Church Security Alert: We Just Went to RED — Here's What You Need to Know

We just raised the alert level for churches nationwide

I MUST APOLOGIZE TO YOU.

I’ve been working on raising the threat level for 3 days. Today was the day I was going to release it and sure enough, there was a complex attack on a synagogue. I wish I had gotten this out earlier. I hope you take this seriously. I had warned that there would be an attack, like the one today, this week. Don’t ignore the warning signs.

Threat Intelligence Briefing
Date: March 10, 2026

Executive Summary

The church security threat level is moving from High (Orange) to Severe (Red). This change reflects a convergence of threat factors, including sustained jihadist incitement against churches, growing concern regarding Iran and its proxies, reporting on possible external signaling to hostile elements outside Iran, and the approach of Easter, when churches become larger, more predictable, and more symbolically significant targets. While recent reporting regarding an Iran-linked drone threat adds to the broader retaliatory picture, the more immediate and likely danger to churches remains lone actors or small cells inspired or directed by ISIS, Al-Qaeda, or Hezbollah-linked elements.

Assessment

Likelihood: Likely

Recommended Red definition:
Red means a severe threat environment exists where credible intelligence or threat indicators suggest attacks against churches could occur in the near term.

Rationale:

• The church threat picture was already elevated due to sustained jihadist messaging and attack encouragement directed at targets inside the United States.

• The Iran threat stream is separate from the Al-Qaeda and ISIS stream, which means churches are not dealing with only one ideological source of danger right now.

• Reporting regarding communications likely originating from Iran raises concern about retaliatory activation of proxy or clandestine elements, even though it does not establish a church-specific plot by itself.

• Easter increases vulnerability because attendance rises, access points become busier, and churches are more visible and predictable during services and related events.

• These factors indicate a more severe threat environment affecting churches during the current period.

Key Judgments:

• The prior High (Orange) posture remains justified by enduring jihadist incitement and the broader pattern of anti-Christian and anti-house-of-worship targeting.

• The current case for Severe (Red) is based on threat convergence, not on one single confirmed operational plot against churches.

• The strongest support for escalation is the combination of sustained jihadist intent, the Iran proxy concern, and the elevated opportunity created by Easter gatherings.

• The reported Iran-linked drone threat adds to the broader retaliatory environment, but it appears more likely directed toward critical infrastructure or other unspecified targets than churches.

• The more immediate and likely danger to churches remains lone actors or small cells inspired or directed by ISIS, Al-Qaeda, or Hezbollah-linked elements.

• Recent violence and threat reporting inside the United States reinforce that the current environment favors lone actor or small-cell violence more than complex, externally directed church-specific attack planning.

• Churches should not interpret Red as proof that a specific local church has been selected for attack.

• Churches should interpret Red as a warning that the environment is serious enough to justify maximum practical vigilance.

What We Know

• Al-Qaeda and ISIS have repeatedly encouraged attacks against Christians, churches, and targets inside the United States.

• The broader U.S.-Iran confrontation has increased concern about proxy activity, retaliatory violence, and asymmetric attacks in the Homeland.

• Reporting regarding communications likely of Iranian origin has raised concern that external signaling may have been sent to hostile elements outside Iran.

• Recent reporting described an Iran-linked drone threat against unspecified targets in California, but the available information suggests that kind of threat is more likely directed at critical infrastructure or other non-church targets.

• Recent incident reporting also reinforces that lone actors and small cells remain the most immediate practical concern inside the United States.

• Houses of worship remain attractive targets because they are open, accessible, routine, and symbolically valuable.

• Easter creates a higher-exposure environment for churches because attendance increases and movement patterns become more predictable.

• A prior interview with a JTTF agent working Hezbollah matters indicated an assessment that a substantial hostile network presence exists in the United States and that those assets could be activated if conflict with Iran escalated.

What We Do Not Know

• We do not know whether the reported communications actually directed attacks, issued activation orders, or had any church-related content.

• We do not know whether any Iranian proxy or sleeper element in the United States has selected churches as a preferred target set in response to the current crisis.

• We do not know whether ISIS or Al-Qaeda supporters are independently planning attacks timed to Easter in the United States.

• We do not know whether federal agencies possess classified threat reporting that is more specific than what has been released publicly.

• We do not know whether the current spike in concern will dissipate quickly or continue to build over the next several weeks.

Scenario Outlook

Most Likely Scenario
A lone actor or small cell conducts an attack against a church, Christian event, or other soft target after being inspired or influenced by ISIS, Al-Qaeda, or Hezbollah-linked messaging. This type of attack requires limited planning, minimal resources, and little outside coordination.

Likely Scenario
A proxy-linked individual or support network inside the United States facilitates or attempts an attack, surveillance, logistics support, or targeting activity tied to the broader Iran conflict. This could include reconnaissance, support to another attacker, or a small directed operation.

Least Likely Scenario
Iran conducts or directly orchestrates a complex attack against a church in the United States. Iran has historically used assassination plots, covert activity, and deniable operations rather than overt attacks on churches.

