U.S.-Iran Conflict: Week 2 Operational and Domestic Security Update
Day 8 of Operation Epic Fury. Domestic threat assessment downgraded from SEVERE to HIGH. The kinetic threat has not materialized at home, but the systems meant to detect it have been gutted.
Operation Epic Fury has entered its second week with no indication of slowing. U.S. and Israeli strikes continue to escalate across Iran, with CENTCOM reporting over 3,000 targets hit and 43 Iranian warships destroyed since February 28. Iran's offensive capability has been degraded significantly, with ballistic missile output down 90% and drone attacks down 83% from Day 1. The Israeli military claims near-complete air superiority after 2,500 strikes with more than 6,000 weapons, and reports 80% of Iran's air defense systems destroyed.
EPS has downgraded its domestic threat assessment from SEVERE to HIGH. Iran's kinetic capability against the homeland remains limited, with no confirmed coordinated cyber campaign or sleeper cell activation on U.S. soil as of this update. However, the downgrade comes with a critical caveat: the institutional capacity to detect and respond to domestic threats has deteriorated sharply. The White House blocked a joint FBI/DHS/NCTC intelligence bulletin on Friday that was set to warn state and local law enforcement about elevated domestic threats tied to the war. All unclassified intelligence products related to Iran now require White House approval before dissemination. This is not standard procedure. Intelligence products for law enforcement are supposed to be neutral and fact-based, issued without political input. That process has now been broken. The threat level is lower. Our ability to see it coming is also lower.
Massive explosions struck Tehran overnight into Saturday morning. Israel announced a new wave of attacks targeting Tehran and Isfahan. Trump posted this morning that Iran "will be hit very hard" this weekend, with new areas under consideration for "complete destruction and certain death," including areas and groups not previously targeted. The U.S. warned the forthcoming bombing campaign will be the most intense yet.
Iran's President Pezeshkian publicly apologized to Gulf neighbors and announced Iran will stop targeting regional countries unless attacks on Iran originate from there. The IRGC backed the decision. This is a major walk-back after a week of striking Qatar, Bahrain, UAE, Saudi Arabia, and Kuwait. Pezeshkian is losing regional allies and knows it. Trump immediately called it a surrender. Pezeshkian fired back that unconditional surrender is "a dream they must take to the grave."
UAE President Mohamed bin Zayed called Iran "the enemy" on camera for the first time, visiting a hospital treating civilians injured by Iranian strikes. He warned Tehran directly that the UAE is "not easy prey." This is a Gulf Arab head of state picking sides on the record, something that would have been unthinkable a week ago.
Multiple U.S. intelligence sources confirmed that Russia is providing Iran with intelligence on the locations and movements of American troops, ships, and aircraft, including satellite imagery. This is the first confirmed indication that Moscow is actively involved in the fight. Iranian aerial tactics have become more precise since the conflict began, with attacks increasingly focused on U.S. radar sites and command-and-control nodes in a pattern that resembles Russia's air campaign in Ukraine.
The USS Gerald R. Ford has entered theater through the Suez Canal. B-1B Lancers arrived at RAF Fairford in the UK after Prime Minister Starmer approved use of British bases for strikes on Iranian missile sites. The State Department approved a $151.8 million emergency arms sale to Israel for 12,000 1,000-pound bomb bodies. Trump met with major U.S. defense contractors at the White House to discuss expanding weapons production.
Gas prices rose another 9 cents per gallon to $3.41, the largest weekly increase since early March 2022, up 43 cents in one week. Brent crude hit $91/barrel for the first time since October 2023, with U.S. oil up 31% and Brent up 24% this week. Qatar's energy minister warned that Gulf exports could halt entirely within weeks if the war continues, which would throw global energy markets into turmoil. Shipping giant Maersk has suspended Middle East operations. Iran says the Strait of Hormuz remains "open" but has stated it will target any U.S. or Israeli ships attempting passage.
