristan remain the centre of gravity. August recorded 130 attacks in South Waziristan and 80 in North Waziristan, together accounting for more than half of the monthly total. The secondary geography is nevertheless strategically important. Peshawar recorded 45 attacks, while DI Khan, Tank, Khyber, Kurram, Mohmand, Bannu, Bajaur, Karak, Orakzai and Upper Dir collectively demonstrate that the insurgency extends across much of the Khyber Pakhtunkhwa security environment. The continued presence across 25 districts in both July and August is one of the strongest indicators of organisational resilience.
Capability Evolution
TTP is not merely maintaining an insurgency. It is imposing sustained operational consumption on Pakistan’s security institutions. The Pakistan Army, SSG, Frontier Corps, police, CTD and local intelligence or peace committee structures are targeted across different levels of the security architecture. This disperses defensive requirements and increases the cost of maintaining territorial control. The shift from 315 to 406 attacks without geographic contraction demonstrates substantial force availability and decentralised operational capacity.
30–90 Day Outlook
TTP remains a critical threat with High confidence. The baseline forecast is continued high-tempo violence across Khyber Pakhtunkhwa, particularly the Waziristan belt. A sustained monthly tempo above approximately 300 attacks should now be treated as structural rather than exceptional. The primary escalation threshold would be a combination of continued mass attack volume with increasing complexity, higher casualty production, successful attacks against strategic military facilities or significant expansion outside the existing geographic concentration.
Ittehad al-Mujahidin Pakistan (IMP)
IMP continues to consolidate its position as a secondary but increasingly relevant component of the Pakistani militant environment. Activity increased from 69 attacks in July to 79 in August, approximately 14 %, while maintaining the same basic geographic architecture and target set. Operations remain concentrated across Khyber Pakhtunkhwa and Gilgit Baltistan, including Khyber, Bannu, North Waziristan, Hangu, Orakzai and Diamer.
The significance of IMP does not match TTP in absolute scale. Its importance lies in multiplying organised armed pressure against the same Pakistani security ecosystem. Army, police, Frontier Corps, CTD, ISI-linked structures and local security committees are simultaneously exposed to several militant organisations operating within overlapping environments. IMP is therefore assessed as a HIGH threat within Pakistan, with an INCREASING trajectory. The principal intelligence question for September through November is whether its growth reflects sustainable organisational expansion or a temporary increase in claim frequency and operational visibility.
Islamic State in Middle East and South Asia
The Islamic State shows an almost inverse pattern to TTP. Recorded attacks remained extremely limited, five in July and six in August. August activity was entirely concentrated in Pakistan, particularly Khyber Pakhtunkhwa, while July included Pakistan, Iraq and Afghanistan. The low volume is analytically important but should not be confused with strategic irrelevance. Target selection remains selective. Pakistani intelligence personnel, political figures, peace committee structures and Taliban personnel demonstrate continued emphasis on actors with political, sectarian or security significance rather than indiscriminate attack generation. July’s attack in Badakhshan also confirms residual capacity to operate against Taliban targets inside Afghanistan, while the Kirkuk attack demonstrated that the Iraqi network has not disappeared completely. The most important development, however, is competitive density in Pakistan.
The apparent decline in Islamic State activity in Syria should be treated with caution. During July and August, the group issued few or no formal claims for attacks inside the country. Yet, several incidents were subsequently attributed by Syrian authorities or security reporting to Islamic State-linked operatives. This discrepancy fits an established pattern. UN monitoring has previously assessed that IS deliberately left a significant proportion of its Syrian operations unclaimed to conceal the extent of its operational presence, preserve cells and complicate attribution. The absence of claims therefore does not necessarily indicate operational inactivity.
This is particularly relevant in the current Syrian transition. A lower public signature may serve organisational security, allowing cells to conduct selective assassinations, bombings or reconnaissance without exposing wider networks. The July attacks in Damascus illustrate the problem: some incidents initially remained unattributed, while subsequent investigations identified individuals linked to IS. The more appropriate metric for Syria is therefore not claimed attacks alone, but the wider universe of suspected jihadist violence, disrupted plots, arrests, weapons seizures and evidence of urban facilitation.
We assess with moderate confidence that Islamic State is currently maintaining a deliberately reduced public operational signature in parts of Syria. This does not imply that every unattributed attack should be assigned to the group. It does, however, mean that formal claim data probably understate its actual operational activity. The key intelligence requirement for the September–November period is to determine whether this concealment reflects defensive preservation or the preparation of a more systematic urban clandestine campaign.
TTP, IMP and Islamic State networks increasingly operate within overlapping security environments while pursuing different organisational and ideological objectives. The Pakistani battlespace should consequently be monitored not only through individual organisations but through interaction, competition, recruitment displacement and potential tactical adaptation between militant ecosystems. Islamic State activity in this theatre is assessed as Elevated despite Low kinetic volume. Confidence is Moderate.
30–90 Day Outlook
The 30–90 day baseline does not indicate a return to sustained high-frequency Islamic State violence in Iraq or Syria. The greater concern remains a low-frequency, high-consequence attack, particularly through ISKP-linked networks, rather than quantitative escalation. A continued absence of formal claims should not be interpreted as evidence of further degradation. Repeated unattributed attacks subsequently linked to IS cells would instead strengthen the assessment that the organisation is deliberately suppressing its public signature while rebuilding clandestine urban capability.
Cross Actor Assessment
The July–August dataset produces a clearer hierarchy than the previous reporting cycle. TTP, al-Shabaab and JNIM currently constitute the primary operational pressure cluster. TTP combines exceptional attack frequency with broad geographic saturation. Al-Shabaab displays the strongest acceleration trajectory, rising from 48 attacks in June to 152 in August while simultaneously expanding pressure into Kenya. JNIM combines geographic depth, multi-state operations, and demonstrated surge capacity, with July showing the organisation can rapidly generate operational mass across Mali and Burkina Faso. Islamic State in Africa remains a structurally important distributed threat, but its current trajectory is more fragmented. The decline to 61 attacks in August lowers immediate aggregate pressure without materially reducing the network’s geographic reach. IMP is an increasingly relevant secondary actor because it contributes to cumulative security overload in Pakistan. Boko Haram/JAS remains locally resilient and deserves particular monitoring in Cameroon’s Far North. At the same time, Lakurawa has moved from peripheral observation toward a credible emerging security problem in the Sokoto–Kebbi border environment. The principal analytical change entering the September–November forecast is therefore not a generalised increase in jihadist violence. It is the emergence of three high-intensity insurgent systems capable of sustaining pressure simultaneously in separate theatres. This has a direct implication for the EIB. I would not rank the actors simply by monthly attacks. For the September–November Global Threat Posture, the hierarchy should provisionally be:
Critical: TTP, al-Shabaab, JNIM.
High: Islamic State Africa (particularly ISWAP and ISCAP) IMP.
Elevated: Boko Haram/JAS, Lakurawa, Islamic State in the Middle East and Asia.
3. Cognitive & Hybrid Battlespace
The cognitive environment entering the September–November 2026 forecast window is becoming more operationally relevant. Across jihadist, Iranian-aligned and other armed non-state ecosystems, information activity is increasingly integrated with military objectives, political positioning, recruitment, deterrence and organisational resilience. The central development is not a dramatic increase in propaganda output. It is the progressive convergence between narrative production, tactical learning, audience segmentation, digital redundancy and the exploitation of geopolitical crises.
