The piece from CFR landed in my inbox this morning, and it’s worth your time if you’re running security operations, building programs, or placing the people who do. Twenty-five years past 9/11, the threat picture has fractured in ways that make the early 2000s look almost straightforward. We faced one adversary then; today it’s al-Qaeda franchises, Islamic State networks, Iranian proxies mixing with contract criminals, narco-traffickers now designated as foreign terrorist organizations, and a widening spectrum of domestic actors the FBI calls nihilistic violent extremists. That’s not threat inflation—it’s the environment your teams are operating in.
The drone problem is the most concrete example of the preparedness gap. The FAA documented more than four hundred illegal drone flights over U.S. airports in the first quarter of 2025 alone, and DHS reported roughly one hundred fifty drones per day crossing the southern border during the first half of that year. If you’re responsible for critical infrastructure or installation security, you already know the counter-UAS authorities are a patchwork and the technology is moving faster than policy. Bipartisan legislation to fix that sits in Congress, unfinished. The gap between what drones can do and what we’re authorized to stop them from doing remains wide, and it’s your problem to manage in the meantime.
What strikes me in conversations with cleared executives is how much the recruitment and radicalization mechanics have changed. The Islamic State pulled fifty-three thousand foreign fighters from eighty countries by understanding social media at a level most governments still don’t. Algorithms designed for engagement have been weaponized to move people from curiosity to commitment at speed, and the generations born after 9/11 process content in ways that make peer-to-peer influence devastatingly effective. If you’re building insider threat programs or vetting pipelines, you’re not just looking at travel patterns and associations anymore—you’re contending with ideological shifts that happen in private channels and move faster than traditional indicators can surface.
Iran’s shift to using criminals and contract actors instead of trained operatives is easy to dismiss because the execution has been clumsy, but the model is worth watching. Ideology produces commitment; money produces volume and deniability. The 2026 U.S.-led campaign against Iran, the destruction of heritage sites, the bombing of a girls’ school in Minab that killed one hundred twenty students—these aren’t abstractions to the populations we’re trying to keep from radicalizing. They’re recruitment narratives with footage, and they’ll produce reprisal-minded actors for years. If you’re running counterterrorism programs or threat fusion cells, you’re planning for that second-order effect whether it’s in the strategy document or not.
AI is entering the fight on both sides, and the advantage isn’t settled. Terrorists are using it to fabricate news content, sharpen targeting, and identify subcultures to exploit. Governments have more computational power and can use AI to predict activity and harden defenses, but the gap between capability and deployment is real. The organizations that figure out how to operationalize AI for threat detection and pattern recognition will pull ahead; the ones that treat it as a future problem will find themselves behind actors who are already experimenting in production environments.
The policy attention has drifted in ways that matter for resourcing and leadership pipelines. Counterterrorism was the seventh sub-bullet in the Biden administration’s 2022 National Security Strategy and didn’t make the top eight in the Trump administration’s 2025 version. The 2026 National Counterterrorism Strategy lists narcoterrorists, legacy Islamist groups, and left-wing extremists but gives state-sponsored terrorism and cyberterrorism only passing mentions and omits far-right violent extremists entirely. If you’re trying to build a program or hire for emerging threats, you’re doing it in an environment where the priority signal from the top is inconsistent and the funding is thinner than it was five years ago.
There’s useful work that’s been done over the past twenty-five years on why people join extremist groups and what pulls them away, but it’s not being scaled or resourced the way it should be. The EU’s Digital Services Act is an example of building guardrails; we haven’t done the equivalent here, and the gap shows. If you’re hiring for prevention, resilience, or counter-radicalization roles, you’re looking for people who understand both the technology and the human factors, and that’s a narrow talent pool. The candidates who’ve done community-level intervention work or built content moderation programs with a security lens are worth finding.
The through-line here is that the threat environment has diversified faster than our structures have adapted, and the organizations that recognize that early will be better positioned. If you’re building teams, the people who can map across state and non-state actors, who understand how technology changes radicalization timelines, and who can work in the seams between policy, operations, and technology are the ones you want. They’re also the hardest to find, because the roles are being defined in real time and the track records are still being built.