CSIS estimates the first 100 hours cost $3.7 billion, roughly $891 million per day, with $3.5 billion unbudgeted. The Pentagon has not asked Congress for a supplemental spending bill. The administration has given shifting timelines of two to six weeks for the campaign.
This is the section that matters most if you are responsible for security at any level inside the United States. EPS downgraded the domestic assessment to HIGH because the direct kinetic threat has not materialized in a coordinated way. But every indicator below explains why that assessment could change fast, and why the systems meant to warn you are not functioning as designed.
Intelligence Pipeline Compromised
The White House blocked a joint FBI/DHS/NCTC intelligence bulletin titled "A Public Safety Awareness Report: Elevated Threat in the United States During US-Iran Conflict." The five-page report was scheduled for release on March 6. DHS informed the White House against the FBI's wishes, and senior administration officials ordered it held. All unclassified Iran-related intelligence products now require White House review before dissemination. A senior DHS official stated plainly: "They don't want anything getting out that says what they're doing in Iran is raising the threat level at home."
DHS / CISA Capacity Degraded
DHS has lost roughly a third of its employees since January 2025. CISA is operating with reduced staffing due to a funding lapse. CISA's temporary director was reassigned last week after clashing with staff and uploading sensitive documents to ChatGPT. The NTAS website has not been updated since February 17, displaying a notice that it is not being actively managed due to the funding gap. The last NTAS bulletin expired in September 2025 and was never renewed before Epic Fury launched. CNN reported that FBI Director Kash Patel dismissed a dozen agents from CI-12, the DC-based counterintelligence unit responsible for monitoring Iranian threats, days before the war started.
Hacktivist Mobilization
The Multi-State Information Sharing and Analysis Center (MS-ISAC) reports hacktivist organizations outside Iran are mobilizing to target domestic U.S. and allied networks, based on prior guidance from Tehran that if the Supreme Leader was killed, these groups should activate. Palo Alto Networks Unit 42 documented 60+ hacktivist groups active as of March 2, including pro-Russian groups, with multiple Iranian state-aligned personas claiming operations against SCADA/PLC systems. Iran's own internet dropped to 1-4% connectivity, which limits nation-state cyber operations from inside the country, but the proxy hacktivists operating from outside Iran are not constrained by this.
Surveillance Activity Near Military Installations
Naval Support Activity Annapolis issued a BOLO on March 4 for a 51-year-old male photographing the closed Gate 3 entry point at the U.S. Naval Academy, including gates, locks, and empty security personnel areas. The individual was driving a rental vehicle picked up from JFK Airport on February 26, two days before Operation Epic Fury launched, with a return date of March 28 in Phoenix. The Naval Academy suspended general public visitation on February 28 and moved to 100% ID checks. Military installations nationwide are operating at threat level BRAVO.
Aviation Security Incidents
Southwest Airlines Flight 2094 from Nashville to Fort Lauderdale was diverted to Atlanta on Friday night after a security incident. FBI and DHS took over the investigation. SWAT teams boarded the aircraft and removed a male passenger in handcuffs. Passengers were ordered heads down, hands up. No explosives were found. The flight continued after a two-hour delay. EPS assesses this is likely an isolated incident involving a mentally unstable individual rather than an organized cell operation. Actual operational actors do not announce their intentions. However, these incidents consume law enforcement and intelligence resources that are already stretched thin.
White House release or continued suppression of the FBI/DHS/NCTC bulletin
If the bulletin remains held beyond the weekend, it signals the administration has made a deliberate decision to control the domestic threat narrative rather than inform law enforcement.
Houthi re-entry into Red Sea shipping attacks
They have been relatively quiet since Epic Fury launched. Any resumption of attacks on commercial shipping in the Red Sea or Bab el-Mandeb would compound the Hormuz disruption and push energy markets into crisis territory.
Iranian cyber operations against U.S. critical infrastructure
With CISA operating at reduced capacity and the intelligence bulletin pipeline disrupted, the window for a successful cyber operation against water, power, or financial systems is wider than it should be. Watch for hacktivist DDoS campaigns escalating to more destructive attacks.
