ISIS Did Not Disappear. It Decentralized: What the September 29 Intelligence Report Means for America

For years, many Americans have understood the Islamic State through images from Iraq and Syria: black flags, armored vehicles, occupied cities, mass executions and a self-declared caliphate controlling territory.

That version of ISIS was largely dismantled.

The threat was not.

The Islamic State Flash Report published September 29, 2026 presents a terrorist organization that is smaller territorially but increasingly dispersed operationally. It describes disrupted cells in the Middle East, alleged plots and arrests across several continents, online recruitment, youth radicalization and individuals attempting to translate extremist propaganda into violence far from traditional conflict zones.

For the United States, that distinction matters.

The most immediate lesson is not that thousands of ISIS fighters are preparing to invade America. There is no credible evidence supporting that proposition.

The more realistic threat is considerably harder to see:

ISIS no longer needs to physically send a trained terrorist into an American city if it can influence someone already here.

That assessment is not simply the conclusion of one private intelligence report. The 2026 U.S. Intelligence Community assessment states that counterterrorism pressure has reduced the ability of groups such as ISIS and al-Qaida to conduct sophisticated large-scale attacks, pushing them increasingly toward propaganda, virtual recruitment and attempts to inspire or enable individuals with access to Western countries.

That fundamentally changes what terrorism prevention looks like.

The Caliphate Was Defeated. The Network Was Not.

ISIS lost the territorial caliphate it once controlled across large portions of Iraq and Syria. But terrorist organizations do not necessarily disappear when they lose territory.

They adapt.

The July 31, 2026 report of the United Nations Secretary-General concluded that ISIS and its affiliates continued to pose a persistent international security threat while adapting to sustained counterterrorism pressure. U.N.-related reporting describes decentralized networks, regional affiliates and continuing activity despite repeated leadership losses.

The U.S. Intelligence Community estimated in its 2026 Annual Threat Assessment that ISIS still had approximately 12,000 to 18,000 members globally, with much of the movement’s recent growth occurring within local conflicts, particularly in Africa. The assessment also identified ISIS elements in Syria and ISIS-Khorasan in South Asia among those most relevant to potential external plotting.

In Syria alone, the U.N.’s July assessment estimated that ISIS maintained as many as approximately 3,000 fighters. The organization had reportedly begun shifting portions of its activity from remote desert areas toward urban environments while continuing to exploit instability surrounding detention facilities and displaced populations.

None of this means ISIS possesses the military capability it held a decade ago.

It means something different.

Territorial defeat did not eliminate ideological reach.

And ideological reach travels exceptionally well through a smartphone.

The American Threat Has Become More Decentralized

The September 29 flash report emphasizes what counterterrorism agencies have been warning about for years: the distinction between a terrorist organization and the person who ultimately commits an attack is becoming increasingly important.

An individual does not necessarily need to attend a terrorist training camp.

He may never meet an ISIS commander.

He may never leave the United States.

He may consume propaganda, interact with extremist communities online, develop an ideological justification for violence and eventually begin preparing independently.

That is why the terminology matters.

An ISIS-directed attack and an ISIS-inspired attack are not the same thing.

In a directed operation, members or operatives of the organization may exercise meaningful command, planning or logistical control.

In an inspired attack, an individual may act primarily on his own after consuming terrorist propaganda or identifying with the organization.

Between those two categories is an increasingly important gray area: people who begin independently but subsequently communicate online with extremists, facilitators or people claiming affiliation with terrorist organizations.

That ambiguity makes detection significantly more difficult.

The FBI has repeatedly described the challenge presented by individuals who radicalize domestically, mobilize quickly and may have little or no traditional organizational connection for investigators to discover.

America Has Already Seen the Model

This is not theoretical.

On March 9, 2026, the U.S. Department of Justice announced charges against Emir Balat and Ibrahim Kayumi, alleging they attempted to detonate explosive devices during demonstrations outside Gracie Mansion in New York City.

According to federal prosecutors, both men subsequently expressed alignment with ISIS. They were later indicted on federal charges associated with the alleged attack. The charges remain allegations unless proven in court.

Six months later, federal authorities announced another case.

On September 15, 2026, DOJ charged Jonathan Hunter Kramer, 21, of Pennsylvania, alleging that he obtained a firearm and ammunition while preparing for terrorist violence in support of ISIS. According to the criminal complaint summarized by DOJ, investigators alleged that Kramer had used an online identity claiming ISIS affiliation, communicated extremist rhetoric and discussed preparations for what he called a “mission.” He was arrested before any alleged attack occurred and is presumed innocent unless proven guilty.

These cases should not automatically be interpreted as evidence of a coordinated nationwide ISIS cell structure.

