EPS Threat Brief Update #2 // March 3, 2026 // U.S.-Iran Conflict: Domestic Security Implications

03 March 2026 · 1500 EST · UPDATE #2 · Distribution: Public

Day 4 of Operation Epic Fury. Iran's supreme leader is dead, the Strait of Hormuz is functionally closed, proxy forces have activated, and the first domestic attack with an Iran-linked nexus has already occurred. This is the threat picture.

Domestic Threat Assessment: SEVERE. Active military operations against a state actor with confirmed proxy retaliation, multi-theater escalation, strategic waterway closure, and confirmed domestic attack with terrorism nexus under FBI investigation. 18,000+ known or suspected terrorists identified inside the United States.

Situation Summary

On 28 February 2026, the United States and Israel launched joint strikes against Iran. The U.S. codename is Operation Epic Fury; Israel's is Operation Roaring Lion. Iranian Supreme Leader Ayatollah Ali Khamenei was confirmed killed alongside 40+ senior officials. As of Day 4, the Iranian Red Crescent reports 787+ killed in Iran. Six U.S. service members have been killed in action. President Trump has projected a 4 to 5 week campaign.

Iran has retaliated with missile and drone strikes against U.S. bases, Israel, and nine nations. The Strait of Hormuz has been functionally closed by the IRGC, with tanker traffic down over 70%. Hezbollah and Iraqi PMF militias have entered the conflict. Israel has expanded ground operations into Lebanon.

Key Numbers

• 6 — U.S. KIA

• 787+ — Iranian Killed

• 70%+ — Tanker Traffic Drop

• 18,000+ — Known/Suspected Terrorists in U.S.

Key Developments Since Initial Brief (01 Mar)

U.S. KIA. Increased from 3 to 6. Three F-15E Strike Eagles mistakenly shot down by Kuwaiti air defenses. All six aircrew recovered. First coalition friendly fire incident of the campaign.

Iranian casualties. 787+ killed per Iranian Red Crescent. IRGC headquarters destroyed. CENTCOM stated the IRGC "no longer has a headquarters."

Succession prevention. Israel bombed the Assembly of Experts during their session to elect a new Supreme Leader. Israeli special forces (Mossad) conducted a confirmed ground operation inside Iran.

Strait of Hormuz. Functionally closed. IRGC broadcasting VHF warnings. Three vessels struck, one seafarer killed. Supertanker rates hit $423,736/day (up 94%). Iraq halted Rumaila oil production due to tanker shortage.

Proxy activation. Hezbollah firing rockets and drones into Israel from Lebanon. Iraqi PMF claimed 23+ drone strikes on U.S. assets in Erbil. Israel deployed ground forces into southern Lebanon. Houthis have not yet re-engaged but retain long-range strike capability.

Diplomatic. U.S. embassies closed in Saudi Arabia and Kuwait. State Department evacuating non-emergency personnel from six nations. Gulf airspace largely closed.

Economic. Dow dropped 1,000+ points. Gas prices spiked 12 cents in a single day, approaching $5 national average. Oil analysts warn of $100+/barrel if Hormuz remains closed.

Analyst Assessment

This is not a limited engagement. The force posture, leadership targeting, regime change rhetoric, and projected 4 to 5 week timeline confirm what the initial indicators suggested on Day 1: this campaign was planned to be sustained from the start. The comparison is not to the Soleimani strike of 2020 or the 12-Day War of June 2025. The appropriate comparison is to the opening phase of Operation Iraqi Freedom.

Two carrier strike groups, B-2 stealth bombers, F-35s, F-22s, THAAD systems, and the largest regional concentration of U.S. military firepower in a generation are not deployed for a punitive strike. They are deployed for a strategic campaign with a desired political end state: regime collapse from within.

The Cornered Animal Problem

A regime that believes it faces annihilation does not calculate risk the same way a regime that believes it will survive does. Their remaining options are all asymmetric, all desperate, and all aimed at inflicting maximum pain on the American homeland.

Iran's conventional military capability is being systematically dismantled. Its supreme leader is dead. Its nuclear program, ballistic missile infrastructure, naval assets, and IRGC command structure have all sustained massive damage across two campaigns in nine months. The Assembly of Experts was bombed while trying to select a successor. Iran faces a leadership vacuum that could lead to fragmented, unpredictable military decision-making.

Iran exacerbated every threat and kicked away every opportunity to take an off-ramp. But the consequence of that miscalculation is not that they become less dangerous. It is that they become more dangerous, because their remaining options are all asymmetric, all desperate, and all aimed at compelling a ceasefire before the regime collapses entirely.