This evolution is visible across organisations that otherwise differ substantially in ideology, command structure and operational capability. JNIM is increasingly treating the information domain as an extension of insurgent governance. Al-Qaeda-linked media networks are exploiting the US–Iran conflict, Gaza and Yemen to reframe regional crises through a transnational jihadist lens. Islamic State supporters continue to circulate practical attack-enabling material outside the organisation’s formal media architecture. At the same time, the Iranian and Hezbollah-aligned ecosystem demonstrates a more mature model in which political communication, proxy messaging, psychological pressure, cyber infrastructure and kinetic activity operate as mutually reinforcing components of a wider coercive strategy.
Narrative Competition and Strategic Legitimacy
The most significant evolution within al-Qaeda-aligned communications is the growing effort to translate battlefield resilience into claims of political legitimacy.
JNIM provides the clearest example. A 31-minute interview released by Az-Zallaqa Media with Abu Mahmoud, the organisation’s emir in Burkina Faso, goes substantially beyond conventional battlefield propaganda. The interview presents JNIM as a political and social actor rather than merely a military organisation, combining religious legitimacy, Islamic morality, patience, governance and population protection with a sustained effort to undermine the credibility of the Burkinabè state. The analysis pays particular attention to the information environment itself. Official narratives concerning security improvements are portrayed as deliberate manipulation, while battlefield developments are presented as evidence that government messaging is disconnected from reality. This represents a more mature conception of information warfare. JNIM is not simply communicating its own operational successes; it is attempting to destroy confidence in the state’s ability to define what is happening. The distinction matters. Insurgent information dominance does not require convincing an entire population that JNIM is legitimate. It may be sufficient to convince communities that government claims cannot be trusted, that security guarantees are unreliable and that cooperation with state forces carries greater risk than accommodation with the insurgency. In contested rural environments, erosion of confidence can generate operational effects equivalent to physical control. The deliberate rejection of ethnic and tribal framing reinforces this strategic objective. Abu Mahmoud explicitly distances the organisation from interpretations of the conflict as a Fulani insurgency. Instead, he presents JNIM as a pan-Islamic movement open to Muslim communities irrespective of ethnicity. This should be read as both ideological positioning and counter-counterinsurgency messaging. Governments across the Sahel have repeatedly attempted to separate jihadist organisations from local populations by exposing ethnic recruitment patterns and local grievances. JNIM is attempting to neutralise that approach by shifting the conflict from communal identity to religious legitimacy.
The accompanying accusations of arbitrary detention, torture, religious persecution and disappearances serve the same purpose. Whether individual allegations are accurate is secondary to their cognitive function. They allow JNIM to position state counterterrorism activity as evidence of systemic hostility toward Muslim communities and therefore convert security-force abuses, or perceptions of abuse, into insurgent legitimacy. This trend should intensify if military pressure against JNIM increases. The organisation has developed sufficient media discipline to integrate territorial warfare, governance narratives and grievance exploitation into a single strategic communications framework.
Al-Qaeda’s Wider Narrative Adaptation
Recent pro-al-Qaeda publishing indicates a broader attempt to reconnect geographically fragmented jihadist theatres through common geopolitical narratives.
The Al-Yaqin media outlet has continued developing its weekly Al-Bayan, including a dedicated Telegram channel. Its third issue focused heavily on the confrontation between the United States and Iran and reiterated armed jihad as the only credible means of defeating the movement’s enemies. The framing is notable because al-Qaeda is exploiting a conflict involving an ideological adversary, Iran, without softening its hostility toward Tehran or the broader Shiite axis. The fifth issue makes this distinction explicit. Its Yemen editorial attacks the Houthis as an oppressive and destructive force while simultaneously portraying regional conflict through the broader lens of foreign domination and failed Islamic political movements. This is strategically important. Al-Qaeda does not need to choose between anti-US mobilisation and anti-Iranian sectarian positioning. Its communications architecture allows the movement to present both actors as components of an illegitimate regional order. The result is a narrative that can exploit the US–Iran conflict without creating ideological dependency on either side. The same pattern was already visible in recent AQIS and AQAP material. AQIS’s Nawa’i Ghazwat al-Hind has linked Gaza, Israel, India–Pakistan tensions, American foreign policy and domestic Muslim grievances within a single interpretative framework. AQAP’s recent Inspire and Open-Source Jihad ecosystem has again emphasised individual mobilisation, Western targeting, and operational self-sufficiency.
The effect is cumulative. Individual al-Qaeda branches remain operationally decentralised, but their information ecosystems increasingly present conflicts in Gaza, Yemen, Kashmir, the Sahel and the West as manifestations of the same confrontation. This preserves ideological coherence despite organisational fragmentation. The principal risk, therefore, is not restoring a centrally controlled al-Qaeda propaganda apparatus. It is the emergence of an interoperable narrative system in which different branches and supporter networks independently reinforce the same themes, enemies and behavioural prescriptions.
Palestine as a Cross-Ecosystem Mobilisation Narrative
Palestine remains the most powerful cross-organisational mobilisation theme within the broader militant information environment. The issue now extends well beyond Hamas or Palestinian organisations. JNIM, AQIS, AQAP, al-Shabaab, Islamic State networks and Iranian-aligned organisations have each incorporated Gaza and Jerusalem into their respective strategic narratives despite fundamental ideological differences. This convergence does not imply cooperation. In several cases, the actors remain enemies. What it demonstrates is that Palestine functions as a universal legitimising frame capable of connecting geographically distant conflicts to an emotionally powerful grievance.
Al-Shabaab’s recent messaging concerning Somaliland and Israel illustrates this particularly well. By portraying potential political or security cooperation with Israel as a religious betrayal, the organisation converts a diplomatic issue in northern Somalia into a jihadist mobilisation narrative. Jerusalem therefore becomes a mechanism for delegitimising Somali political actors who have no direct role in the Gaza conflict.
Hamas is simultaneously attempting to shape the post-war political environment through a broader international narrative. Its communications increasingly address Western as well as Palestinian and Arab audiences, relying less exclusively on Islamist terminology and more heavily on concepts such as resistance, national liberation, human rights and political legitimacy. This is designed to preserve political relevance even as military and diplomatic pressure continues around disarmament and future Palestinian governance. The November Palestinian electoral horizon adds a cognitive dimension. Hamas now has incentives to demonstrate political relevance without necessarily abandoning its armed identity. The information contest is therefore likely to move progressively from battlefield legitimacy toward claims of representative legitimacy, resistance credentials and political survival.
For European security services, the relevance is indirect but substantial. Palestine-related mobilisation continues to provide a narrative bridge capable of attracting individuals who might otherwise remain outside traditional jihadist ideological environments. The transition from political outrage to jihadist validation remains highly dependent on personal networks and digital exposure, but the emotional entry point is significantly broader than the core jihadist constituency.
Capability Dissemination and Operational Enablement
The distinction between propaganda and operational support is becoming increasingly blurred. The pro-Islamic State Lamanho ecosystem remains particularly relevant. The English- and Russian-language channel continues to circulate videos, posters and instructional material concerning improvised explosive devices and explosive backpacks. The significance lies less in the technical sophistication of each publication than in the persistence of attack-enabling material within supporter-operated ecosystems beyond official Islamic State channels. This creates a distributed operational library. Modern extremist ecosystems no longer require a central organisation to publish comprehensive manuals continuously. Instructions can be fragmented across images, archived PDFs, short videos, translated documents and private conversations. A prospective attacker can therefore build operational knowledge incrementally.