They demonstrate something else.

The ideological distance between a terrorist organization overseas and a prospective attacker inside the United States has dramatically collapsed.

The internet provides the bridge.

The Smartphone Is Now Part of the Battlefield

Historically, terrorist recruitment required physical relationships.

Recruiters needed people.

Training required travel.

Propaganda required physical distribution.

Communication was slower and easier to isolate geographically.

That environment no longer exists.

A person sitting in an American bedroom can consume extremist propaganda produced thousands of miles away, interact with ideological communities, enter increasingly private communications channels and encounter material designed to normalize violence.

The 2026 U.S. Intelligence Community assessment specifically notes that al-Qaida and ISIS plotters seeking to threaten the United States have increasingly focused on virtually recruiting U.S.-based aspirants rather than relying exclusively on infiltrating trained foreign operatives.

That is one of the most important counterterrorism developments affecting the American public.

Distance is no longer the protective barrier it once was.

A terrorist organization’s physical headquarters can be destroyed while its propaganda remains globally accessible.

The Age Problem Cannot Be Ignored

One of the most concerning themes in the September 29 report is youth radicalization.

The report describes cases involving teenagers and young adults and highlights what analysts sometimes call a compressed “flash-to-bang” period: the time between observable radicalization and movement toward violence.

The underlying concern is not new.

The FBI warned years ago that successful violent extremists can sometimes progress from radicalization toward violence within months rather than years. The Bureau also observed a declining average age among some foreign-terrorist-organization-inspired plotters.

Modern digital environments potentially accelerate that process.

This has major implications for parents, schools, colleges and community organizations.

The solution is not treating religious conversion, political opinions, cultural identity or adolescent isolation as evidence of terrorism.

They are not.

What matters is behavior associated with movement toward violence.

The FBI’s behavioral-threat guidance specifically cautions that no single behavior proves someone is preparing an attack. Concern increases when multiple behaviors begin converging: communicating violent intentions, developing specific attack plans, testing security, displaying obsessive interest in previous attackers or taking concrete preparatory steps toward violence.

That distinction is essential.

Effective threat recognition is behavioral.

It should not become demographic profiling.

Soft Targets Remain Attractive Because They Are Open

The American public should also understand why public spaces repeatedly appear in terrorism investigations.

Concerts.

Religious institutions.

Public demonstrations.

Retail locations.

Schools.

Transportation systems.

Entertainment districts.

Community gatherings.

These locations exist specifically because people are expected to enter them.

Their openness is part of their purpose.

That also complicates security.

Federal security guidance refers to many of these locations as soft targets and crowded places, where large numbers of people may gather without the security architecture associated with military installations or hardened government facilities. CISA maintains protective-security resources specifically for organizations responsible for these environments.

The March Gracie Mansion case demonstrates another complication: terrorism can intersect with politically or socially contentious public gatherings.

Federal prosecutors alleged that the devices were deployed during competing demonstrations. Whatever the politics of the participants, the security principle remains identical:

A lawful gathering becomes a terrorism target the moment someone decides that ideological disagreement justifies mass violence.

The Constitution protects speech, religious practice, political disagreement, assembly and protest.

It does not protect terrorism.

Religious Institutions Deserve Particular Attention

ISIS propaganda historically has encouraged violence against a variety of civilian, governmental and religious targets.

FBI testimony has specifically noted terrorist propaganda advocating attacks against civilians as well as military, law-enforcement and intelligence personnel.

Religious facilities face a particularly difficult security problem.

Churches, synagogues, mosques, temples and other houses of worship are designed to welcome people rather than operate like fortified compounds.

Security therefore requires balance.

Organizations should know their emergency procedures, establish communication protocols, coordinate with local law enforcement where appropriate and understand basic response plans without turning worship into an atmosphere of permanent fear.

Preparedness does not require paranoia.

It requires planning.

Chemical and Unconventional Threats Expand the Problem

The September flash report also discusses an alleged Canadian investigation involving interest in toxic chemical agents.

The importance of such cases is not that Americans should suddenly expect chemical terrorism on every street corner.

They demonstrate that security planning cannot assume every potential attack will involve the same weapon.

Modern violent extremists explore multiple methods.

The correct public response is not attempting to learn those methods in anticipation of confronting them personally.

It is recognizing genuinely suspicious behavior and allowing trained investigators to determine its significance.

DHS guidance specifically identifies suspicious acquisition or storage of unusual hazardous materials, surveillance of facilities, attempts to obtain sensitive security information and other contextual behaviors as potential indicators warranting attention. Importantly, DHS also stresses that many individual activities can be innocent and must be evaluated within the larger context.

