U.S.-Iran Conflict Week 2 — Mar 7, 2026 Brief

07 March 2026 · 1530 EST · UPDATE #3 · Distribution: Public

Dignified Transfer / Dover Air Force Base. Six American service members killed in action during Operation Epic Fury are being received at Dover AFB today. These are the first U.S. combat deaths of this conflict, killed by Iranian drone and missile strikes on U.S. facilities in Kuwait. Whatever your position on this war, these six gave everything. God bless them and their families.

U.S.-Iran Conflict: Week 2 Operational and Domestic Security Update

Day 8 of Operation Epic Fury. Domestic threat assessment downgraded from SEVERE to HIGH. The kinetic threat has not materialized at home, but the systems meant to detect it have been gutted.

Domestic Threat Assessment: HIGH (downgraded from SEVERE). Iran's offensive capability degraded 90% on missiles, 83% on drones. No coordinated cyber campaign or sleeper cell activation confirmed on U.S. soil. However, domestic vulnerability has increased: White House blocked joint FBI/DHS/NCTC threat bulletin, CISA at reduced capacity, CI-12 counterintelligence unit gutted pre-war. The threat is lower. Our ability to see it coming is also lower.

Key Numbers

1,332+ — Killed in Iran
3,000+ — Targets Struck
43 — Iranian Ships Sunk
$891M — Cost Per Day
$91/bbl — Brent Crude

Executive Summary

Operation Epic Fury has entered its second week with no indication of slowing. U.S. and Israeli strikes continue to escalate across Iran, with CENTCOM reporting over 3,000 targets hit and 43 Iranian warships destroyed since February 28. Iran's offensive capability has been degraded significantly, with ballistic missile output down 90% and drone attacks down 83% from Day 1. The Israeli military claims near-complete air superiority after 2,500 strikes with more than 6,000 weapons, and reports 80% of Iran's air defense systems destroyed.

EPS has downgraded its domestic threat assessment from SEVERE to HIGH. Iran's kinetic capability against the homeland remains limited, with no confirmed coordinated cyber campaign or sleeper cell activation on U.S. soil as of this update. However, the downgrade comes with a critical caveat: the institutional capacity to detect and respond to domestic threats has deteriorated sharply. The White House blocked a joint FBI/DHS/NCTC intelligence bulletin on Friday that was set to warn state and local law enforcement about elevated domestic threats tied to the war. All unclassified intelligence products related to Iran now require White House approval before dissemination. This is not standard procedure. Intelligence products for law enforcement are supposed to be neutral and fact-based, issued without political input. That process has now been broken.

Battlefield Update

Escalation continues. Massive explosions struck Tehran overnight into Saturday morning. Israel announced a new wave of attacks targeting Tehran and Isfahan. Trump posted this morning that Iran "will be hit very hard" this weekend, with new areas under consideration for "complete destruction and certain death," including areas and groups not previously targeted. The U.S. warned the forthcoming bombing campaign will be the most intense yet.

Iran pulls back on Gulf strikes. Iran's President Pezeshkian publicly apologized to Gulf neighbors and announced Iran will stop targeting regional countries unless attacks on Iran originate from there. The IRGC backed the decision. This is a major walk-back after a week of striking Qatar, Bahrain, UAE, Saudi Arabia, and Kuwait. Pezeshkian is losing regional allies and knows it. Trump immediately called it a surrender. Pezeshkian fired back that unconditional surrender is "a dream they must take to the grave."

UAE President goes public. UAE President Mohamed bin Zayed called Iran "the enemy" on camera for the first time, visiting a hospital treating civilians injured by Iranian strikes. He warned Tehran directly that the UAE is "not easy prey." This is a Gulf Arab head of state picking sides on the record, something that would have been unthinkable a week ago.

Russia feeding targeting data. Multiple U.S. intelligence sources confirmed that Russia is providing Iran with intelligence on the locations and movements of American troops, ships, and aircraft, including satellite imagery. This is the first confirmed indication that Moscow is actively involved in the fight. Iranian aerial tactics have become more precise since the conflict began, with attacks increasingly focused on U.S. radar sites and command-and-control nodes in a pattern that resembles Russia's air campaign in Ukraine.