Recent AQAP material demonstrates the same principle through a more structured format. Inspire Guide, Open Source Jihad and related publications continue to reduce the distinction between ideological mobilisation and tactical instruction. The intended audience is not necessarily an established operative. It is the individual who has already accepted the ideological premise but lacks operational confidence. The strategic effect is barrier reduction. Generative artificial intelligence may accelerate this trend further. Its most immediate relevance is unlikely to be inventing fundamentally new terrorist weapons. It lowers the cost of translation, content adaptation, research, audience targeting, propaganda production and potentially operational problem-solving. Smaller media networks can produce multilingual content faster, and supporters can increasingly personalise information to their own circumstances.
The intelligence challenge is therefore shifting from possessing extremist propaganda to tracking sequences of behaviour. An individual viewing ideological content presents a different risk from an individual who subsequently searches for tactical information, migrates to private platforms, asks specific technical questions, conducts reconnaissance or begins procurement. The presence of operational material in Russian and English is particularly important because it expands accessibility beyond Arabic-speaking militant constituencies and creates overlap with Central Asian, Caucasian and European digital environments.
Digital Ecosystem Evolution
The current jihadist media ecosystem is defined by redundancy rather than dominance by a single platform. Telegram remains important, but persistent enforcement and account removals have encouraged diversification across private messaging services, alternative hosting environments, file-sharing systems, forums, and Rocket.chat-based communities and decentralised or semi-private channels. Material is frequently mirrored before takedown, ensuring persistence even where primary distribution nodes disappear. This architecture creates resilience through fragmentation. Losing a major channel may reduce audience size but does not necessarily eliminate the content. Documents migrate between platforms, supporters create archives, and translated material can circulate for years after original publication.
Al-Yaqin’s decision to establish a dedicated Telegram channel for Al-Bayan illustrates the continued value of branded secondary media ecosystems within the al-Qaeda environment. These networks expand ideological output beyond formal branch media and reduce dependence on centrally recognised outlets.
Islamic State supporter ecosystems operate similarly but tend to place greater emphasis on rapid replication, visual propaganda, attack celebration and practical material.
The result is a digital environment in which formal organisational attribution becomes progressively less useful as the sole analytical metric. Unofficial media entities can perform strategically important functions without receiving public recognition from an organisation. More important than the number of channels is the relationship between them. Repeated cross-posting, shared administrators, translation chains, common archives and migration patterns can reveal the functional architecture behind ostensibly independent outlets.
Iranian-Aligned Cognitive and Digital Architecture
The Iranian-aligned information environment is more complex because cognitive operations are embedded within a broader state and proxy architecture.
A coordinated European operation earlier this year identified more than 14,000 IRGC-linked posts and URLs distributed across mainstream social networks, streaming platforms, blogs and independent websites. Content appeared in multiple languages and included religious martyrdom narratives, political messaging, recruitment and fundraising material, and AI-generated videos. The same digital ecosystem facilitated amplification of material associated with Hezbollah, Ansar Allah, Hamas and Palestinian Islamic Jihad. We also identified cryptocurrency transactions within the wider online infrastructure. Scale matters less than architecture. The Iranian system is not simply a propaganda network. It is an influence ecosystem capable of moving narratives between state institutions, proxies, sympathetic media, social-media accounts and transnational communities. Messaging can therefore be adapted to different audiences while preserving common strategic themes such as resistance to Israel, opposition to US regional presence, martyrdom and the legitimacy of the Iranian-led resistance axis.
The current US–Iran conflict strengthens the importance of this architecture. Military escalation increases demand for immediate narrative interpretation and creates opportunities to frame battlefield developments as proof of Western aggression, regional resistance or domestic betrayal. This also creates a competitive information environment with Sunni jihadist organisations. Al-Qaeda and Islamic State exploit the same conflict while depicting Iran and its proxies as enemies. Audiences therefore receive competing explanations of the same events, each seeking to convert geopolitical shock into ideological mobilisation. The cognitive battlespace should consequently be assessed as competitive rather than bipolar.
Hezbollah: From Deterrence Messaging to Attritional Narrative
Hezbollah’s current information posture is inseparable from its military adaptation. The organisation has shifted toward a more dispersed attritional approach, relying increasingly on small cells, drones, guided weapons and selective rocket fire rather than continuous large-scale barrages. Drones have become particularly important within this operational model.
This shift has an immediate cognitive function. Hezbollah does not need to demonstrate that it can defeat Israel conventionally. It needs to demonstrate persistence, impose costs and maintain the perception that Israeli military superiority cannot produce complete strategic resolution. The information objective therefore becomes resilience signalling. Selective attacks, imagery of surviving infrastructure, claims of continued command functionality and narratives of resistance are intended simultaneously for Lebanese supporters, Israeli audiences and Iran’s wider regional network. This matters especially as disarmament pressure increases inside Lebanon. The political struggle over Hezbollah’s weapons is inherently cognitive because the organisation must convince its constituency that disarmament would expose Lebanon to Israeli coercion. At the same time, opponents argue that continued independent military capability perpetuates instability and undermines state sovereignty.
Recent sanctions and financial investigations also demonstrate that the organisation’s resilience architecture extends well beyond battlefield communications. Cash courier networks linking Lebanon, Turkey, the UAE and Iran continue to provide mechanisms for transferring large quantities of foreign currency outside formal financial channels. For intelligence purposes, financial, information, and military resilience should therefore be treated as interdependent.
Ansar Allah and the Weaponisation of Strategic Geography
The Houthis continue to demonstrate perhaps the clearest integration of kinetic action, strategic geography and information effects among Iranian-aligned non-state actors. Missile and drone operations in and around the Red Sea are designed to produce effects substantially larger than their tactical scale. An attack against a commercial vessel can affect insurance costs, shipping routes, regional risk perception and international political calculations even where physical damage remains limited.
August operations against Mocha and renewed attacks affecting maritime traffic demonstrate the continuing use of drones and missiles as both weapons and communication instruments. The group’s own media quickly amplifies launch footage and operational claims, turning tactical activity into immediate strategic messaging. This creates an unusually efficient coercive model: comparatively limited kinetic resources can generate global economic and psychological effects because the target environment is a major maritime chokepoint.
The Houthi information architecture also benefits from a broader Iranian-aligned media ecosystem while retaining significant autonomous narrative capacity. Gaza, US military activity, Israel and Saudi Arabia can each be incorporated into a single resistance framework depending on the operational requirement. For the September–November period, the principal cognitive risk is continued linkage between maritime violence and broader regional conflicts. Every escalation involving Iran, Israel or the United States potentially provides Ansar Allah with a narrative justification for renewed operations.
Hamas and Post-Conflict Cognitive Survival
Hamas is entering a different phase of information warfare. The core objective is increasingly organisational survival and political legitimacy rather than battlefield mobilisation alone. The movement must simultaneously reassure its remaining domestic constituency, preserve the legitimacy of armed resistance, resist disarmament demands and maintain an external narrative capable of generating political pressure on Israel. This produces deliberate audience segmentation.
Domestic narratives emphasise steadfastness and survival. Arab and Muslim audiences receive a resistance- and Jerusalem-focused message. Western audiences are increasingly addressed through the language of national liberation, civilian protection, international law and political rights. Israeli audiences remain targets for psychological pressure and demonstrations that military operations have failed to eliminate Hamas as a political actor.
The forthcoming Palestinian political process increases the importance of this strategy. Hamas has an incentive to translate the continued existence of the organisation into a claim that it cannot be excluded from any durable political settlement. From a cognitive perspective, therefore, military degradation does not automatically produce political marginalisation. A weakened organisation can still retain significant influence if it controls how others interpret its survival.
