2nd Report March 3rd 2026 - Official For Release

EPS Threat Brief Update #2, 03 March 2026: Text Version

U.S.-Iran Conflict: Domestic Security Implications, Update #2. Date: 03 March 2026, 1500 EST. Prepared by Kawika Rogers. Distribution: Public Release.

Current Domestic Threat Assessment

Assessment: SEVERE. Active military operations against a state actor with confirmed proxy group retaliation, multi-theater escalation, strategic waterway closure, and a confirmed domestic attack with terrorism nexus under FBI investigation. 18,000+ known or suspected terrorists identified inside the United States per NCTC Director testimony.

Situation Summary

On 28 February 2026, the United States and Israel launched joint strikes against Iran (U.S. codename: Operation Epic Fury; Israeli codename: Operation Roaring Lion). Iranian Supreme Leader Ayatollah Ali Khamenei was confirmed killed alongside 40+ senior officials. As of 03 March 1500 EST (Day 4), the Iranian Red Crescent reports 787+ killed in Iran. Six U.S. service members have been killed in action. A 4 to 5 week campaign has been projected. Iran has retaliated with missile and drone strikes against U.S. bases, Israel, and nine nations. The Strait of Hormuz has been functionally closed by the IRGC, with tanker traffic down over 70%. Hezbollah and Iraqi PMF militias have entered the conflict. Israel has expanded ground operations into Lebanon.

Key Developments Since Initial Brief (01 March)

U.S. KIA: Increased from 3 to 6. Three F-15E Strike Eagles mistakenly shot down by Kuwaiti air defenses (all six aircrew recovered), the first coalition friendly fire incident of the campaign. Iranian casualties: 787+ killed per the Iranian Red Crescent. IRGC headquarters destroyed; per CENTCOM, the IRGC no longer has a headquarters.

Succession Prevention: Israel bombed the Assembly of Experts during their session to elect a new Supreme Leader. Israeli special forces conducted a confirmed ground operation inside Iran.

Strait of Hormuz: Functionally closed. IRGC broadcasting VHF warnings. Three vessels struck, one seafarer killed. Supertanker rates hit $423,736 per day, up 94%. Iraq halted Rumaila oil production due to tanker shortage.

Proxy Activation: Hezbollah firing rockets and drones into Israel from Lebanon. Iraqi PMF claimed 23+ drone strikes on U.S. assets in Erbil. Israel deployed ground forces into southern Lebanon. The Houthis have not yet re-engaged but retain long-range strike capability.

Diplomatic: U.S. embassies closed in Saudi Arabia and Kuwait. State Department evacuating non-emergency personnel from six nations. Gulf airspace largely closed.

Economic: Dow dropped 1,000+ points. Gas prices spiked 12 cents in a single day, approaching a $5 national average. Oil analysts warn of $100+ per barrel if Hormuz remains closed.

Analyst Assessment

This is not a limited engagement. The force posture, leadership targeting, regime change rhetoric, and projected 4 to 5 week timeline confirm what the initial indicators suggested on Day 1: this campaign was planned to be sustained from the start. The comparison is not to the Soleimani strike of 2020 or the 12-Day War of June 2025. The appropriate comparison is to the opening phase of Operation Iraqi Freedom. Two carrier strike groups, B-2 stealth bombers, F-35s, F-22s, THAAD systems, and the largest regional concentration of U.S. military firepower in a generation are not deployed for a punitive strike. They are deployed for a strategic campaign with a desired political end state: regime collapse from within.

The Cornered Animal Problem: Iran's conventional military capability is being systematically dismantled. Its supreme leader is dead. Its nuclear program, ballistic missile infrastructure, naval assets, and IRGC command structure have all sustained massive damage across two campaigns in nine months. The Assembly of Experts was bombed while trying to select a successor. Iran faces a leadership vacuum that could lead to fragmented, unpredictable military decision-making. A regime that believes it faces annihilation does not calculate risk the same way a regime that believes it will survive does. The consequence of Iran's miscalculation is not that it becomes less dangerous. It is that it becomes more dangerous, because its remaining options are all asymmetric, all desperate, and all aimed at inflicting maximum pain on the American homeland to compel a ceasefire before the regime collapses entirely.

