Church Threat Level Has Moved Based on Current Threat Levels
The threat level has changed.
BLUF
The Christian Warrior Training Church Security Threat Level System is being lowered from SEVERE to ELEVATED, effective immediately. The three primary threat vectors that pushed us to SEVERE have each degraded in operational capacity. The lone wolf threat to individual congregations remains constant and is the most statistically probable threat your team will face this year. Maintain your Sunday protocols. This is not a stand-down.
Key Judgments
It is Highly Likely that the lone wolf attacker represents the primary threat to individual congregations in the United States throughout 2026, consistent with every statistical trend from the past decade. It is Likely that ISIS and al-Qaeda will continue publishing lone actor incitement in their official communications, but it is Possible that either organization currently has the operational capacity to execute a directed, coordinated attack against U.S. churches. It is Possible that Iranian proxy networks embedded in the United States could be activated by Tehran under specific geopolitical conditions, but current indicators show those networks are fragmented, their leadership has been significantly degraded, and proxy forces in other theaters have refused activation orders. It is Unlikely that a Hezbollah-directed attack against U.S. congregations is imminent, though Iranian-inspired lone actors remain a secondary concern.
Understanding the CSTLS: How the System Works
The Church Security Threat Level System is not a one-way escalator. Think of it as an elevator. You can be on the second floor and ride straight to the fifth if the threat environment demands it. You can be on the fifth floor and drop to the second when the intelligence supports that decision. There is no requirement to stop at every floor on the way up or on the way down.
When CWT raised the threat level to SEVERE following ISIS threat indicators targeting Christian congregations during the Easter season, the intelligence supported that call. The al-Naba newsletter had published direct incitement, the holiday window represented a high-value target period for symbolic attacks, and multiple threat vectors were active simultaneously. That posture was the right call at the time.
The elevator is now moving down. Not because the threat has disappeared, but because the specific conditions that put us on the fifth floor have changed. ELEVATED is the floor the current intelligence supports. That can change in either direction at any time.
Threat Vector Assessment
Vector 1: ISIS and al-Qaeda
Both organizations have continued publishing lone actor incitement in official communications, including al-Naba newsletter guidance calling on supporters to act independently
Every directed plot against U.S. targets in the current cycle has been interdicted by federal law enforcement
The shift to lone actor messaging is itself an intelligence indicator: it reflects organizational inability to run coordinated cells, not a reduction in intent
The primary ISIS and al-Qaeda threat to Christian congregations right now is in Europe, where operational capacity and geographic access are significantly higher
U.S. threat from these organizations: Likely, lone actor inspired; Unlikely, directed cell operation
Vector 2: Iranian Proxies
At least one attack connected to an Iranian-inspired individual occurred against a synagogue; the attacker had a family member killed in an Israeli airstrike and acted on personal grievance, not Hezbollah direction
That incident was lone wolf, not proxy-directed, and should be assessed accordingly
Iranian proxy networks remain embedded in the United States in significant numbers, a fact CWT has documented previously
However, proxy forces in Iraq and other Middle Eastern theaters have refused Iranian activation orders, indicating command and control fractures
Israeli operations have significantly degraded Hezbollah leadership, disrupting the organizational capacity to coordinate foreign operations
These networks can reconstitute. Degraded does not mean dismantled.
U.S. threat from Iranian proxies: Possible; activation dependent on Iranian strategic calculation and geopolitical trigger
Vector 3: Lone Wolf Actors
This vector does not de-escalate. It does not have an off-season.
History is unambiguous: the most likely attacker to walk through your church doors on a Sunday morning is a lone individual acting on personal grievance, mental illness, ideological radicalization, or domestic conflict
This vector is why ELEVATED is the floor and not LOW
No threat brief, no intelligence assessment, and no seasonal calendar changes this reality
U.S. threat from lone wolf actors: Highly Likely on a long enough timeline; unpredictable as to timing and target
What Changed and What Did Not
What changed is the directed threat posture. The Easter window has closed. The specific ISIS incitement cycle that targeted the holiday period has passed its peak. Iranian proxy activation has not materialized domestically despite the geopolitical conditions that could have triggered it. Federal interdiction has continued to disrupt organized plotting.
What did not change is the base threat environment that every church in America operates in every single week. A congregation is a predictable, soft target. Sunday morning is a predictable time. Your address is public. Your service schedule is on your website. None of that changed. The lone wolf attacker does not read CWT threat assessments before choosing a target.
Threat Assessment
The overall threat to individual U.S. congregations is assessed at ELEVATED (Yellow). This assessment reflects the degraded but sustained capacity of foreign terrorist organizations to inspire lone actor violence, the unresolved presence of Iranian proxy networks on U.S. soil, and the persistent and historically documented threat of the lone wolf attacker to soft targets including churches.
The shift from SEVERE to ELEVATED is intelligence-driven, not comfort-driven. Sunday protocols should remain fully staffed. Access control, parking lot coverage, and interior team positioning should be maintained at standard operating levels. ELEVATED does not mean relaxed. It means the specific, directed, holiday-window threat that pushed us to SEVERE has passed, and the ambient threat that your team should always be preparing for remains.
If a credible directed threat surfaces against U.S. congregations, if proxy activation indicators emerge, or if a lone actor attack against a church occurs in your region, expect this level to move. The elevator runs both directions.
Biblical Lens
The men of Issachar are one of the most overlooked models in all of Scripture for what a church security team is supposed to be.
“Of Issachar, men who had understanding of the times, to know what Israel ought to do.” — 1 Chronicles 12:32, ESV
Understanding the times accurately and knowing what the moment requires. The CSTLS exists for exactly that purpose. When the intelligence said SEVERE, we went to SEVERE. When the intelligence says ELEVATED, we go to ELEVATED. The men of Issachar did not hold a fixed position regardless of what was happening around them. They read the environment and they acted accordingly.
Paul makes the same call in Romans:
“Besides this you know the time, that the hour has come for you to wake from sleep.” — Romans 13:11, ESV
Waking from sleep is not a one-time event. It is a posture. Your team does not get to decide that because last Sunday was quiet, this Sunday will be too. You wake up again every week, you read the environment, and you take your position. That is what ELEVATED demands. The watch continues.
I’m thinking the wolves are lying in wait for the shepherds to feel overconfident and not deploy their sheepdogs. The calm before the storm. IMO
Well explained brother Keith