Hybrid Convergence and the Operationalisation of Influence
The broader hybrid environment is increasingly characterised by convergence between influence activity, cyber infrastructure, financial mechanisms and kinetic coercion. This does not mean that jihadist organisations, Iranian proxies and state influence networks are converging organisationally. They are not. The convergence is functional. Different actors increasingly exploit the same technological environment, social platforms, hosting providers, encrypted applications, cryptocurrency networks and global information cycles. Artificial intelligence further lowers the cost of producing persuasive content, multilingual messaging and synthetic visual material. The result is a battlespace in which relatively small organisations can generate narrative effects and then have larger political or algorithmic ecosystems amplify them. The boundary between cybercrime and influence activity is also blurring. Criminal infrastructure can provide hosting, compromised accounts, payment mechanisms, bot services, and other capabilities required for influence operations without sharing the client’s ideological objectives. This creates another layer of plausible deniability and complicates attribution.
For NATO and European intelligence services, the implication is significant. The principal challenge is no longer simply identifying hostile propaganda. It is determining when an information ecosystem begins producing operational effects: recruitment, fundraising, behavioural mobilisation, infrastructure targeting, physical violence or degradation of political legitimacy.
Assessment
The cognitive battlespace is entering a phase in which information operations are increasingly inseparable from organisational capability. JNIM demonstrates how an insurgent movement can use information warfare to degrade state legitimacy and reinforce coercive governance. Al-Qaeda’s wider media ecosystem uses geopolitical crises to sustain ideological coherence across geographically disconnected theatres. Islamic State supporter networks continue lowering practical barriers to individual violence through decentralised tactical material. Hamas is adapting information warfare toward political survival and international legitimacy. Hezbollah and Ansar Allah integrate narrative effects directly with military deterrence and attritional coercion. Iran operates a broader multilingual ecosystem that links state messaging, proxies, digital infrastructure, and financial support. The principal intelligence indicator is therefore no longer propaganda volume. The more relevant sequence is:
Narrative convergence → audience migration → closed-network interaction → capability acquisition → behavioural activation.
The transition between these stages is where cognitive activity becomes an operational threat. For the September–November period, three developments deserve priority attention.
First, further convergence around Gaza and the US–Iran confrontation could provide otherwise competing militant ecosystems with simultaneous mobilisation opportunities. There is no evidence of organisational convergence, but parallel exploitation of the same geopolitical shock could increase radicalisation pressure across multiple constituencies.
Second, practical attack material circulating through Islamic State and al-Qaeda-aligned supporter networks continues to shorten the distance between ideological consumption and independent operational experimentation.
Third, Iranian-aligned organisations increasingly demonstrate that cognitive warfare can be integrated with kinetic pressure, cyber infrastructure and financial resilience rather than conducted as a separate communications activity.
Analyst Bottom Line
The information domain should now be treated as a capability layer rather than a propaganda layer. The most mature militant organisations are no longer using media primarily to document operations. They use it to shape legitimacy, influence population behaviour, sustain recruitment, impose psychological costs, distribute operational knowledge, and preserve organisational relevance under military pressure.
For the next 90 days, the most important warning indicator will not be the appearance of additional publications or channels. It will be evidence that narrative mobilisation is producing observable behavioural change: movement into encrypted environments, sustained interaction with facilitators, target research, technical inquiry, procurement, reconnaissance or financial mobilisation.
Assessment Confidence: High regarding the continued strategic importance of the cognitive domain and the increasing integration of information operations with insurgent and hybrid strategies.
Confidence is Moderate regarding the ability to measure direct behavioural activation from propaganda alone, because attributing online exposure to subsequent operational intent remains inherently difficult.
4. Forward Threat Forecast, 30–90 Days
September–November 2026 Forecast Framework
The September–November 2026 threat environment is unlikely to be defined by a single dominant escalation. The more probable trajectory is simultaneous pressure across several operational systems whose strategic effects are increasingly cumulative. Jihadist insurgencies in Africa and Pakistan will remain the principal sources of sustained kinetic activity, while Europe is becoming the most important external security environment because of the density of disrupted jihadist cases, accelerated digital radicalisation, foreign-fighter and facilitation trajectories, and the simultaneous expansion of state-linked hybrid activity.
The central forecast is therefore one of persistent operational pressure with selective escalation rather than uniform expansion. JNIM, al-Shabaab, and TTP currently have the clearest capacity to sustain a high operational tempo. Islamic State branches remain resilient but geographically uneven. In the West, the probability of a centrally directed mass-casualty jihadist campaign remains lower than the probability of self-initiated or remotely influenced violence, small-network plotting and disrupted attack preparation. At the same time, European security services must operate against an increasingly crowded threat environment in which jihadist mobilisation coexists with Russian sabotage, hostile intelligence activity, Iranian-linked networks, cyber operations and other forms of deniable coercion.
This creates an important distinction for the forecast period. The probability of disruption is high; the probability of strategic surprise is lower but potentially consequential.
Africa: Sustained Insurgent Pressure and Strategic Encroachment
Africa will remain the principal global centre of gravity of jihadist insurgency through November. The most important trajectory is expected to remain in the central Sahel, where JNIM has demonstrated both exceptional surge capacity and the ability to sustain a substantially elevated operational baseline. The shift from 52 attacks in June to 158 in July and 93 in August suggests the July escalation was not an isolated statistical anomaly. It showed the organisation’s ability to mobilise distributed operational networks across Mali, Burkina Faso, and Niger and maintain significant pressure without requiring continuous maximum effort.
The baseline forecast is therefore for continued high activity in Mali and Burkina Faso, with Burkina Faso likely to remain particularly exposed. However, attack volume alone will provide an increasingly poor measure of strategic deterioration. More consequential would be further movement toward economic interdiction, strategic infrastructure attacks, pressure on major transport corridors, operations around urban centres and attempts to constrain state access to peripheral territory. Current trends already indicate increasing pressure against population centres and economic infrastructure, while both JNIM and Islamic State Sahel Province are incorporating drones, swarming assaults and more complex tactical combinations into their operations.
Mali presents the highest strategic risk. JNIM does not need to seize Bamako to alter the balance between insurgency and state authority. Sustained interference with transport, fuel distribution, commercial movement and military access can progressively increase the economic and political cost of governing territory outside the capital. Operations in Koulikoro and the Bamako area during July reinforce the requirement to distinguish between territorial conquest and strategic isolation. The latter is substantially more plausible within the present forecast horizon.
Niger represents a secondary escalation pathway. Political instability, continuing Islamic State pressure and the coexistence of JNIM activity in Tillabéri create opportunities for militants to exploit security-force distraction and deteriorating confidence in state institutions. The failed mutiny in Niamey adds a political vulnerability that militant organisations may seek to convert into operational advantage.
Islamic State activity across Africa is likely to remain geographically persistent despite the decline from 87 attacks in July to 61 in August. A renewed increase in Nigeria or eastern DRC is plausible during the forecast period. Still, the most important warning condition would be simultaneous acceleration across ISWAP, ISCAP and Mozambique without a corresponding reduction in secondary theatres. Such a development would indicate greater system-wide regenerative capacity than the August decline currently suggests.
Al-Shabaab represents the strongest immediate escalation signal. The increase from 48 attacks in June to 97 in July and 152 in August cannot yet be assumed to represent a permanent new baseline. Still, it demonstrates substantial force availability and operational depth. The organisation is likely to maintain pressure across Lower Shabelle, Bay, Gedo, Hiraan and the approaches to Mogadishu while preserving an increasingly active Kenyan front. The rise in attacks across Garissa, Mandera, Wajir and Lamu indicates that northeastern Kenya should be treated as an extension of the operational system rather than as a peripheral external theatre. The most dangerous al-Shabaab scenario is not simply another monthly increase. It is the combination of sustained rural pressure with a successful complex attack against a high-value security, government or international target in Mogadishu, or a significant operation in Kenya capable of producing strategic political effects.