Indicators and Warnings

• Any reporting showing ISIS, Al-Qaeda, or Hezbollah-linked supporters encouraging attacks on churches, Easter services, pastors, or Christian gatherings.

• Signs of lone actor mobilization such as surveillance, dry runs, online threats, manifesto language, weapons staging, or unusual probing of church operations.

• Additional federal or state bulletins referencing Iranian proxy activity, sleeper assets, retaliatory violence, or attacks against religious institutions.

• Credible reporting of disrupted plots, suspicious surveillance, dry runs, or weapons staging involving churches, Christian schools, or Easter events.

• Online propaganda or chatter from ISIS, Al-Qaeda, Iran-linked actors, or supporters encouraging attacks on churches, pastors, or Easter gatherings.

• Suspicious persons photographing entrances, children’s areas, parking lots, or security positions during services or rehearsals.

• Unusual attempts to test access control, ask detailed security questions, or probe staff schedules, volunteer rotations, or police response times.

• Threats, manifesto language, or social media posts mixing anti-Christian rhetoric with geopolitical grievance over U.S. action against Iran.

Implications for Churches

• Large Easter services, sunrise services, children’s events, and Holy Week gatherings raise exposure because crowds are larger and movement patterns are more predictable.

• Churches with weak entry control, poor communications, or limited parking lot coverage face greater vulnerability.

• Ministries that assume Red means panic will react poorly. Red should mean disciplined vigilance, visible security presence, faster reporting, and tighter coordination.

• Smaller churches are not exempt. A low-resource church can still be targeted because attackers often prefer accessible venues over hardened ones.

Recommendations for Churches

• Double security personnel where possible.

• Place trained, visible security personnel at main entrances and high-traffic exterior areas during all services and events.

• Increase observation of parking lots, children’s ministry areas, and secondary doors.

• Tighten access to non-public areas and keep interior doors to children’s and staff zones controlled.

• Review emergency communications, medical response, and law enforcement notification procedures before each major Easter event.

• Brief greeters, ushers, children’s workers, and security personnel on suspicious behavior indicators and immediate reporting.

• Encourage teams to act early on suspicious behavior rather than waiting for certainty.

• Coordinate with local law enforcement, fusion centers, and nearby churches where practical.

• Avoid alarmist public messaging. The purpose of Red is readiness, not fear.

Downgrade Criteria

This Red designation should be treated as temporary and reassessed immediately after Easter.

The threat level may be reduced from Severe (Red) to High (Orange) if the following conditions are met:

• No credible church-focused attacks or disrupted plots emerge in the United States during the Easter window.

• No new federal, state, or local warnings provide added corroboration of Iranian proxy activation or church targeting.

• No additional intelligence indicators appear showing coordinated mobilization, church surveillance, or attack preparation tied to the current crisis.

• The broader U.S.-Iran confrontation stabilizes rather than escalates.

Biblical Analysis

The biblical tension here is not whether the church should gather or whether it should live in fear. The issue is whether Christians will respond to a real threat environment with sober obedience, orderly preparation, and peace in Christ. Churches should not drift into denial and call it faith, and they should not drift into fear and call it wisdom. Security and worship are not competitors. They serve together so the congregation can gather, worship Christ, and live in peace.

Romans 12:18
If possible, so far as it depends on you, live peaceably with all.

Romans 12:18 keeps the church from adopting a bunker mentality. The goal is not to turn the church into an isolated fortress that sees every outsider as an enemy. The goal is to preserve peaceful worship, keep the doors open, and maintain a Christian witness while still recognizing that evil sometimes intrudes into lawful and public gatherings. This verse reminds church leaders and safety teams that preparation should serve peace, not replace it.

Nehemiah 7:1
Now when the wall had been built and I had set up the doors, and the gatekeepers, the singers, and the Levites had been appointed,

Nehemiah 7:1 is a strong picture of order in the life of God’s people. The gatekeepers are listed alongside the singers and the Levites, right next to those responsible for worship and ministry. That pairing is not accidental. It shows that worship, service, and security each had a place in the ordered life of the covenant community. In a church setting, that should encourage safety teams to see their work as supporting the gathered worship of God, not competing with it.

Nehemiah 4:9
And we prayed to our God and set a guard as a protection against them day and night.

Nehemiah 4:9 shows the proper balance between dependence on God and practical action. The people prayed, and they also set a guard. They did not treat security measures as a substitute for faith, and they did not treat prayer as an excuse to neglect basic protection. That balance is important for churches during elevated threat periods. Prayer must remain central, but prayer does not cancel the responsibility to prepare wisely.

Sources

• Interview with JTTF agent working Hezbollah

• ABC News, Iran may be activating sleeper cells outside the country, alert says

• ABC News, FBI warns Iran aspired to attack California with drones in retaliation for war: Alert

• Fusion Center bulletin, Improvised Explosive Device Attack at NYC Protest

• ABC News, Terrorism motive probed in mass shooting at Austin bar: FBI