Iran's Remaining Asymmetric Options: With conventional capabilities degraded, Iran retains three primary asymmetric vectors: proxy forces, maritime disruption, and cyber operations. The initial assessment on 01 March identified a credibility crisis facing Iran's proxy network, and that assessment has been validated. Hezbollah, despite being degraded from 2024 Israeli operations, has entered the fight. Kataib Hezbollah and Iraqi PMF elements have struck U.S. assets. Per NCTC Director testimony, 18,000 known or suspected terrorists have been identified inside the United States, and the NCTC is working with DHS and the FBI to locate and remove them. The U.S. power grid alone presents a catastrophic target set. The government also confirmed it is reviewing the status of Afghan nationals admitted under Operation Allies Welcome after the NCTC identified 2,000 with ties to terrorist organizations, and the Senate Intelligence Committee formally requested a comprehensive review of the vetting process.

On Domestic Threat Indicators: The Austin shooting on 01 March represents exactly the type of domestic event that validates these concerns. The shooter wore Iranian imagery, had Iranian flags and photos of Iranian leaders at his residence, and struck less than 24 hours after Operation Epic Fury launched. FBI JTTF is investigating potential terrorism nexus and self-radicalization. For security planning purposes, the distinction between directed and inspired matters less than the indicator: individuals within the United States are already acting in response to this conflict. Iran has threatened sleeper cell attacks inside the United States, and with the regime facing potential annihilation, the deterrent calculus that previously kept those cells in reserve no longer exists.

What to Watch Next: First, Houthi engagement in the Red Sea. If the Houthis resume maritime attacks, the combination of Hormuz and Bab al-Mandab creates a global shipping crisis unprecedented in modern history. Second, Iranian cyber operations against U.S. infrastructure, the highest-probability asymmetric retaliation vector and the one with the least warning time. Third, additional domestic attacks or disrupted plots.

Recommended Security Posture: Organizations

Physical Security: Increase officer presence at entry points. Implement random bag and vehicle checks. Add vehicle barriers at high-profile facilities. Increase parking structure patrols.

Access Control: Restrict visitor access. Verify all credentials at entry. Temporary badge escort requirements. Revoke dormant access. Brief front desk staff on the threat indicators seen in Austin.

Incident Response: Brief active threat protocols. Verify emergency notification systems. Confirm law enforcement liaison contacts. Run a tabletop exercise modeled on the Austin pattern.

Surveillance: Increase CCTV monitoring. Conduct irregular perimeter sweeps. Brief officers on pre-attack reconnaissance indicators. Report suspicious repeated vehicle passes or photography of entry points.

Personnel: Brief all staff on the elevated threat. Review post orders. Increase shift overlap during high-traffic periods. Ensure current use-of-force and de-escalation training.

Cyber Defense: Patch all systems immediately. Restrict USB and external device use. Increase phishing vigilance; Iranian APT groups are using spearphishing with fake app updates. Verify backup procedures. Report suspicious network activity to IT security.

Executive Protection: Review executive travel protocols. Increase surveillance detection awareness. Verify secure communications. Brief principals on Iranian assassination plot history.

Recommended Security Posture: Individuals and Families

Situational Awareness: Pay attention to your surroundings, especially in crowded public spaces, transit hubs, shopping centers, houses of worship, and entertainment venues. Look for unattended bags, vehicles parked in unusual locations, or individuals exhibiting signs of surveillance. Trust your instincts. If something feels wrong, leave the area and report it.

Know Your Exits: Every time you enter a building, restaurant, or venue, identify at least two exits. Know how to get out of wherever you are without having to think about it.

Emergency Plans: Discuss with your family what to do in an emergency. Designate a rally point and an out-of-state contact person. Ensure all family members know how to call 911 and can describe their location. Keep vehicles fueled above half a tank.

Digital Hygiene: Do not click links in unsolicited emails or texts, especially those referencing the Iran conflict, military updates, or emergency alerts. Iranian cyber groups are actively deploying phishing campaigns disguised as legitimate app updates and government notifications. Verify all communications through official channels.

Report Suspicious Activity: If you see something, say something. Contact local law enforcement or the FBI tip line (1-800-CALL-FBI) for suspicious activity, including individuals making threats related to the conflict, conducting unusual surveillance of buildings or infrastructure, or stockpiling materials.