Forecast confidence: High. Africa will remain the principal jihadist operational theatre through November. Confidence is lower on monthly attack volume because all major organisations can rapidly redistribute operational effort.
Pakistan and the Afghanistan–Pakistan System: The Highest-Tempo Insurgent Environment
Pakistan will remain the most intense counter-state insurgency environment within the monitored system. The TTP’s 406 attacks in August, following 315 in July and 336 in June, demonstrate that high-frequency violence has become structural rather than episodic. The principal forecast is continued operational saturation across Khyber Pakhtunkhwa, particularly South and North Waziristan, with persistent secondary pressure in Peshawar, DI Khan, Tank, Khyber, Kurram, Mohmand, Bannu and Bajaur.
The significance of the August data lies partly in the relationship between frequency and lethality. Attacks increased substantially while reported casualties fell from 781 in July to 646 in August. This suggests a campaign increasingly capable of using repeated lower-scale engagements to consume security resources, challenge local intelligence networks and maintain constant operational pressure. The objective need not be tactical success in every engagement. Persistent attacks against police, CTD personnel, peace committees, Frontier Corps and military units can progressively weaken the local architecture required to identify, penetrate and disrupt insurgent networks.
IMP adds a second layer. Its rise from 69 attacks in July to 79 in August remains far below TTP activity but increases the cumulative burden on the same security environment. The critical intelligence question is whether IMP is developing durable autonomous force-generation and command capabilities or remains dependent on overlapping militant infrastructures.
The most dangerous variable remains the Afghanistan–Pakistan relationship. A major TTP attack generating substantial military or political casualties could trigger Pakistani cross-border action. Afghan civilian casualties or strikes perceived as violations of sovereignty could then create political pressure on Kabul, facilitate TTP mobilisation and produce a further retaliatory cycle.
Islamic State activity is likely to remain substantially below TTP levels, but ISKP should not be evaluated through attack frequency alone. Its external networking, multilingual propaganda, recruitment architecture and ability to select politically consequential targets preserve disproportionate strategic relevance.
Forecast confidence: High regarding continued high TTP activity. Moderate regarding escalation into a wider Afghanistan–Pakistan confrontation, because the trigger is plausible but highly dependent on the scale and political effect of individual attacks.
Europe and the Western Threat Environment: From Radicalisation Indicators to Operational Preparation
Europe should be treated as a priority theatre within the September–November forecast even though it does not approach Africa or Pakistan in kinetic volume. The reason is different: the density and characteristics of recent counterterrorism cases increasingly indicate movement from ideological consumption toward behavioural mobilisation and operational preparation.
The pattern visible across recent Weekly Threat Shifts is no longer limited to propaganda possession or expressions of ideological sympathy. Investigations increasingly involve foreign training aspirations, technical research, explosive-related material, reconnaissance, attack discussion, encrypted networking and individuals attempting to move toward conflict or training environments. The distinction between foreign-fighter mobilisation and domestic attack planning is also becoming less reliable. Individuals may seek training abroad precisely because external contact could provide the capability subsequently required for violence inside Europe.
The German case involving two nationals accused of preparing serious Islamic State-associated violence is particularly indicative. Both were arrested while allegedly attempting to travel toward the Middle East for weapons training. At the same time, one had reportedly also considered a suicide attack inside Germany using an explosive belt or vehicle. The case illustrates a trajectory in which external mobilisation and domestic targeting are not alternative pathways but potentially sequential components of the same radicalisation process.
Italy provides another important warning signal. A 17-year-old arrested near Pavia in July had reportedly participated in pro-Islamic State online environments, communicated with foreign peers, expressed willingness to die as a martyr and downloaded material concerning improvised explosive devices and an explosive belt. A separate 16-year-old case emerging in August and September involved jihadist material alongside neo-Nazi, white-supremacist and accelerationist content and an increasing interest in weapons, explosives, incendiary substances and methods of conducting violent actions.
These cases are analytically significant because they challenge conventional ideological categorisation. Some younger subjects increasingly inhabit digital environments in which jihadism, antisemitism, accelerationism, neo-Nazism and fascination with mass violence coexist. The operational risk may therefore develop before ideological identity becomes coherent enough to fit a conventional counterterrorism profile.
Spain provides a second structural indicator. By early August, Spanish security forces had already conducted 43 counterterrorism operations during 2026, resulting in 82 arrests for jihadism-related offences. These figures matter not because they predict an imminent attack, but because they show the continued depth of the underlying mobilisation environment.
Taken together with investigations in France, Germany, Italy and other European states, the arrest pattern suggests that European counterterrorism services are confronting an active and regenerative threat ecosystem rather than simply residual post-caliphate networks.
The baseline forecast through November is therefore continued elevated disruption activity across Europe, with arrests likely to remain more frequent than successful attacks. This partly reflects threat persistence and partly shows that European intelligence and police services continue to penetrate networks before execution. The most probable successful attack scenario remains a self-initiated or minimally facilitated operation requiring limited preparation. Knives, vehicles, firearms where accessible, incendiary methods or rudimentary explosive concepts remain more probable than sophisticated externally directed operations. However, persistent circulation of attack-enabling material means that improvised explosive attack preparation cannot be excluded, particularly where online radicalisation progresses into closed-network interaction and technical experimentation.
The highest-consequence scenario is different: a small network receiving meaningful external facilitation, training, technical assistance or operational guidance from an Islamic State-linked structure while retaining enough autonomy to avoid the communications signature of a conventionally directed plot. This remains less likely than self-initiated violence but would substantially increase attack complexity. Young subjects require particular attention. Recent cases do not justify concluding that European jihadism is becoming predominantly adolescent. They do indicate that age is becoming a less reliable proxy for operational capability. Digital environments provide minors with ideological material, transnational contacts and technical content that previous generations would have required physical extremist networks to access.
The broader Western environment shows similar characteristics, but less frequently. The August disruption of an alleged Islamic State-inspired plot against the New York State Capitol is particularly relevant because the investigation involved more than ideological intent. The suspect allegedly conducted physical reconnaissance, photographed the target and intended to use an explosive device against government officials and the building itself. Movement across that sequence matters far more than propaganda consumption alone.
The September–November period also contains symbolic dates and politically sensitive events that may provide mobilisation opportunities. These should not automatically be interpreted as attack windows. Still, jihadist media ecosystems repeatedly exploit anniversaries, Middle Eastern conflict developments and highly visible political events to reinforce target legitimacy and individual mobilisation.
The baseline Western threat is therefore assessed as Elevated, with Europe representing the priority external theatre. There is currently insufficient evidence to assess that Islamic State or al-Qaeda has restored a sustained centrally directed European attack architecture comparable to earlier periods. The more credible threat comes from distributed mobilisation, in which organisational propaganda, supporter networks, and occasional facilitators can influence individuals without exercising full command.
The principal warning indicator would be a shift in arrest profiles: multiple cases involving common facilitators, repeated external training pathways, shared technical infrastructure, coordinated reconnaissance or operational links connecting suspects across several European states. Such a pattern would suggest that what currently appears primarily decentralised is acquiring a more structured transnational layer.