What This Means for Law Enforcement

For law enforcement, the developing threat creates a difficult intelligence problem.

Traditional counterterrorism investigations often looked for networks:

Who is communicating with whom?

Who provided money?

Who trained the operative?

Who arranged travel?

Where is the organization?

Decentralized terrorism can substantially reduce those signatures.

A prospective attacker may radicalize primarily online, communicate with only a handful of people and move from extremist rhetoric toward violence without belonging to a traditional organization.

That increases the importance of Joint Terrorism Task Forces, intelligence sharing, behavioral threat assessment and credible reporting from families, schools, employers and members of the public.

The Kramer case illustrates the potential importance of reporting. DOJ states that investigators received information concerning his behavior months before his September arrest and subsequently continued investigating the matter.

Counterterrorism increasingly becomes an information problem before it becomes a tactical problem.

Once an attack begins, many prevention opportunities have already disappeared.

What This Means for Private Security

Private security organizations should pay attention for the same reason.

The security officer standing outside a religious institution, hospital, event venue, school, corporate office or critical facility may never encounter a terrorist.

But that officer may encounter pre-incident behavior.

Security personnel therefore need more than a uniform and a firearms qualification.

They need training in observation, communication, access control, suspicious-activity recognition, emergency procedures, incident reporting and coordination with law enforcement.

The objective is not to turn security officers into intelligence agents.

It is to ensure they understand when ordinary behavior becomes sufficiently unusual that it should be documented or reported.

A person conducting legitimate photography is not automatically suspicious.

A person asking questions is not automatically suspicious.

A person’s ethnicity or religion is never by itself suspicious.

But repeated efforts to circumvent security, detailed probing of protective procedures, explicit threats, unusual surveillance or multiple behaviors associated with attack preparation can justify attention.

Context matters.

Professional judgment matters.

Training matters.

What Ordinary Americans Should Actually Do

Terrorism reporting inevitably creates a danger of overreaction.

Americans should not start investigating their neighbors.

They should not follow suspicious individuals.

They should not confront someone because of clothing, religion, language or political beliefs.

And they should not attempt to determine whether someone “looks like a terrorist.”

The FBI explicitly advises citizens not to conduct their own investigations or place themselves in danger. Suspicious activity should be reported to appropriate authorities.

The practical standard is straightforward.

Pay attention to behavior.

If someone communicates a credible intention to conduct violence, appears to be actively preparing an attack, conducts suspicious surveillance of a potential target or engages in other behavior presenting a legitimate security concern, report what you actually observed.

Do not embellish it.

Do not diagnose it.

Do not post it on social media first.

Report facts.

For emergencies or an attack in progress, call 911.

The FBI accepts terrorism-related tips through its national tip system and at 1-800-CALL-FBI.

Vigilance Is Not Fear

There is another danger surrounding terrorism: allowing terrorists to achieve psychological effects far beyond their actual operational capability.

Terrorism is designed not merely to kill.

It is designed to frighten populations, dominate news cycles, generate social division and convince millions of people that they are perpetually unsafe.

That makes exaggeration counterproductive.

Americans should understand the threat without inflating it.

The United States possesses extraordinary counterterrorism capabilities. Intelligence agencies, federal investigators, state and local police, international partners and private organizations disrupt threats that the public may never hear about.

The fact that arrests are announced before attacks occur is evidence that prevention mechanisms sometimes work.

But success creates its own danger: complacency.

ISIS does not need to control Mosul or Raqqa to remain dangerous.

It needs communications.

It needs propaganda.

It needs grievances it can exploit.

And ultimately it needs only a very small number of people willing to convert ideology into violence.

The Strategic Lesson

The September 29 report should therefore be read as something larger than a list of arrests and disrupted plots.

It describes the continuing evolution of terrorism.

The Islamic State of 2026 is not the Islamic State of 2015.

The territorial organization was badly damaged.

Its ability to influence violence survived.

America consequently faces a different security problem from the one many people still visualize.

The threat may not arrive through an organized terrorist cell crossing the border under orders from a centralized command structure.

It may already be sitting behind a computer screen somewhere in the United States.

That does not justify panic.

It justifies competence.

Better intelligence.

Better information sharing.

Better behavioral threat recognition.

Better security planning.

Better digital awareness among parents and educators.

And a public capable of recognizing genuine warning signs without confusing suspicion with prejudice.

The United States has spent a quarter-century building extraordinary capabilities for finding terrorist organizations.

The next phase of the problem is increasingly about identifying when terrorist influence reaches an individual before that individual reaches a target.

That is a more decentralized problem.

It is also one that cannot be solved by government alone.