HSToday Threat Forecast 2026: Hybrid Extremism and Persistent Violence: Key Terrorism Risks Ahead
Heightened Lone-Actor and Small-Cell Violence Driven by Ideological Hybridity
A defining counterterrorism risk in 2026 is the continued prevalence of lone-actor and small-cell attacks fueled by overlapping ideological, religious, political, and personal grievance motivations. Patterns observed in 2025 demonstrate that individuals increasingly draw selectively from Salafi-jihadist propaganda, domestic extremist narratives, and contemporary geopolitical grievances without formal organizational direction. This ideological hybridity complicates detection and prevention, as perpetrators often fall outside traditional counterterrorism profiles and may radicalize rapidly through online ecosystems. As a result, violence is likely to remain frequent, low-level, and unpredictable, sustaining a persistent baseline of threat rather than discrete waves of coordinated attacks.
Intensification of Localized Insurgency and Mass-Casualty Violence
The 2025 pattern of high-fatality attacks against military bases, security forces, and civilian populations suggests that localized insurgent violence will remain a central feature of the threat landscape in 2026. Jihadist groups are likely to continue prioritizing territorial influence, state erosion, and population control over externally directed mass-casualty operations. In regions such as the Sahel, the Lake Chad Basin, Somalia, Pakistan’s border areas, and parts of the Middle East, these actors will exploit overstretched security forces, declining international military engagement, and unresolved political grievances. Sustained or escalating violence risks deepening humanitarian crises, accelerating displacement, and further undermining already fragile state legitimacy.
Expansion of Permissive Environments and Transnational Spillover
A major counterterrorism risk entering 2026 is the persistence—and potential expansion—of permissive environments that allow jihadist groups to train, regroup, and project influence beyond national borders. Afghanistan, parts of Syria and Iraq, and large areas of the Sahel and Central Africa continue to be characterized by weak governance, limited counterterrorism capacity, and ambiguous political commitments to suppress extremist actors. These conditions enable groups such as Islamic State–Khorasan Province (ISIS-K), ISIS–Sahel, ISIS–Democratic Republic of Congo (ISIS–DRC), and al-Qaeda–affiliated Jama’at Nusrat al-Islam wal-Muslimin (JNIM) to sustain training infrastructures, facilitate cross-border mobility, and inspire or indirectly support attacks abroad. The continued existence of these safe havens increases the likelihood of regional spillover, the circulation of foreign fighters, and the diffusion of tactics and ideology across Asia, Africa, and the Middle East.
Operational Adaptability and Tactical Innovation by Jihadist Groups
Another significant risk lies in the continued operational adaptability of jihadist organizations, which increasingly blend low-cost, accessible weapons with coordinated or multi-phase attacks. The widespread use of improvised explosive devices, vehicle-borne bombs, suicide attacks, and small-arms assaults in 2025 highlights a tactical flexibility that is likely to persist into 2026. These methods lower barriers to entry, complicate early detection, and allow groups to inflict significant casualties without sophisticated infrastructure. As security forces adapt to existing threats, jihadist actors are likely to continue innovating tactically, often blurring the lines between terrorism, insurgency, and criminal activity to evade pressure and maintain momentum.
Symbolic and Opportunistic Attacks Linked to the 25th Anniversary of September 11
The 25th anniversary of the September 11 attacks represents a distinct symbolic risk in 2026, particularly for self-radicalized individuals and small networks seeking ideological validation, notoriety, or commemorative impact. Rather than complex, centrally directed plots, the primary threat is likely to come from opportunistic attacks timed around the anniversary and directed at symbolic or high-visibility targets such as landmarks, transportation hubs, government facilities, or religious sites. Elevated security postures may deter large-scale operations but could also incentivize spontaneous or unsophisticated attacks that exploit crowded public spaces and media attention. Even limited incidents during this period could generate disproportionate psychological and political effects.
Expansion of Digitally Networked Extremism and the 764 Ecosystem
An emerging counterterrorism risk in 2026 is the continued evolution and potential expansion of digitally native extremist networks such as the 764 ecosystem. Unlike traditional terrorist organizations, these networks operate through decentralized online communities, encrypted platforms, and peer-to-peer radicalization, often targeting vulnerable individuals and minors. Their activities frequently blur the boundaries between terrorism, violent extremism, coercive exploitation, and organized criminal behavior. As pressure on formal extremist groups continues, networks like 764 may gain influence by encouraging self-initiated violence, accelerating radicalization trajectories, and inspiring copycat behavior without issuing explicit operational directives—posing a challenge to counterterrorism frameworks oriented toward hierarchical structures and clearly articulated ideologies.
Militarization of Drug Cartels and the Weaponization of Drones
A distinct and growing counterterrorism risk in 2026 is the continued evolution of drug trafficking organizations into hybrid security threats, particularly following their designation as Foreign Terrorist Organizations. Modern cartels operate as adaptive, compartmentalized, and multidimensional networks capable of reconstituting under pressure, blurring the lines between organized crime, insurgency, and terrorism. This transformation is increasingly evident in the use of unmanned aerial systems (UAS) for surveillance, intimidation, smuggling, and direct attacks, situating cartel violence within a hybrid warfare environment. The diffusion of drone tactics—combined with access to explosives, firearms, and cross-border logistics—raises concerns about tactical cross-pollination between criminal and ideological actors, the emergence of factional radicalization, and the normalization of asymmetric methods traditionally associated with terrorist organizations.
