The US-Israeli escalation with Iran in 2026, sparked by simultaneous Iranian attacks in late February 2026, has revived old concerns about Tehran’s homeland security threats through its asymmetric capabilities. For the US, the tactical dimension is just one aspect of security; the real issue is how a military engagement with a country labelled for decades as a terrorist state influences the likelihood and nature of retaliatory attacks on the US homeland.
Homeland security officials have come to view the current situation not in terms of war and peace but of pressure. Iran’s proven penchant for using proxies, covert agents and cyber units provides a range of options which do not require attribution back to the Iranian state, making deterrence and response strategies more complex. In this regard, the Iran-linked terrorism threat to the US homeland has evolved from a hypothetical to an ongoing operational threat.
Threat architecture: How Iran-linked risks are structured?
According to US intelligence assessments in 2025-2026, Iran’s approach is hierarchical and involves semi-independent external networks. These include IRGC affiliates, Hezbollah facilitators and criminal network players. The 2026 Annual Threat Assessment notes a continued focus by Iran on surveillance and contingency operations against US officials and infrastructure, especially those involved in implementing sanctions and military operations.
Law enforcement reports consistently highlight the thwarting of various Iran-related plots in recent years, including surveillance, procurement and assassination. A recent point of emphasis remains the 2024 indictment by the US Justice Department of people connected to an Iran Revolutionary Guard Corps (IRGC) plot to target high-profile US political figures, which served to reinforce the impression that the targeting of high-value, symbolic targets remains a concept within Iran’s repertoire.
Proxy networks and indirect escalation pathways
In addition to state-affiliated planning, proxy networks like Hezbollah continue to provide a persistent element of Iran’s influence. These groups have both a high degree of autonomy and ideological congruence, enabling them to act without specific instructions. According to intelligence reporting in 2025, some individuals consider themselves “sleepers” who are operating below the radar but are ready to be activated in times of conflict.
The question is not whether these networks exist in the US, but whether geopolitical tensions trigger activation. Conflict raises the likelihood that minimally connected agents or facilitators may act on their own initiative, which blurs the distinctions between centralised terrorism and opportunistic violence inspired by the conflict.
Institutional readiness and domestic security recalibration
The escalation in 2026 has prompted US security agencies to recalibrate their focus on threats from Iran in the broader context of counterterrorism. The Federal Bureau of Investigation (FBI) has reportedly boosted surveillance of suspected Iranian facilitators and redeployed staff from other areas back to counterterrorism. The Department of Homeland Security, in its 2025 advisories, has encouraged state and local governments to heighten awareness of critical infrastructure, and possible retaliation.
But these changes are taking place in a tight institutional environment. Scarcity of resources and other national security priorities have limited the flexibility of operations, especially in areas that require sustained surveillance and intelligence efforts. Experts note that while widely known threats are given priority, less visible cases may compete for forensics resources.
Cyber operations and non-kinetic pressure points
Cyberspace is one of the most prominent elements of Iran’s asymmetric capability. This includes persistent intelligence assessments from 2015-2016 that credit phishing, network exploration and exfiltration attempts to Iran. These activities are often not aimed at immediate consequences, but rather as positioning, including access mapping and psychological cues.
The dilemma for US homeland security is that cyber operations are not always linked to terrorism. Cyber activities are not always directly related to physical attacks, but can be used as a precursor, enabler or independent pressure tactic, broadening the range of activities associated with the Iran-linked terrorism threat to the US homeland beyond traditional notions of violence.
Political signalling and deterrence dynamics in 2026
The ongoing war also affects the signalling dynamics between the US and Iran. The US government views Iranian statements and the activities of its proxies increasingly through a prism of deterrence, in which ambiguity itself is a tactic. This makes it difficult to respond appropriately, with escalation or weakness as the risks.
In 2025, the Department of Homeland Security (DHS) issued an advisory on the heightened geopolitical tensions with Iran that suggest a higher potential for direct and indirect attempts to target US interests, including individuals and symbols. Such assessments reflect a move away from threat-based and towards risk-based approaches to security.
Meanwhile, there is greater political attention in Washington on preparedness. Congress and oversight committees are concerned about the adequacy of intelligence-sharing, coordination and infrastructure protection in a multi-dimensional threat environment. What’s at stake is not just intent but also the scalability of US systems in the face of increasing threats.
Expanding threat typologies and lone-actor risks
The growing importance of non-state non-directed actors is a crucial development in the Iran-linked terrorism threat. Lone-actor mobilisation, based on ideological affinity or perceived geopolitical injustice, is an important category of threat in homeland security. Compared to traditional plots, these attacks are more difficult to monitor due to their decentralised nature.
Similarly, “hybrid” actors who blend ideological alignment, criminality and facilitation add complexity. Actors can help with intelligence gathering, support or funding without formal membership to a militant group. This adds to attribution challenges and the behaviours that should be tracked for counterterrorism purposes.
Strategic uncertainty and the limits of containment logic
The central policy dilemma in 2026 is whether existing containment strategies: sanctions, intelligence disruption, and targeted interdiction are sufficient in a conflict-driven environment. While these tools have disrupted multiple Iran-linked plots over time, they are less effective against decentralised or opportunistic actions that emerge during periods of heightened geopolitical tension.
US intelligence agencies have consistently emphasised that Iran is unlikely to rely solely on large-scale, centrally coordinated attacks on US soil. Instead, the more probable trajectory involves layered pressure combining cyber activity, proxy-linked signalling, and isolated attempts at physical disruption. This creates a dispersed threat landscape that resists traditional counterterrorism sequencing.
The result is a security environment defined less by singular catastrophic risks and more by cumulative, lower-intensity pressures that require sustained vigilance across multiple domains simultaneously.
As the conflict with Iran continues to evolve through 2026, the question shaping US homeland security planning is not whether retaliation is possible, but how it manifests across overlapping domains of cyber operations, proxy influence, and individual mobilisation, and whether existing institutional frameworks can adapt quickly enough to a threat that does not arrive in a single form but rather as a continuous, shifting pattern of risk.