Force expansion. The USS Gerald R. Ford has entered theater through the Suez Canal. B-1B Lancers arrived at RAF Fairford in the UK after Prime Minister Starmer approved use of British bases for strikes on Iranian missile sites. The State Department approved a $151.8 million emergency arms sale to Israel for 12,000 1,000-pound bomb bodies. Trump met with major U.S. defense contractors at the White House to discuss expanding weapons production.

Economic Impact

Gas prices rose another 9 cents per gallon to $3.41, the largest weekly increase since early March 2022, up 43 cents in one week. Brent crude hit $91/barrel for the first time since October 2023, with U.S. oil up 31% and Brent up 24% this week. Qatar's energy minister warned that Gulf exports could halt entirely within weeks if the war continues, which would throw global energy markets into turmoil. Shipping giant Maersk has suspended Middle East operations. Iran says the Strait of Hormuz remains "open" but has stated it will target any U.S. or Israeli ships attempting passage.

CSIS estimates the first 100 hours cost $3.7 billion, roughly $891 million per day, with $3.5 billion unbudgeted. The Pentagon has not asked Congress for a supplemental spending bill. The administration has given shifting timelines of two to six weeks for the campaign.

Domestic Threat Picture

This is the section that matters most if you are responsible for security at any level inside the United States. EPS downgraded the domestic assessment to HIGH because the direct kinetic threat has not materialized in a coordinated way. But every indicator below explains why that assessment could change fast, and why the systems meant to warn you are not functioning as designed.

Intelligence pipeline compromised. The White House blocked a joint FBI/DHS/NCTC intelligence bulletin titled "A Public Safety Awareness Report: Elevated Threat in the United States During US-Iran Conflict." The five-page report was scheduled for release on March 6. DHS informed the White House against the FBI's wishes, and senior administration officials ordered it held. All unclassified Iran-related intelligence products now require White House review before dissemination. A senior DHS official stated plainly: "They don't want anything getting out that says what they're doing in Iran is raising the threat level at home."

DHS / CISA capacity degraded. DHS has lost roughly a third of its employees since January 2025. CISA is operating with reduced staffing due to a funding lapse. CISA's temporary director was reassigned last week after clashing with staff and uploading sensitive documents to ChatGPT. The NTAS website has not been updated since February 17, displaying a notice that it is not being actively managed due to the funding gap. The last NTAS bulletin expired in September 2025 and was never renewed before Epic Fury launched. CNN reported that FBI Director Kash Patel dismissed a dozen agents from CI-12, the DC-based counterintelligence unit responsible for monitoring Iranian threats, days before the war started.

Hacktivist mobilization. The Multi-State Information Sharing and Analysis Center (MS-ISAC) reports hacktivist organizations outside Iran are mobilizing to target domestic U.S. and allied networks, based on prior guidance from Tehran that if the Supreme Leader was killed, these groups should activate. Palo Alto Networks Unit 42 documented 60+ hacktivist groups active as of March 2, including pro-Russian groups, with multiple Iranian state-aligned personas claiming operations against SCADA/PLC systems. Iran's own internet dropped to 1-4% connectivity, which limits nation-state cyber operations from inside the country, but the proxy hacktivists operating from outside Iran are not constrained by this.

Surveillance activity near military installations. Naval Support Activity Annapolis issued a BOLO on March 4 for a 51-year-old male photographing the closed Gate 3 entry point at the U.S. Naval Academy, including gates, locks, and empty security personnel areas. The individual was driving a rental vehicle picked up from JFK Airport on February 26, two days before Operation Epic Fury launched, with a return date of March 28 in Phoenix. The Naval Academy suspended general public visitation on February 28 and moved to 100% ID checks. Military installations nationwide are operating at threat level BRAVO.

Aviation security incidents. Southwest Airlines Flight 2094 from Nashville to Fort Lauderdale was diverted to Atlanta on Friday night after a security incident. FBI and DHS took over the investigation. SWAT teams boarded the aircraft and removed a male passenger in handcuffs. Passengers were ordered heads down, hands up. No explosives were found. The flight continued after a two-hour delay. EPS assesses this is likely an isolated incident involving a mentally unstable individual rather than an organized cell operation. Actual operational actors do not announce their intentions. However, these incidents consume law enforcement and intelligence resources that are already stretched thin.