Forecast confidence: Moderate–High. Confidence is high that arrests, investigations and disrupted jihadist mobilisation will remain elevated. Confidence is moderate regarding successful attack occurrence because individual execution remains intrinsically difficult to forecast and current disruption capability remains strong.
Syria and the Residual Islamic State System
Syria will remain a lower-volume but high-sensitivity theatre. The principal risk during the forecast period is not territorial Islamic State resurgence. It is the reconstruction of clandestine operational infrastructure inside an unstable political and security transition. Changes to detention arrangements, security-force integration, local intelligence networks and the broader post-Assad political order create exploitable seams. Islamic State does not require large formations to exploit them. Small urban cells capable of assassinations, bombings, infrastructure attacks or sectarian violence could generate disproportionate political effects by challenging the new government’s claim to security consolidation. The highest-risk scenario is therefore a politically consequential attack in Damascus or another major urban centre, particularly against senior government officials, security institutions, religious targets or foreign interests. Such an operation could simultaneously damage government legitimacy, discourage external engagement and provide Islamic State with global propaganda effects.
Iraq is likely to remain substantially more contained. Residual Islamic State activity persists, but there is currently insufficient evidence for a broader insurgent regeneration. The principal variable is cross-border contamination from Syrian instability rather than autonomous Iraqi escalation.
Forecast confidence: Moderate. The opportunity structure is clear; the organisation’s ability to translate it into sustained urban operational capability remains less certain.
Hybrid Actors and European Strategic Exposure
The hybrid threat environment is likely to become more operationally consequential during the same forecast period.
Europe is again the central theatre.
The attempted explosive-equipped drone attack at Leipzig/Halle Airport represents a potentially important threshold. The facility is strategically relevant to NATO and Ukrainian logistics, and the German government has attributed the incident to Russia. Moscow denies responsibility. What makes the episode particularly consequential is not simply the attribution but the method: a relatively low-cost unmanned platform could threaten a strategically important logistics node while preserving many characteristics of hybrid action, including limited footprint, deniability, and ambiguity over escalation thresholds.
The incident should not be interpreted as evidence that Russia is preparing conventional military action against NATO territory. Current Alliance assessments do not indicate an imminent conventional attack. The more plausible forecast is continued activity below the threshold of open warfare.
The wider pattern strengthens that judgement. Denmark has identified attempts to recruit its citizens for reconnaissance and sabotage-related activity against defence companies, including approaches through social-media and gaming environments. Estonia has investigated suspected sabotage against a defence company supplying Ukraine. Germany is investigating additional incidents involving energy infrastructure and a defence technology company.
The operational model is attractive because it lets state intelligence structures separate the sponsor from the executor. Local criminals, ideologically motivated individuals, financially recruited intermediaries, or foreign residents can potentially conduct reconnaissance, arson, sabotage, or logistics without understanding the operation’s wider strategic purpose.
This generates an important convergence with the jihadist threat, but only at the level of methods and security requirements. There isn’t a basis to treat the actors as organisationally connected. Both environments nevertheless exploit inexpensive technologies, encrypted communications, compartmentalised networks and vulnerable critical infrastructure.
Energy infrastructure deserves particular attention. Recent incidents involving German substations and the growing exposure of energy systems to cyber and physical disruption show that relatively limited attacks can have significant political and economic effects. Increasing digitalisation simultaneously expands the cyber attack surface, including within operational technology environments.
Iran-aligned networks represent a separate hybrid risk. The ongoing confrontation involving Iran and the United States increases incentives for Tehran and aligned organisations to preserve asymmetric response options. A broad Hezbollah external attack campaign in Europe is not the baseline scenario. More plausible are surveillance, intimidation, logistical activity, covert financing, cyber operations or selective use of intermediaries where strategic circumstances favour deniability.
Pressure on Hezbollah inside Lebanon will remain relevant as European states prepare greater support for the Lebanese Armed Forces and the disarmament question becomes increasingly central. The stronger the perceived threat to Hezbollah’s organisational survival, the greater the incentive to preserve external financial, intelligence, and logistical networks, even if they remain operationally dormant.
The hybrid forecast through November is therefore continued testing of European resilience rather than overt escalation toward conventional conflict. Defence industrial facilities, logistics hubs, energy infrastructure, transport systems and Ukraine-related supply chains remain particularly attractive targets.
Forecast confidence: High regarding continued Russian-linked hybrid pressure and hostile intelligence activity. Moderate regarding the frequency of kinetic sabotage and Iranian-aligned activation, because both remain highly dependent on political decision-making and escalation dynamics.
Baseline Forecast
The most likely September–November outcome is a continuation of the current fragmented but high-pressure threat environment.
No jihadist organisation is assessed as likely to achieve a transformative territorial breakthrough during the forecast window. However, JNIM, al-Shabaab, and TTP are likely to sustain enough operational pressure further to degrade state security capacity in their respective theatres. Islamic State branches will remain geographically resilient despite uneven attack volumes. Syria will remain vulnerable to clandestine regeneration.
Europe will experience continued jihadist arrests and disrupted plots, with a smaller but persistent probability of successful self-initiated or minimally facilitated violence. The number of disruptions may remain substantially higher than the number of attacks, but this should not be interpreted as a contraction in the threat.
Hybrid activity against Europe is likely to continue below the conventional-war threshold, particularly against infrastructure associated with defence production, energy and logistical support to Ukraine.
Baseline Probability: High.
Escalatory Scenario
A more serious scenario would involve simultaneous deterioration across several currently active systems rather than a single global jihadist offensive.
In Africa, this could involve JNIM combining high operational tempo with sustained economic interdiction and attacks against strategic urban or infrastructure targets. At the same time, al-Shabaab maintains August-level pressure and Islamic State branches simultaneously increase activity in Nigeria, DRC and Mozambique.
In Pakistan, a major TTP attack could provoke significant Pakistani cross-border military action, producing an escalation cycle with Afghanistan.
In Europe, the threshold would be crossed by one successful mass-casualty jihadist attack or evidence that several disrupted cases share a common external facilitator or training architecture.
Within the hybrid domain, a successful state-linked sabotage operation causing substantial casualties or prolonged disruption to European military or energy infrastructure would increase pressure for a more explicit NATO or EU response. The strategic significance would derive from simultaneity. Western governments would have to manage external insurgent instability, domestic terrorism, infrastructure protection, and hostile-state activity at the same time.
Escalatory Scenario Probability: Moderate.
Strategic Shock Scenario
The lower-probability, higher-impact scenario is a geopolitical shock that rapidly connects otherwise separate threat environments. The most credible triggers are a major escalation involving Iran and the United States or Israel, a severe Pakistan–Afghanistan confrontation, a major deterioration of the Syrian security transition, or a politically consequential jihadist attack in Europe.
A renewed regional war involving Iran could activate several information and proxy ecosystems simultaneously. Hezbollah, Ansar Allah and Iranian-linked networks could increase pressure against Western interests while Sunni jihadist organisations exploit the same conflict to mobilise against both Western states and Iran. A major European terrorist attack could produce a different cascade: emergency security measures, intensified political polarisation, retaliatory extremist mobilisation, copycat interest and accelerated jihadist propaganda exploitation.
The defining characteristic of strategic shock would therefore not be organisational coordination. It would be parallel mobilisation by hostile actors exploiting the same political event for different strategic purposes.
Strategic Shock Probability: Low–Moderate.
Impact: Very High
Early Warning Indicators
Reconsider the forecast upward if several indicators begin appearing concurrently. In the Sahel, these include sustained interdiction of major economic corridors, repeated attacks against airports or other strategic infrastructure, persistent JNIM activity closer to Bamako, and coordinated use of drones, vehicle-borne explosives and large assault formations. In Somalia, the key threshold is continued August-level activity combined with successful penetration of major security or government targets and further expansion in Kenya.
