U.S.-Iran Conflict: Domestic Security Implications

Day 4 of Operation Epic Fury. Iran's supreme leader is dead, the Strait of Hormuz is functionally closed, proxy forces have activated, and the first domestic attack with an Iran-linked nexus has already occurred. This is the threat picture.

Kawika Rogers | Managing Partner, Eight Point Solutions LLC 03 March 2026 · 1500 EST | Update #2 | Distribution: Public

🔴 CURRENT DOMESTIC THREAT ASSESSMENT: SEVERE Active military operations against a state actor with confirmed proxy retaliation, multi-theater escalation, strategic waterway closure, and confirmed domestic attack with terrorism nexus under FBI investigation. 18,000+ known or suspected terrorists identified inside the United States.

Situation Summary

On 28 February 2026, the United States and Israel launched joint strikes against Iran. The U.S. codename is Operation Epic Fury; Israel's is Operation Roaring Lion. Iranian Supreme Leader Ayatollah Ali Khamenei was confirmed killed alongside 40+ senior officials. As of Day 4, the Iranian Red Crescent reports 787+ killed in Iran. Six U.S. service members have been killed in action. President Trump has projected a 4 to 5 week campaign.

Iran has retaliated with missile and drone strikes against U.S. bases, Israel, and nine nations. The Strait of Hormuz has been functionally closed by the IRGC, with tanker traffic down over 70%. Hezbollah and Iraqi PMF militias have entered the conflict. Israel has expanded ground operations into Lebanon.

Metric	Figure
U.S. KIA	6
Iranian Killed (Red Crescent)	787+
Tanker Traffic Drop	70%+
Known/Suspected Terrorists in U.S.	18,000+

Key Developments Since Initial Brief (01 Mar)

U.S. KIA Increased from 3 to 6. Three F-15E Strike Eagles mistakenly shot down by Kuwaiti air defenses. All six aircrew recovered. First coalition friendly fire incident of the campaign.

Iranian Casualties 787+ killed per Iranian Red Crescent. IRGC headquarters destroyed. CENTCOM stated the IRGC "no longer has a headquarters."

Succession Prevention Israel bombed the Assembly of Experts during their session to elect a new Supreme Leader. Israeli special forces (Mossad) conducted a confirmed ground operation inside Iran.

Strait of Hormuz Functionally closed. IRGC broadcasting VHF warnings. Three vessels struck, one seafarer killed. Supertanker rates hit $423,736/day (up 94%). Iraq halted Rumaila oil production due to tanker shortage.

Proxy Activation Hezbollah firing rockets and drones into Israel from Lebanon. Iraqi PMF claimed 23+ drone strikes on U.S. assets in Erbil. Israel deployed ground forces into southern Lebanon. Houthis have not yet re-engaged but retain long-range strike capability.

Diplomatic U.S. embassies closed in Saudi Arabia and Kuwait. State Department evacuating non-emergency personnel from six nations. Gulf airspace largely closed.

Economic Dow dropped 1,000+ points. Gas prices spiked 12 cents in a single day, approaching $5 national average. Oil analysts warn of $100+/barrel if Hormuz remains closed.

Analyst Assessment

This is not a limited engagement. The force posture, leadership targeting, regime change rhetoric, and projected 4 to 5 week timeline confirm what the initial indicators suggested on Day 1: this campaign was planned to be sustained from the start. The appropriate comparison is not to the Soleimani strike of 2020 or the 12-Day War of June 2025 — it is to the opening phase of Operation Iraqi Freedom.

Two carrier strike groups, B-2 stealth bombers, F-35s, F-22s, THAAD systems, and the largest regional concentration of U.S. military firepower in a generation are not deployed for a punitive strike. They are deployed for a strategic campaign with a desired political end state: regime collapse from within.

The Cornered Animal Problem

A regime that believes it faces annihilation does not calculate risk the same way a regime that believes it will survive does. Their remaining options are all asymmetric, all desperate, and all aimed at inflicting maximum pain on the American homeland.

Iran's conventional military capability is being systematically dismantled. Its supreme leader is dead. Its nuclear program, ballistic missile infrastructure, naval assets, and IRGC command structure have all sustained massive damage across two campaigns in nine months. The Assembly of Experts was bombed while trying to select a successor. Iran faces a leadership vacuum that could lead to fragmented, unpredictable military decision-making.

