CWT Threat Level Raised to ORANGE Through July 1

There are converging threat vectors that necessitated the raising of our alert status.

Facebook | X | Instagram | YouTube | LinkedIn | Threads | TikTok

BLUF

CWT is raising the Church Security Threat Level from ELEVATED (Yellow) to HIGH (Orange), effective immediately through July 1, 2026, driven by active intent against Christians from ISIS, ongoing IRGC and HAYI operations against Jewish institutions, and peak summer church programming. There is no named, time-and-place threat to a particular congregation, which is what holds this at High rather than Critical. Church security teams should hold an elevated posture through the World Cup window and the June dates of concern and tighten access control and child-safety procedures for Vacation Bible School and summer programming.

Key Judgments

• Highly Likely: The IRGC-directed HAYI network remains operational overseas and retains intent against Jewish and allied targets despite the May arrest of a senior operative in the United States.

• Highly Likely: Inspired or copycat actors will attempt or conduct attacks on soft targets and large public gatherings in North America during the window, and ISIS messaging now explicitly calls for attacks on Christian targets in the West, which places Christian gatherings inside that target set.

• Likely: The June 11 to July 19 World Cup window, paired with ISIS threats against the Pope and stadium venues, raises the threat to large public and Christian gatherings.

• Likely: Summer church programming increases congregational exposure through predictable schedules, open campuses, and large numbers of children on site.

• Unlikely: A specific, IRGC-directed plot against a named U.S. church materializes within the window based on current reporting.

Why the Threat Level Is Moving to Orange

The level is changing because several threats lineup inside the same calendar window, not because of any single report naming a church. An Iran-backed network using the front group HAYI has carried out roughly twenty attacks and attempted attacks across Europe and the United States and was tied in May to a disrupted plot against a Manhattan synagogue, with Jewish institutions in Los Angeles and Scottsdale also identified as targets. The principal was arrested, but the network and its intent overseas are intact, and with the United States and Iran still trading strikes, that campaign has reason to keep operating here through criminal proxies.

ISIS is pushing the same direction from the other end. On May 30, the official ISIS outlet Halummu released an English poster titled “And Kill Them Wherever You Find Them,” calling on followers to attack Christian and Jewish targets in the West on their own initiative, with knives, firearms, and vehicles, and holding up the December 2025 Bondi Beach attacker as a model to copy (MEMRI, May 31). Pro-ISIS media has also circulated a direct threat against the Pope and World Cup venues tied to the June 11 opening. June is peak summer programming for the American church, and a global mass-gathering event alongside full church campuses in the same weeks is the combination that moves the level.

This posture is built on demonstrated intent, not guesswork. The threat to Christians as a target class is specific and active: ISIS is calling for it by name, and the IRGC, through the HAYI network, is running operations against Jewish institutions, with counterterrorism analysts assessing that the same targeting can extend to Christian supporters of Israel. What is not present is a named threat to a particular U.S. congregation with a time and place, which is the line between High and Critical. The posture is scoped to return to Yellow once the window closes.

Threat Vectors

• IRGC and HAYI: an Iran-directed network with a documented model of paying criminal proxies to strike Jewish and allied targets, infrastructure intact overseas after the May U.S. arrest.

• ISIS and al-Qaida lone actors: jihadist media calling for vehicle, edged-weapon, and firearms attacks, including a May 30 ISIS poster inciting attacks on Christians and Jews in the West and a direct threat against the Pope and World Cup stadiums.

• Large public gatherings: the World Cup and its fan zones drawing crowds and the attention of inspired attackers from June 11 into mid-July.

• Online radicalization: newer, low-moderation social platforms accelerating self-radicalization toward soft-target attacks.

• Seasonal church exposure: Vacation Bible School and day camps placing large numbers of children on open campuses on fixed, published schedules.

Vacation Bible School and Summer Programming

Vacation Bible School is the exposure on your own property, and it is the reason the elevation runs through July 1 rather than stopping with the calendar dates. VBS and day camps bring children to the building in volume, on a schedule you post publicly, often through side and rear doors that get propped open for load-in and pickup. Plan children’s programming as the most protected space on your campus this month: one monitored way in, eyes on the parking lot and the approach, and a hard count of every child from drop-off to pickup.

Recommended Actions

• Work the parking lot and approach routes first, with visible security and trained greeters posted before and after every service and program, because intent reads on the approach before it reaches the door.

• Lock down VBS and camp access to a single monitored entry, with badged check-in and check-out for every child and no exterior doors propped open.

• Walk your active-threat response plan with your team specifically through the VBS rooms and children’s wing, including lockdown, how you move children, and who calls 911.

• Confirm radios and communications work and that any volunteer can push a lockdown alert during children’s programming.

• Coordinate with local law enforcement and with the synagogues and Jewish institutions in your area, and report suspicious surveillance, filming, or door-probing without delay.

• Tighten cyber hygiene against AI-written phishing aimed at staff and volunteers: slow down on unexpected links and payment requests, and verify any financial request through a second channel.

Threat Indicators

These are the developments that would push the level from HIGH (Orange) to CRITICAL (Red), and the conditions for bringing it back down.

• A specific, credible threat naming churches, a Christian event, or a U.S. region.

• An attack on a U.S. congregation or synagogue, or a domestic arrest tied to the HAYI network.

• A completed or attempted attack at a World Cup venue, fan zone, or related mass gathering in North America.

• De-escalation: the level returns to ELEVATED (Yellow) after July 1 if the World Cup window and the June dates of concern pass without a church-specific indicator.

Threat Assessment

CWT assesses the overall threat to U.S. congregations as HIGH (Orange) for the period running now through July 1, 2026. The primary concern is an inspired or copycat lone actor striking a soft target or large gathering with a vehicle, edged weapon, or firearm during the window, which we judge Likely and rising as the tournament opens, the June anniversary dates pass, and ISIS messaging continues to name Christian and Jewish targets in the West. The secondary concern is directed IRGC and HAYI activity; that network is Highly Likely to remain capable and intent against Jewish and allied targets, though a directed strike on a named U.S. church specifically remains Unlikely on current reporting. The elevation reflects demonstrated intent against Christians and active operations against related targets, layered over peak summer programming, rather than a single named plot against one church, and the correct posture is active measures now, focused on children’s programming and the parking lot, with a planned return to ELEVATED (Yellow) once the window closes. Teams that publicly support Israel should take the threat to synagogues seriously for their own posture and coordinate locally.

Biblical Lens

For thus the Lord said to me: “Go, set a watchman; let him announce what he sees.” (Isaiah 21:6, ESV)

The watchman’s job is to look and to report plainly what is there. That is what this brief is, and it is what your team does every week on the property. Set the watch, report what you actually see rather than what fear invents, and give your people a clear picture so they can stand ready.

Take a minute to leave a comment with how your team is adjusting for VBS this month, and share this brief with your pastor and your security team leader so everyone is working from the same posture.