In Pakistan, priority indicators are sustained monthly TTP activity above the present high baseline, increasing attacks outside the Waziristan core, successful complex attacks against CTD or intelligence facilities, and Pakistani military action inside Afghanistan followed by organised militant retaliation.
For Europe, the most important indicators are increasingly operational arrest profiles rather than raw arrest numbers: technical experimentation, acquisition attempts, reconnaissance, travel for training, common facilitators, cross-border network connections and migration from open propaganda environments into closed operational communities. Particular attention should be given to minors and young adults where ideological hybridisation is accompanied by growing technical interest in violence.
For hybrid actors, key indicators include repeated drone reconnaissance around military or logistics facilities, unexplained fires at defence-industrial sites, recruitment of local intermediaries, coordinated attacks against energy infrastructure, and evidence that reconnaissance and sabotage cases across different European countries share financial or operational handlers.
Forecast Bottom Line
The September–November 2026 threat environment is unlikely to produce a single global escalation. It is more likely to generate multiple simultaneous pressure points operating at different levels of intensity.
Africa will remain the principal insurgent centre of gravity. Pakistan will remain the highest-tempo counter-state battlefield. Syria will remain the most sensitive jihadist regeneration environment. Europe, however, should now be treated as the priority external threat theatre.
The European judgement is not based on an expectation of a centrally directed jihadist campaign. It derives from the accumulation of disrupted cases showing increasingly operational behaviour, the persistence of transnational digital networks, the involvement of unusually young subjects, the continued circulation of attack-enabling material and the possibility that foreign training, online facilitation and domestic violence increasingly intersect.
At the same time, European security institutions are confronting a second threat architecture based on sabotage, hostile intelligence activity, cyber operations and deniable state-linked coercion. These systems are organisationally separate but compete for the same intelligence resources and increasingly expose many of the same critical infrastructures.
The most important forecast judgement is therefore that Europe’s risk is increasing primarily through threat density rather than through the emergence of a single dominant adversary.
A jihadist plot, an explosive drone against a logistics hub, sabotage of a defence facility and a cyber intrusion into energy infrastructure may have entirely different sponsors and strategic objectives. For the security institution responsible for preventing them, however, they increasingly occupy the same battlespace.
4. Strategic Risk Assessment
The September–November 2026 risk environment is defined by the coexistence of mature insurgencies, emerging external mobilisation and increasingly assertive hybrid activity. These threats do not constitute a unified system, but their simultaneous development increases pressure on intelligence, counterterrorism and force-protection architectures. The principal strategic risk is therefore cumulative: several adversaries can exploit different vulnerabilities at the same time without coordinating.
Strategic Risk Hierarchy
The highest-probability risk remains sustained insurgent attrition in Africa and Pakistan. JNIM, al-Shabaab and TTP have demonstrated sufficient operational depth to absorb counterterrorism pressure while maintaining or rapidly regenerating attack tempo. Their strategic effect increasingly derives from repeated degradation of state security systems rather than individual spectacular attacks. Local intelligence networks, police structures, auxiliaries, transport corridors and government access to peripheral territory remain particularly exposed.
The second risk is the progressive geographic diffusion of jihadist activity. In the Sahel, the concern is not an imminent assault on national capitals but the extension of operational and support networks toward politically and economically sensitive corridors, including the Niger–Benin–Nigeria interface and the wider approaches to coastal West Africa. In Somalia, the corresponding risk is sustained al-Shabaab pressure inside the country combined with a more active Kenyan theatre. In Pakistan, the relevant indicator is further penetration beyond the established Waziristan concentration while maintaining the current operational density in core areas.
The third risk is transnational mobilisation in Europe. This is lower in kinetic intensity but potentially higher in immediate political consequence for Western governments. The volume of recent arrests is important, but the qualitative evolution of cases is more significant. Training intent, explosive-related material, target research, reconnaissance, martyrdom narratives, transnational contacts and movement toward closed digital environments indicate that a limited but persistent segment of the mobilisation ecosystem is progressing beyond ideological consumption.
The fourth risk is hybrid coercion against European critical infrastructure and defence-related systems. Russia-linked sabotage, reconnaissance and recruitment of intermediaries represent the most immediate component, while Iranian-aligned networks preserve a separate latent capability whose activation will depend heavily on regional escalation. Logistics hubs, defence industry facilities, energy systems and infrastructure connected to support for Ukraine offer adversaries strategic effects disproportionate to the resources required to disrupt them.
The fifth risk is strategic opportunity generated by political shock. Syria, Afghanistan–Pakistan relations, the Sahel and the Iran–Israel–US confrontation each contain escalation mechanisms capable of changing the threat environment faster than organisational development alone. These environments should therefore be monitored not only for militant activity but also for political events that could create sudden operational openings.
Escalation Triggers
The Sahel would move from sustained deterioration toward strategic escalation if JNIM could combine its current operational depth with repeated disruption of major transport or supply corridors, attacks against strategically significant infrastructure, and persistent pressure around national or regional centres. Another numerical surge comparable to July would be less consequential than evidence that military activity is producing durable restrictions on state movement and economic access.
For al-Shabaab, the threshold would be crossed if the current operational acceleration were combined with a successful complex attack against a major Somali government, intelligence or international target, or with a sustained expansion of operations inside Kenya. The organisation already has the infrastructure for both; the uncertainty is around timing and target selection.
Pakistan presents the clearest potential escalation chain. A high-casualty TTP attack against a strategic military or political target could trigger substantial Pakistani action across the Afghan border. Afghan casualties or political retaliation could then reinforce militant mobilisation and further reduce the space for bilateral containment. The resulting cycle would transform an already severe domestic insurgency into a broader interstate security crisis.
In Europe, escalation would be indicated less by an increase in arrests than by evidence connecting apparently separate investigations: common facilitators, external training, shared technical infrastructure, cross-border procurement, coordinated reconnaissance or repeated contact with the same overseas networks. A successful mass-casualty attack would immediately alter the political environment, but evidence of such an enabling architecture would be strategically more important for intelligence.
Within the hybrid domain, a successful sabotage operation causing prolonged disruption or casualties at a major European defence, energy or transport facility would represent a significant threshold. Attribution would become central. An operation credibly linked to a hostile state would create immediate pressure for deterrent measures while simultaneously testing the boundary between criminal sabotage, terrorism and hostile state action.
Cross-Theatre Risk Interaction
The principal theatres should not be interpreted as isolated systems. Their interaction is primarily cognitive, technological and political rather than command-driven. Operational success in the Sahel or Somalia strengthens narratives of jihadist persistence far beyond those theatres. Gaza, Iran, Western military activity and political crises provide common mobilisation material to organisations that otherwise remain ideologically hostile to one another. Tactical innovations, propaganda formats and technical knowledge migrate digitally without requiring organisational cooperation.
The same applies to strategic shocks. Escalation involving Iran and Israel or the United States could simultaneously activate Iranian-aligned networks, increase Hezbollah and Houthi pressure, intensify Sunni jihadist propaganda and elevate the threat to Western and Jewish interests. These actors would pursue different objectives, but Western security institutions would experience their activity at the same time.
Europe is where this interaction becomes most operationally relevant. Counterterrorism services must address jihadist mobilisation while counterintelligence and law-enforcement structures confront sabotage, hostile intelligence operations, cyber activity and criminal intermediaries. The strategic vulnerability is therefore partly institutional: adversaries need not cooperate if simultaneous threats force governments to divide finite collection, investigative, and protective resources.