Iran exacerbated every threat and rejected every off-ramp. The consequence of that miscalculation is not that they become less dangerous — it is that they become more dangerous, because their remaining options are all asymmetric, all desperate, and all aimed at compelling a ceasefire before the regime collapses entirely.

Iran's Remaining Asymmetric Options

With conventional capabilities degraded, Iran retains three primary asymmetric vectors:

Proxies: Hezbollah has entered the fight despite 2024 degradation. Kataib Hezbollah and Iraqi PMF elements have struck U.S. assets. The Houthis remain the critical wildcard — if they re-engage in Bab al-Mandab, it creates a dual maritime chokepoint crisis unprecedented in modern history.
Cyber: Iran's most cost-effective remaining response option. Palo Alto Networks Unit 42 confirmed a surge of 60+ hacktivist groups active as of 02 March, including IRGC-aligned groups that formed an "Electronic Operations Room" within hours of the first strikes. IRGC-affiliated groups (APT33, APT42, Cotton Sandstorm, MuddyWater) have historically probed U.S. critical infrastructure. Power grid attacks, water system intrusions, financial network disruptions, and hack-and-leak operations are all within Iran's demonstrated capability set.
Sleeper Cell Activation: Iran sent a direct communique to President Trump before the strikes threatening sleeper cell terrorist attacks inside the United States. With the regime now facing potential annihilation, the deterrent calculus that previously kept these cells in reserve no longer exists.

18,000 Known or Suspected Terrorists in the United States

This is the number that should be keeping every security professional awake at night.

NCTC Director Joe Kent testified before the House Homeland Security Committee that at least 18,000 known or suspected terrorists were identified as having entered the United States during the prior administration — explicitly including al-Qaeda, ISIS, and affiliated groups. Of those, 2,000 were identified from approximately 88,000 Afghan nationals admitted under Operation Allies Welcome, who Kent testified were not properly vetted.

The Senate Intelligence Committee, led by Chairman Tom Cotton, formally requested a comprehensive review of the failed vetting process following the confirmed killing of a National Guard soldier near the White House by an Afghan national admitted through that program in late 2025.

On Domestic Threat Indicators

The Austin shooting on 01 March validates these concerns. The shooter wore Iranian imagery, had Iranian flags and photos of Iranian leaders at his residence, and struck less than 24 hours after Operation Epic Fury launched. FBI JTTF is investigating potential terrorism nexus and self-radicalization.

For security planning purposes, the distinction between directed and inspired matters less than the indicator: individuals within the United States are already acting in response to this conflict.

What to Watch Next

01 — Houthi Engagement in the Red Sea If the Houthis resume maritime attacks, the combination of Hormuz and Bab al-Mandab creates a global shipping crisis unprecedented in modern history.

02 — Iranian Cyber Operations Against U.S. Infrastructure This is the highest-probability asymmetric retaliation vector and the one with the least warning time.

03 — Additional Domestic Attacks or Disrupted Plots 18,000 KSTs on U.S. soil, combined with Iran's demonstrated willingness to activate assets when cornered, creates a threat surface that is extremely difficult to fully contain.

04 — Iranian Succession Process An IRGC faction that believes the regime is collapsing has every incentive to escalate. The most dangerous adversary is one that believes it has nothing left to lose.

Domestic Threat Indicators (Updated)

Austin, TX Mass Shooting — 01 MARNdiaga Diagne, 53, naturalized U.S. citizen from Senegal. Wore "Property of Allah" sweatshirt over Iranian flag undershirt. Quran recovered from vehicle. Search warrant produced Iranian flag and photos of Iranian leaders at residence. FBI JTTF investigating terrorism nexus and self-radicalization. 2 killed (Ryder Harrington, 19; Savitha Shan, 21), 14 injured, 3 critical. Third victim expected to be taken off life support. Diagne killed by APD officers.

Known Terrorist Presence NCTC Director Joe Kent: 18,000+ known or suspected terrorists in the U.S., including al-Qaeda and ISIS affiliates. 2,000 Afghan nationals with terrorist organization ties from 88,000 admitted under Operation Allies Welcome. Government reviewing all admissions. Senate Intelligence Committee formally requesting comprehensive vetting review.

Sleeper Cell Threat NBC News reported Iran sent communique to Trump threatening sleeper cell attacks inside U.S. before strikes began. Former FBI Assistant Director Swecker described the situation as a "tinder box" with Iranian leadership in a state of desperation. Gov. Abbott warned sleeper cells must be taken seriously. ICE arrested 11 Iranian nationals in the country illegally since strikes began, including an alleged Iranian army sniper.