Russian escalation beyond intelligence sharing
Moscow is already feeding satellite imagery to Tehran. The next step would be active electronic warfare support or direct targeting assistance for Iranian missile launches against U.S. assets.
Mojtaba Khamenei succession timeline
Trump publicly rejected Mojtaba as "unacceptable." If the IRGC pushes him through, expect the U.S. to intensify strikes specifically targeting regime continuity infrastructure. The power vacuum is a destabilizer regardless of outcome.
| Category | Action | Priority |
|---|---|---|
| Threat Intelligence | Do not rely solely on government bulletins for threat awareness. Build your own picture using OSINT, industry ISACs, and private sector threat feeds. The government pipeline has been compromised by political interference. | IMMEDIATE |
| Cyber Defense | Patch all internet-facing systems. Review access controls for OT/ICS environments. Brief staff on phishing indicators associated with Iranian APT groups (Charming Kitten, APT33, APT34). Monitor for anomalous DNS queries and credential harvesting attempts. | IMMEDIATE |
| Physical Security | Increase visible security presence at entry points, especially for facilities near military installations, Jewish/Israeli institutions, or government buildings. Review CCTV coverage and ensure recording systems are operational. | HIGH |
| Incident Response | Review and brief active threat response plans. Ensure communication trees are current. Conduct a tabletop exercise with key personnel if one has not been conducted in the last 90 days. | HIGH |
| Executive Protection | Assess threat profiles for key personnel, particularly those with public-facing roles or ties to defense, energy, or Israeli-affiliated organizations. Vary routes and schedules. | MODERATE |
Stay aware of your surroundings
This is not a platitude. If you see someone photographing security infrastructure, access points, or emergency response equipment, report it to local law enforcement immediately.
Have a communication plan
Know how you will reach family members if cell networks go down or are disrupted. Designate an out-of-area contact everyone checks in with.
Prepare for economic disruption
Gas prices are climbing and will continue to climb. If Gulf exports halt, expect significant increases in fuel, food, and goods prices. Keep vehicles fueled and have a reasonable supply of essentials.
Monitor local news
With the federal intelligence pipeline disrupted, local reporting becomes more important. Pay attention to local law enforcement advisories, suspicious activity reports, and community alerts.
If you see something, say something
The FBI tip line is 1-800-CALL-FBI. The Nationwide SAR Initiative allows reporting through local fusion centers. Do not assume someone else has already reported it.
EPS Threat Response Services
Eight Point Solutions is actively supporting clients with threat-specific services during this elevated threat environment.
Tailored situational awareness briefings for your organization's leadership, security teams, and staff.
Physical and cyber vulnerability assessments calibrated to the current threat environment, with actionable remediation plans.
Monitoring of proxy group activity, domestic threat indicators, and developments relevant to your organization's risk profile.
Practical training for personnel on responding to active shooter, active threat, and workplace violence scenarios.
Staff briefings on phishing identification, social engineering tactics, and Iranian APT group indicators of compromise.
Trained, credentialed security personnel available at short notice. All personnel vetted and trained to Maryland MPCTC standards.
This brief incorporates analysis from: CENTCOM operational statements; Al Jazeera live conflict reporting (March 6-7, 2026); CNN live updates and intelligence reporting; NBC News live updates; Fox News Digital live coverage; Daily Mail investigative reporting on blocked intelligence bulletin; CSIS cost estimates; Palo Alto Networks Unit 42 threat brief (March 2, 2026); MS-ISAC/Center for Internet Security webinar on hacktivist mobilization; Defense One CISA staffing and cyber strategy reporting; CFR homeland security analysis (Bruce Hoffman); Naval Support Activity Annapolis BOLO (March 4, 2026); CISA/FBI/DC3/NSA joint fact sheet on Iranian cyber actors; Ryan Geho Substack analysis (March 7, 2026); IBTimes reporting on blocked bulletin details; CBS12/Atlanta PD reporting on Southwest Flight 2094 incident; and open-source intelligence monitoring.