Iran's Remaining Asymmetric Options

With conventional capabilities degraded, Iran retains three primary asymmetric vectors: proxy forces, maritime disruption, and cyber operations.

Proxies: The initial assessment on 01 March identified a credibility crisis facing Iran's proxy network. That assessment has been validated. Hezbollah, despite being degraded from 2024 Israeli operations, has entered the fight. Kataib Hezbollah and Iraqi PMF elements have struck U.S. assets. The Houthis remain the critical wildcard. If they re-engage in Bab al-Mandab, it creates a dual maritime chokepoint crisis from Hormuz to Suez unprecedented in modern history.

Cyber: This is Iran's most cost-effective remaining response option. Palo Alto Networks Unit 42 confirmed a surge of 60+ hacktivist groups active as of 02 March, including IRGC-aligned groups that formed an "Electronic Operations Room" within hours of the first strikes. IRGC-affiliated groups (APT33, APT42, Cotton Sandstorm, MuddyWater) have historically probed U.S. critical infrastructure. Power grid attacks, water system intrusions, financial network disruptions, and hack-and-leak operations are all within Iran's demonstrated capability set.

18,000 Known or Suspected Terrorists in the United States

This is the number that should be keeping every security professional awake at night.

NCTC Director Joe Kent testified before the House Homeland Security Committee that at least 18,000 known or suspected terrorists were identified as having entered the United States during the prior administration. Kent was explicit: these are al-Qaeda, ISIS, and affiliated groups. Of those, 2,000 were identified from approximately 88,000 Afghan nationals admitted under Operation Allies Welcome. Kent testified that these individuals were not properly vetted.

The government has also confirmed it is reviewing the status of Afghan nationals admitted under the Biden-era program, after an Afghan national admitted through that program shot and killed a National Guard soldier near the White House in late 2025. The Senate Intelligence Committee, led by Chairman Tom Cotton, formally requested a comprehensive review of the failed vetting process.

On Domestic Threat Indicators

The Austin shooting on 01 March represents exactly the type of domestic event that validates these concerns. The shooter wore Iranian imagery, had Iranian flags and photos of Iranian leaders at his residence, and struck less than 24 hours after Operation Epic Fury launched. FBI JTTF is investigating potential terrorism nexus and self-radicalization. For security planning purposes, the distinction between directed and inspired matters less than the indicator: individuals within the United States are already acting in response to this conflict.

The Atlantic Council has warned that Iran could activate assassination plots, terror attacks, cyberattacks, kidnappings, or sabotage operations against U.S. civilian and military targets. NBC News reported that Iran sent a direct communique to President Trump before the strikes threatening sleeper cell terrorist attacks inside the United States. With the regime now facing potential annihilation, the deterrent calculus that previously kept these cells in reserve no longer exists.

What to Watch Next

1. Houthi engagement in the Red Sea. If the Houthis resume maritime attacks, the combination of Hormuz and Bab al-Mandab creates a global shipping crisis unprecedented in modern history.

2. Iranian cyber operations against U.S. infrastructure. This is the highest-probability asymmetric retaliation vector and the one with the least warning time.

3. Additional domestic attacks or disrupted plots. 18,000 KSTs on U.S. soil, combined with Iran's demonstrated willingness to activate assets when cornered, creates a threat surface that is extremely difficult to fully contain.

4. Iranian succession process. An IRGC faction that believes the regime is collapsing has every incentive to escalate. The most dangerous adversary is one that believes it has nothing left to lose.

Domestic Threat Indicators (Updated)

Austin, TX mass shooting (01 MAR). Ndiaga Diagne, 53, naturalized U.S. citizen from Senegal. Wore "Property of Allah" sweatshirt over Iranian flag undershirt. Quran recovered from vehicle. Search warrant produced Iranian flag and photos of Iranian leaders at residence. FBI JTTF investigating terrorism nexus and self-radicalization. 2 killed, 14 injured, 3 critical. Diagne killed by APD officers.

Known terrorist presence. NCTC Director Joe Kent: 18,000+ known or suspected terrorists in the U.S., including al-Qaeda and ISIS affiliates. 2,000 Afghan nationals with terrorist organization ties from 88,000 admitted under Operation Allies Welcome.

Sleeper cell threat. NBC News reported Iran sent communique to Trump threatening sleeper cell attacks inside U.S. before strikes began. ICE arrested 11 Iranian nationals in the country illegally since strikes began, including an alleged Iranian army sniper.

Federal posture. FBI Director Kash Patel: counterterrorism and counterintelligence teams on high alert. Joint Terrorism Task Forces activated nationwide. NYPD, LAPD, and major metros increasing patrols at sensitive locations. DHS NTAS Bulletin active citing heightened threat environment.