Strategic Assessment
The overall strategic risk is assessed as Very-High but geographically uneven. This rating does not imply an imminent global escalation. It reflects the simultaneous presence of three high-intensity insurgent systems, a resilient multi-province Islamic State architecture, an increasingly operational Western jihadist mobilisation environment and persistent hybrid pressure against Europe.
The principal deterioration indicator over the next 90 days would be movement from resilience to strategic effect: insurgents restricting state access, external jihadist networks enabling rather than merely inspiring Western actors, or hybrid operations producing sustained disruption of critical infrastructure.
Executive “So What?”
The September–November threat environment requires a shift from organisation-centric monitoring toward effect-centric intelligence.
Attack counts remain useful, but they no longer adequately measure strategic deterioration. JNIM can increase pressure without capturing territory. TTPs can degrade Pakistani security architecture through hundreds of individually limited attacks. Al-Shabaab can generate strategic effects by combining rural attrition with selective penetration of high-value targets. A European jihadist supporter may become operationally relevant without formal organisational membership. A state actor can generate significant disruption through an intermediary who has little understanding of the wider operation.
For decision-makers, the priority is therefore to identify the point at which persistent activity begins altering state freedom of action. In Africa and Pakistan, this means protecting local intelligence penetration, transport access, security-force resilience and critical nodes rather than focusing exclusively on militant attrition. In Europe, it means detecting behavioural progression from digital mobilisation to capability acquisition. Within the hybrid domain, it requires integrating counterintelligence, counterterrorism, cyber, criminal, and infrastructure-protection intelligence early enough to recognise common vulnerabilities even when the adversaries are unrelated.
The next strategic surprise is unlikely to announce itself through the creation of a new major organisation. It is more likely to emerge when an already visible threat crosses a threshold that existing analytical categories have obscured.
5. Intelligence Monitoring
September–November 2026
Intelligence collection during the forecast period should prioritise changes in capability and intent over fluctuations in propaganda or attack frequency.
Priority Indicators
In the central Sahel, the principal collection requirement is to determine whether JNIM is converting operational reach into persistent strategic isolation. Repeated interdiction of transport routes, fuel and commercial networks, pressure around Bamako or other major centres, attacks against airports and logistical infrastructure, and durable activity toward coastal West Africa would indicate movement beyond conventional rural insurgency. Pay particular attention to whether operations in Niger and the southern Sahel reflect temporary penetration or the establishment of repeatable logistical and recruitment networks.
Within the Islamic State African architecture, simultaneous acceleration should trigger reassessment. A substantial increase in Nigeria, eastern DRC and Mozambique occurring without contraction elsewhere would indicate greater regenerative depth than current aggregate figures suggest. In northwestern Nigeria, official Islamic State attribution, standardised media production, more sophisticated attacks, or persistent connections between Lakurawa-associated networks and established Islamic State structures would materially change the assessment of that emerging theatre.
For Somalia, collection should focus on whether the August al-Shabaab acceleration can be sustained and whether increased activity produces strategic penetration. Attacks against intelligence facilities, major government institutions, aviation infrastructure or international compounds would be more significant than continued increases in routine engagements. Persistent expansion across Garissa, Mandera, Wajir and Lamu would similarly indicate a more durable Kenyan campaign.
Pakistan requires continuous monitoring of TTP operational geography, local intelligence degradation and cross-border escalation. Assassinations of CTD personnel, informants, tribal intermediaries and peace-committee members should be treated as indicators of deliberate counterintelligence shaping. Further expansion around Peshawar or outside the established Khyber Pakhtunkhwa core, increasingly complex attacks against intelligence facilities, greater UAS use and coordinated propaganda following Pakistani operations in Afghanistan would all indicate deterioration.
Syria should be monitored primarily for clandestine regeneration. Recurrent Islamic State activity in Damascus or other urban centres, assassinations of security officials, detention instability, movement of former detainees, sectarian targeting and evidence of multi-governorate coordination would indicate that residual networks are rebuilding operational infrastructure rather than merely exploiting isolated opportunities.
Europe requires a different collection model. The priority should be behavioural progression. Propaganda consumption becomes substantially more relevant when accompanied by movement toward encrypted communities, interaction with known facilitators, technical questions, target research, physical reconnaissance, travel intent, procurement or attempts to acquire weapons and explosive precursors. Common infrastructure or facilitators appearing across separate national investigations should receive immediate strategic attention because they could reveal an enabling layer currently obscured by apparently autonomous cases.
The age profile of suspects should remain a dedicated monitoring variable. The increasing presence of minors and very young adults does not establish a new dominant demographic. Still, it challenges assumptions linking operational capability to long-standing physical participation in extremist milieus.
Hybrid monitoring should prioritise reconnaissance around European defence production, logistics hubs, energy infrastructure and facilities associated with support to Ukraine. Recruitment of financially motivated intermediaries, unexplained fires, drone activity, suspicious procurement, cryptocurrency payments and recurring handlers across apparently unrelated incidents would increase confidence that sabotage activity is being organised systematically rather than opportunistically.
Iranian and Hezbollah-associated networks require separate monitoring for surveillance of Israeli, Jewish, Iranian opposition and Western targets, unusual financial transfers, courier activity, activation of previously dormant facilitators and changes in operational security. Escalation involving Iran should immediately increase collection on these indicators, even without explicit threat reporting.
Key Intelligence Questions
The central intelligence question in the Sahel is whether JNIM is approaching the point where it can systematically constrain state access to strategically important economic and population centres without attempting conventional territorial seizure. For Islamic State in Africa, the question is whether its distributed provincial architecture can regenerate simultaneously across several fronts.
In Somalia, the critical issue is whether al-Shabaab’s August acceleration represents a temporary surge or the beginning of a higher operational baseline capable of supporting both domestic and Kenyan escalation.
For Pakistan, collection must determine whether TTP’s exceptional tempo is producing measurable degradation of local intelligence and policing rather than merely high attack statistics, and whether IMP is developing autonomous organisational depth.
For Syria, the priority is whether Islamic State can reconstruct urban facilitation networks before the new security architecture closes transitional gaps.
For Europe, the principal KIQ is increasingly consequential: are the numerous disrupted cases predominantly independent manifestations of digital radicalisation, or are common facilitators and transnational enabling networks beginning to provide a more structured operational layer?
Within the hybrid environment, the corresponding question is whether hostile-state reliance on disposable intermediaries is evolving from episodic experimentation into a repeatable European sabotage model.
🔒Executive Intelligence Cycle
This assessment is part of a broader analytical cycle.
Founding subscribers receive the Executive Intelligence Briefing, which integrates all threat assessments, cognitive domain analysis, and a rolling 30–90-day forecast into a single monthly strategic synthesis.
© Daniele Garofalo Monitoring - All rights reserved.
ISSN (International Standard Serial Number): 3103-3520
NATO NCAGE: AX664 (NATO Commercial and Governmental Entity)
UNITED NATIONS Global Marketplace ID: 1210727
ORCID Code: 0009-0006-5289-2874Daniele Garofalo is an independent researcher and analyst specialising in Intelligence, Jihadist Terrorism, Islamist insurgencies, Non-State Armed Groups (NSAG), Cognitive Warfare, and Hybrid Warfare.
His work focuses on continuous intelligence monitoring, threat assessment, and analysis of propaganda and cognitive/information dynamics, with an emphasis on decision-oriented outputs, early warning, and strategic trend evaluation.