What to Watch / Next 72 Hours

White House release or continued suppression of the FBI/DHS/NCTC bulletin. If the bulletin remains held beyond the weekend, it signals the administration has made a deliberate decision to control the domestic threat narrative rather than inform law enforcement.
Houthi re-entry into Red Sea shipping attacks. They have been relatively quiet since Epic Fury launched. Any resumption of attacks on commercial shipping in the Red Sea or Bab el-Mandeb would compound the Hormuz disruption and push energy markets into crisis territory.
Iranian cyber operations against U.S. critical infrastructure. With CISA operating at reduced capacity and the intelligence bulletin pipeline disrupted, the window for a successful cyber operation against water, power, or financial systems is wider than it should be. Watch for hacktivist DDoS campaigns escalating to more destructive attacks.
Russian escalation beyond intelligence sharing. Moscow is already feeding satellite imagery to Tehran. The next step would be active electronic warfare support or direct targeting assistance for Iranian missile launches against U.S. assets.
Mojtaba Khamenei succession timeline. Trump publicly rejected Mojtaba as "unacceptable." If the IRGC pushes him through, expect the U.S. to intensify strikes specifically targeting regime continuity infrastructure. The power vacuum is a destabilizer regardless of outcome.

Security Recommendations: Organizations

Threat Intelligence (Immediate): Do not rely solely on government bulletins for threat awareness. Build your own picture using OSINT, industry ISACs, and private sector threat feeds. The government pipeline has been compromised by political interference.
Cyber Defense (Immediate): Patch all internet-facing systems. Review access controls for OT/ICS environments. Brief staff on phishing indicators associated with Iranian APT groups (Charming Kitten, APT33, APT34). Monitor for anomalous DNS queries and credential harvesting attempts.
Physical Security (High): Increase visible security presence at entry points, especially for facilities near military installations, Jewish/Israeli institutions, or government buildings. Review CCTV coverage and ensure recording systems are operational.
Incident Response (High): Review and brief active threat response plans. Ensure communication trees are current. Conduct a tabletop exercise with key personnel if one has not been conducted in the last 90 days.
Executive Protection (Moderate): Assess threat profiles for key personnel, particularly those with public-facing roles or ties to defense, energy, or Israeli-affiliated organizations. Vary routes and schedules.

Security Recommendations: Individuals and Families

Stay aware of your surroundings. If you see someone photographing security infrastructure, access points, or emergency response equipment, report it to local law enforcement immediately.
Have a communication plan. Know how you will reach family members if cell networks go down or are disrupted. Designate an out-of-area contact everyone checks in with.
Prepare for economic disruption. Gas prices are climbing and will continue to climb. If Gulf exports halt, expect significant increases in fuel, food, and goods prices. Keep vehicles fueled and have a reasonable supply of essentials.
Monitor local news. With the federal intelligence pipeline disrupted, local reporting becomes more important. Pay attention to local law enforcement advisories, suspicious activity reports, and community alerts.
If you see something, say something. The FBI tip line is 1-800-CALL-FBI. The Nationwide SAR Initiative allows reporting through local fusion centers. Do not assume someone else has already reported it.

This threat brief is based on publicly available, open-source intelligence. It does not contain classified information. Distribution is authorized for public release.

Continuing coverage: U.S.-Iran conflict

About the Author

Kawika Rogers is Managing Partner at Eight Point Solutions LLC, a veteran-led defense consulting and training firm based in Maryland. He served as an Infantry Team Leader in the United States Marine Corps, then directed the Field Training Officer program and served as an Armorer for Triple Canopy at Camp Arifjan and Camp Buehring in support of Operation Inherent Resolve. He has also served in an advisory and operational capacity in Eastern Europe. Rogers holds over 15 instructor certifications in firearms, defensive tactics, and emergency medicine, and studied International Relations and Global Security at American Military University.

Eight Point Solutions LLC 7404 Executive Place, 5th Floor, Suite L-17, Lanham, MD 20706 // rogers@eightpointsolutions.com // eightpointsolutions.com SDVOSB // eightpointsolutions.app // eightpointsolutions-tech.com // SAM UEI: EY34ARER2TD9

EPS Threat Brief Update #4 // March 7, 2026 // U.S.-Iran Conflict Week 2