BLUF
The Department of Homeland Security Office of Intelligence and Analysis (DHS I&A) is aware of no specific, credible foreign terrorist or Domestic Violent Extremist (DVE) threat to events associated with the 25th anniversary of the September 11 attacks. September 11, 2026 falls on a Friday. Observances run 11 and 12 September, and the first regular church service after the anniversary is Sunday, 13 September.
Key Judgments
Highly Likely: Foreign Terrorist Organization (FTO) media references 9/11 in propaganda through the anniversary window. DHS states it anticipates an increase.
Highly Likely: Any attack against a church in this window originates with a lone offender or small group using low-capability methods rather than a directed cell.
Likely: Hoax bomb threats and false active shooter calls against churches and public events increase during the window.
Possible: An ISIS-inspired individual attempts an attack against a religious target in the United States during September.
Unlikely: A coordinated, externally directed mass casualty attack occurs on or near the anniversary.
Source
DHS I&A analytic comment on the 25th anniversary of the 9/11 attacks, dated 1 September 2026, drawing on multi-agency threat assessments produced in May, June, July, and August 2026, an assessment from the National Counterterrorism Center (NCTC), and Department of Justice case reporting.
The qualifier DHS attaches to its own finding matters as much as the finding. No specific, credible threat has been identified, and special events with large attendance and amplified media coverage remain attractive to physical, cyber, and hoax threat actors because of that coverage.
Threat Actors
DHS I&A assesses lone offenders and small groups, radicalized online and operating with minimal coordination, as the most significant terrorism threat in the homeland. That judgment comes from an August 2026 multi-agency threat assessment. Their decentralized nature enables rapid mobilization against soft targets, and their motivations run across racial, ethnic, political, religious, anti-government, anti-immigration, and other ideological grievances, which produces a wide array of potential targets and makes the threat difficult to counter.
A July 2026 multi-agency assessment records an uptick over the previous 18 months in attacks by lone actors inspired by Sunni violent extremist ideology.
Two categories appear throughout the reporting. A Lone Offender acts alone or without the witting support of others. A Domestic Violent Extremist (DVE) operates primarily within the United States without direction or inspiration from a foreign terrorist group. DHS uses that second term synonymously with domestic terrorist.
Case Activity, 2026
DateLocationDetail19–20 AugAlbany, NYWoman charged over an alleged ISIS-inspired plot to bomb the New York State CapitolJulFort Worth, TXArrest tied to an alleged ISIS-inspired mass shooting plot targeting Election Day; first Department of Justice case filed before the Alien Terrorist Removal Court (ATRC)JunWayne, NJArrest for attempted material support to ISIS; prosecutors allege the subject discussed attacks on churches5 JunKS / CAThree US citizens arrested for alleged conspiracy to provide material support to ISIS18 MaySan Diego, CAShooting at the Islamic Center of San Diego7 MarNew York, NYTwo arrested after allegedly attempting to detonate two improvised explosive devices outside Gracie Mansion; bomb making materials and attack notes recovered
DHS cites the Albany plot, the San Diego shooting, and the Gracie Mansion attack together as evidence of the threat to religious institutions, public gatherings, and events. Five terrorism cases in six months, and none of them required a foreign organization to move an operative into the country.
Extremist Messaging
February 2026. The official ISIS spokesman published a speech calling for attacks on Jewish and Christian targets everywhere.
March 2026. Al-Qa’ida in the Arabian Peninsula (AQAP) published the 12th edition of its English-language Inspire Guide, praising the ISIS-inspired attack on a Hanukkah celebration at Bondi Beach, Australia, and providing instructions for making explosives.
7 May 2026. AQAP released an English-language video titled “Why Jihadi Operations in the West?” encouraging lone actor attacks and using footage from 9/11 and the 1993 World Trade Center bombing. Assessed by NCTC.
18 August 2026. A pro-ISIS media outlet released a poster commemorating the attacks, closing with a bin Laden quote.
A May 2026 multi-agency public safety awareness report assesses that violent extremist messaging continues to highlight large gatherings and crowded places as attack targets, and that lone actors may attack to commemorate or emulate past attacks or act on published guidance. DHS anticipates increased references to 9/11 in FTO-associated media on or before the anniversary. Christian targets are named directly in the February ISIS speech and in the Wayne, New Jersey case.
Tactics
DHS assesses explosive devices, edged weapons, firearms, and vehicle ramming as likely tactics against special events, based on an August 2026 assessment, because of the vulnerability of crowded venues. The Grand Blanc Township attack in September 2025 used three of the four in a single event: the attacker rammed a pickup into the building, fired into the congregation, and set the structure on fire.