Federal Posture FBI Director Kash Patel: counterterrorism and counterintelligence teams on high alert. Joint Terrorism Task Forces activated nationwide. NYPD, LAPD, and major metros increasing patrols at sensitive locations. DHS NTAS Bulletin active citing heightened threat environment.

Cyber Threats Unit 42 (Palo Alto Networks): 60+ hacktivist groups active as of 02 March. IRGC-aligned "Electronic Operations Room" formed within hours of strikes. Cotton Sandstorm deploying WezRat malware via spearphishing. APT IRAN claiming sabotage of Jordanian infrastructure. Iran-aligned hackers claimed attack on Truth Social. Check Point confirmed pre-staged malware identified before strikes began.

Category	Recommended Action	Priority
Physical Security	Increase officer presence at entry points. Implement random bag and vehicle checks. Add vehicle barriers at high-profile facilities. Increase parking structure patrols.	🔴 IMMEDIATE
Access Control	Restrict visitor access. Verify all credentials at entry. Temporary badge escort requirements. Revoke dormant access. Brief front desk on Iranian-imagery threat indicators from Austin.	🔴 IMMEDIATE
Incident Response	Brief active threat protocols. Verify emergency notification systems. Confirm LE liaison contacts. Run tabletop exercise: active shooter with vehicle-borne initiation (Austin pattern).	🔴 IMMEDIATE
Surveillance	Increase CCTV monitoring. Irregular perimeter sweeps. Brief officers on pre-attack reconnaissance indicators. Report suspicious repeated vehicle passes or photography of entry points.	🟠 HIGH
Personnel	Brief all staff on elevated threat. Review post orders. Increase shift overlap during high-traffic periods. Ensure current use-of-force and de-escalation training.	🟠 HIGH
Cyber Defense	Patch all systems immediately. Restrict USB/external device use. Increase phishing vigilance. Verify backup procedures. Monitor for WezRat and Cotton Sandstorm indicators.	🟠 HIGH
Executive Protection	Review executive travel protocols. Increase surveillance detection awareness. Verify secure communications. Brief principals on Iranian assassination plot history (Bolton, Pompeo, dissidents).	🟡 MODERATE

EPS Enhanced Services Available

Eight Point Solutions LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) specializing in security training, consulting, and threat intelligence. In response to the current threat environment, EPS is offering:

Threat-Specific Briefings — Customized security officer briefings addressing the Iran conflict, domestic threat indicators, and facility-specific risk factors.
Active Threat Response Training — Refresher courses for firearms-qualified and unarmed personnel. Updated curriculum incorporating the Austin shooting pattern.
Vulnerability Assessments — Site-specific evaluations of physical security, access control, surveillance coverage, and incident response gaps.
OSINT Monitoring — Periodic threat intelligence updates for executive clients. Monitoring of proxy group activity, domestic threat indicators, and regional developments.
Emergency Augmentation Staffing — Trained security personnel available at short notice. All personnel vetted, credentialed, and trained to Maryland MPCTC standards.
Cyber Awareness Training — Staff briefings on phishing identification, social engineering tactics, and Iranian APT group indicators.

Reference Material

This brief incorporates analysis from: CENTCOM operational statements; Iranian Red Crescent casualty reporting; NCTC Director Joe Kent testimony before House Homeland Security Committee (Dec 2025); CSIS "Operation Epic Fury" and "Regional Reverberations" reports (01–02 March 2026); Atlantic Council expert reaction panel; Palo Alto Networks Unit 42 "Escalation of Cyber Risk Related to Iran" threat brief (02 March 2026); Check Point Research Iranian cyber ecosystem analysis; The Register cyber threat reporting; Middle East Forum Iran strike scenario analysis; DHS NTAS Bulletins; FBI JTTF public statements; Stimson Center Houthi analysis; UKMTO maritime incident reports; Senate Intelligence Committee Afghan vetting correspondence; and open-source intelligence monitoring.

This threat brief is provided for informational purposes and is based on publicly available, open-source intelligence. It does not contain classified information. Distribution is authorized for public release.

Eight Point Solutions LLC | 7404 Executive Place, Suite 400, Lanham, MD 20706 info@eightpointsolutions.com · (410) 525-5775 · www.eightpointsolutions.com SDVOSB Certified · SAM UEI: EY34ARER2TD9