Cyber threats. Unit 42 (Palo Alto Networks): 60+ hacktivist groups active as of 02 March. IRGC-aligned "Electronic Operations Room" formed within hours of strikes. Cotton Sandstorm deploying WezRat malware via spearphishing.

Recommended Security Posture: Organizations

• Physical Security (Immediate): Increase officer presence at entry points. Implement random bag and vehicle checks. Add vehicle barriers at high-profile facilities. Increase parking structure patrols.

• Access Control (Immediate): Restrict visitor access. Verify all credentials at entry. Temporary badge escort requirements. Revoke dormant access. Brief front desk on Iranian-imagery threat indicators from Austin.

• Incident Response (Immediate): Brief active threat protocols. Verify emergency notification systems. Confirm LE liaison contacts. Run tabletop exercise: active shooter with vehicle-borne initiation (Austin pattern).

• Surveillance (High): Increase CCTV monitoring. Irregular perimeter sweeps. Brief officers on pre-attack reconnaissance indicators. Report suspicious repeated vehicle passes or photography of entry points.

• Personnel (High): Brief all staff on elevated threat. Review post orders. Increase shift overlap during high-traffic periods. Ensure current use-of-force and de-escalation training.

• Cyber Defense (High): Patch all systems immediately. Restrict USB/external device use. Increase phishing vigilance (Iranian APT groups using spearphishing with fake app updates). Verify backup procedures. Monitor for WezRat and Cotton Sandstorm indicators.

• Executive Protection (Moderate): Review executive travel protocols. Increase surveillance detection awareness. Verify secure communications. Brief principals on Iranian assassination plot history.

Recommended Security Posture: Individuals & Families

The following guidance is for everyday Americans navigating the current elevated threat environment. These are practical, common-sense measures that reduce risk without requiring specialized training or equipment.

• Situational awareness. Pay attention to your surroundings, especially in crowded public spaces, transit hubs, shopping centers, houses of worship, and entertainment venues. Look for unattended bags, vehicles parked in unusual locations, or individuals exhibiting signs of surveillance. Trust your instincts. If something feels wrong, leave the area and report it.

• Know your exits. Every time you enter a building, restaurant, or venue, identify at least two exits. In the Austin shooting, the attack happened at an outdoor bar. Know how to get out of wherever you are without having to think about it.

• Emergency plans. Discuss with your family what to do in an emergency. Designate a rally point and an out-of-state contact person. Ensure all family members know how to call 911 and can describe their location. Keep vehicles fueled above half tank.

• Digital hygiene. Do not click links in unsolicited emails or texts, especially those referencing the Iran conflict, military updates, or emergency alerts. Iranian cyber groups are actively deploying phishing campaigns disguised as legitimate app updates and government notifications. Verify all communications through official channels.

• Report suspicious activity. If you see something, say something. Contact local law enforcement or the FBI tip line (1-800-CALL-FBI) for suspicious activity. This includes individuals making threats related to the Iran conflict, conducting unusual surveillance of buildings or infrastructure, or stockpiling materials.

• Major events. The FIFA World Cup and U.S. 250th anniversary celebrations are upcoming high-profile events that counterterrorism officials have specifically identified as potential targets. Exercise heightened awareness at all large public gatherings.

This threat brief is based on publicly available, open-source intelligence. It does not contain classified information. Distribution is authorized for public release.

Continuing coverage: U.S.-Iran conflict

• EPS Threat Brief Update #3 // March 5, 2026 // Operation Epic Fury Day 6
• EPS Threat Brief Update #4 // March 7, 2026 // U.S.-Iran Conflict Week 2
• EPS Dispatch // March 30, 2026 // Operation Epic Fury Day 30
• EPS Dispatch // April 14, 2026 // Hormuz Blockade Day 2
• U.S.-Iran Conflict: Domestic Security Implications

About the Author

Kawika Rogers is Managing Partner at Eight Point Solutions LLC, a veteran-led defense consulting and training firm based in Maryland. He served as an Infantry Team Leader in the United States Marine Corps, then directed the Field Training Officer program and served as an Armorer for Triple Canopy at Camp Arifjan and Camp Buehring in support of Operation Inherent Resolve. He has also served in an advisory and operational capacity in Eastern Europe. Rogers holds over 15 instructor certifications in firearms, defensive tactics, and emergency medicine, and studied International Relations and Global Security at American Military University.

Eight Point Solutions LLC 7404 Executive Place, 5th Floor, Suite L-17, Lanham, MD 20706 // rogers@eightpointsolutions.com // eightpointsolutions.com SDVOSB // eightpointsolutions.app // eightpointsolutions-tech.com // SAM UEI: EY34ARER2TD9