A June 2026 DHS regional perspective report assesses hoax threat perpetrators as increasing in frequency, particularly around high-profile events, because a false bomb threat or false active shooter call disrupts an event, diverts emergency resources, and causes panic at low cost and low risk. For a church, the delivery vector is the office phone line, staff email, or a livestream comment. On 25 August 2026 a pastor in Hayden, Idaho received a threatening email directing recipients to open an attached zip file; the safety team assessed it as a cyber attack rather than a threat of violence. Assign the evacuation decision to one person before that call comes in.
Indicators
Photography of entrances, exits, or security positions
Unexplained questions about security procedures
Bulky clothing inconsistent with the weather or the setting
Social media traffic discussing vulnerabilities or opportunities to disrupt a specific event
Acquisition of weapons, ammunition, or explosive precursors in unusual quantity
Report to your state fusion center and to the CWT Intelligence Platform. The National Network of Fusion Centers comprises 80 DHS-recognized centers, established after 2001 because several agencies each held part of the information and none of them put it together. Churches qualify as private sector reporting partners, and most safety teams have never contacted theirs.
Threat Assessment
The Church Security Threat Level System (CSTLS) holds at HIGH / ORANGE through the anniversary weekend. Nothing in this reporting moves the level. An absence of specific threat reporting is not a downgrade.
It is Highly Likely that FTO propaganda referencing 9/11 circulates through the window and reaches individuals in the United States already inclined toward violence. It is Likely that hoax threats against churches and public gatherings increase through 14 September, and a hoax against a given church is more probable this month than an attack on it. It is Possible that an ISIS-inspired lone offender attempts an attack against a religious target during September; the Albany, Fort Worth, and Wayne cases indicate an active pipeline. It is Unlikely that a coordinated, externally directed operation occurs.
The primary concern for a church safety team is a lone offender with a firearm, edged weapon, or vehicle arriving at a service running larger than normal on an altered schedule. The secondary concern is disruption through hoax threats and cyber attempts against staff email. DHS mitigation guidance, drawn from the 2017 Manchester Arena attack, addresses crowd bottlenecks before an event starts and after it ends rather than during, which places the requirement on the parking lot and on the arrival and departure windows on 13 September.
Biblical Lens
Terrorism is not a modern invention and Scripture does not treat it as one. It appears by tactic, by organization, and by method.
The tactic. Moses tells Israel to remember what Amalek did on the road out of Egypt. Amalek did not meet the fighting men at the front. He attacked Israel when the people were faint and weary and cut down the ones lagging behind, and he did not fear God (Deuteronomy 25:17-18). That is the oldest description of terrorism in the Bible and it is an accurate one. The target was chosen because it was the weakest part of the group, and the purpose was the effect the killing would have on everyone still walking.
The organization. In Acts 21:38, a Roman tribune asks Paul whether he is the Egyptian who stirred up a revolt and led four thousand men of the Assassins into the wilderness. The word translated Assassins is sicarii, the dagger men. Josephus describes them carrying short blades under their cloaks and killing during the festivals in Jerusalem, when the city was packed with worshippers. They used a concealed weapon against a crowded religious gathering, then mixed back into the crowd they had just attacked.
The method. When the Rabshakeh, the field commander sent by Sennacherib, came to the wall of Jerusalem, Hezekiah’s officials asked him to speak Aramaic so the people on the wall would not understand him. He refused, and instead called out in Hebrew in a loud voice so every man sitting on that wall would hear him say their king could not deliver them (2 Kings 18:26-30). The Assyrian army was real. The speech was aimed at the will of the population rather than at the defenses.
The response. Nehemiah faced all three at once. He had threats of attack, he had enemies working to demoralize his people, and he had a work crew that could not stop working.
And we prayed to our God and set a guard as a protection against them day and night.
Nehemiah 4:9. He did both, and the text gives no indication he saw a conflict between them. What follows in that chapter is the operational detail. Half of his men worked while the other half stood with spears, shields, bows, and armor. Every builder wore his sword at his side while he laid stone. The trumpeter stayed beside Nehemiah, and he told the people that wherever they heard the trumpet, they were to rally to that place, because God would fight for them (Nehemiah 4:16-20). He posted a watch, armed the workforce, established an alarm signal, and named a rally point. Then he kept building.
I am more than a little concerned with the apathy I see among my Christian and Jewish friends regarding terrorist threats and acts of violence in our nation. I am not certain about the Jewish community as much, ( I do live right "next door" to one of the largest Jewish communities in the nation. I have many many friends and former co-workers who live in that area.) I may be wrong but I consider it a bit naive for anyone to expect 9-11, which is also Rosh Hashanah, or any other holiday to pass peaceably without incident or to occur "normal as usual". I dont think that the American Church is ready for much. A few good church leaders are preparing their people for general and heightened suffering and persecution. I am not sure whether they are also taking extra precautionary steps with securing their property and their congregations. I hope so. One Canadian church pastor took extra steps towards security after my Canadian friend showed him an email newsletter from you. Keep up the good and great Godly work you are doing. God bless.