Twenty-five years after the September 11, 2001 attacks, Europe’s terrorist threat has changed fundamentally. The era of large, hierarchically organised operations remains part of the history of modern terrorism, but the contemporary threat is increasingly defined by decentralised initiative, digital exploitation and the capacity of violent extremists to learn and adapt rapidly. According to an assessment from the Soufan Center, jihadism remains the most consequential terrorist threat in the European Union and the United Kingdom in 2026, even as far-right, far-left, anarchist, separatist, nihilistic and conspiracy-driven extremism has gained ground.
The attacks of September 11 represented the apex of hierarchical, centrally directed transnational terrorism. Al-Qaeda’s model depended on deep ideological allegiance, command structures and complex logistics spanning national borders. The successive wave of Islamic State (IS)-directed attacks in Europe from 2015 onwards retained elements of that model, but also lowered the barrier for inspired sympathisers to carry out violence with minimal guidance from a central organisation.
The collapse of Islamic State’s territorial “caliphate” in Iraq and Syria accelerated that transformation. Rather than eliminating the group’s wider project, the loss of territory contributed to a shift towards decentralised franchising, online mobilisation and autonomous action. The result is a terrorist environment in which the organisation itself can become less important than the ideological and technological ecosystem surrounding it.
That transformation is reflected in the declining importance of individual militant leaders. Today, only a small circle of specialists can confidently identify the leaders of key terrorist organisations and their principal affiliates, a marked contrast with the immediate post-9/11 period. The personal charisma of figures such as Islamic State founder and first caliph Abu Bakr al-Baghdadi, who consciously echoed Osama bin Laden’s leadership style, matters far less in a landscape shaped by repeated targeted killings of senior leaders.
The most relevant terrorist organisations have consequently moved towards more horizontal, networked and digital forms of command. Leadership has become increasingly depersonalised, with individual commanders less central to the ability of extremist movements to maintain ideological influence or inspire violence.
Much of the infrastructure sustaining this threat is now virtual. Islamic State continues to operate in key conflict hotspots, but it also maintains a sprawling digital ecosystem. Short videos circulated through platforms such as TikTok, Instagram and Twitch provide radical narratives with visibility and can serve as emotional entry points for susceptible audiences. Encrypted channels facilitate secure interaction and the distribution of explicit material, while peer-to-peer applications can reinforce ideological commitment and operational skills.
The consequence is a profound change in the relationship between terrorist organisations and their supporters. A terrorist organisation can inspire violence without necessarily knowing the identities of those consuming its propaganda. At the same time, a self-radicalised individual can move towards violence without receiving formal orders. This is the logic of “mutant jihadism”: the ideological brand can survive even as hierarchical structures dissolve.
Islamic State Khorasan Province (ISK) has exploited this model particularly effectively, extending its reach beyond its operational core in Central Asia into Europe. Its external operations demonstrate how planners located far from Europe can connect with supporters in cities such as Paris, Brussels and Berlin. Cases since 2023 suggest that Central Asian diaspora networks, cross-border logistics and encrypted communications can still support structured plotting, while the group’s messaging explicitly targets young and socially isolated individuals whom it can mobilise online.
The August 2024 plot against Taylor Swift concerts in Vienna illustrates how these dynamics can converge. The principal perpetrator, Beran A., a young adult, consumed Salafi influencer-preacher content on TikTok alongside explicit Islamic State propaganda. His activity progressed beyond passive consumption to practical preparation, including researching targets, studying bomb-making and maintaining intensive contact with like-minded individuals online and offline.
Based on Beran A.’s plans, the operation was intended to combine a vehicle attack, explosives and a machete assault. The early detection of the plot demonstrated the importance of transatlantic intelligence cooperation, domestic surveillance and timely information sharing. It also exposed the limitations of conventional labels. Although initially described as a lone-actor plot, the attacker and his accomplices operated within a supportive micro-network, illustrating what has been described as a “lone perpetrator plus” pattern.
The terrorist threat has also been affected by the Hamas attack of October 7, 2023, and the subsequent war in Gaza. The conflict generated what the Soufan Center describes as a “propaganda shockwave”, reshaping Islamist mobilisation across Europe. Images of civilian suffering, often stripped of context and repackaged with emotionally charged slogans, became instruments of political and psychological mobilisation.
Jihadist propaganda portrayed the war as evidence of a global assault on Islam and used it to justify retaliatory violence in Europe. The “victim–revenge” narrative can be particularly potent where anger, humiliation, grief and a sense of complicity precede the development of any coherent doctrinal worldview. Digital platforms can intensify that process by amplifying highly emotional material and allowing users to move rapidly from mainstream content to explicit extremist propaganda.
The resulting threat is increasingly youth-centric. European cases documented since October 7 show adolescents doing more than consuming extremist material. Some produce propaganda, operate chat groups, discuss objectives and seek validation from older or more experienced actors. Such peer-driven dynamics can accelerate radicalisation while lowering the threshold for action.
Yet Europe’s security challenge cannot be reduced to jihadism alone. Europol recorded 45 terrorist attacks across 10 EU member states in 2025, comprising 22 completed attacks, 20 foiled plots and three failed attempts. While the arrest figures, foiled plots and relatively low cost of many attacks reflect intensive prevention efforts, they also demonstrate the persistence of an environment in which extremist mobilisation continues.
The prevailing methods increasingly involve knives, vehicles, improvised weapons and other readily available means. Such methods require little funding and can provide few warning signs. Drones and 3D-printed weapons may become preferred means of conducting low-level attacks, particularly among young, digitally savvy users.
At the same time, ideological boundaries are becoming less distinct. Right- and left-wing extremism, nihilist and anarchist violence, separatist activities, anti-government extremism and conspiracy-driven mobilisation remain relevant. Extremists can borrow narratives from movements with which they would previously have appeared incompatible, producing eclectic, “salad bar” ideologies centred on themes such as alleged state oppression, demographic replacement, anti-globalism, antisemitism and civilisational conflict.
Digital environments help circulate common emotional codes — anger, resentment, humiliation and nihilism — across otherwise disparate groups. Other vulnerabilities complicate the picture. Criminal experience can support terrorist activity, blurring the distinction between crime and terrorism. Prisons can become environments for recruitment and reinforcement. Mental health problems may coexist with extremist commitments without fully explaining them, while migration from conflict zones creates additional vulnerabilities. Intelligence analysis must therefore distinguish structural risk factors from concrete evidence of mobilisation and intent.
A quarter-century after 9/11, the central transformation is therefore not simply that terrorism has become smaller. It is that the terrorist group itself is becoming less clearly bounded. Europe increasingly confronts an ecosystem in which propaganda is personalised, radicalisation can accelerate online, operational knowledge is widely circulated and attacks can be improvised at low cost.
For European counterterrorism institutions, the challenge is consequently to detect and disrupt threats that may have no obvious organisational centre. The response described in the Soufan Center assessment requires intelligence-led disruption alongside long-term prevention, digital resilience and efforts to strengthen social cohesion. The objective is to reduce the virtual and social spaces in which grievance, ideology, technology and opportunity converge.
Twenty-five years after the attacks that defined an era of centrally directed terrorism, Europe faces a different problem: not necessarily an enemy with a visible command structure, but a fragmented terrorist ecosystem capable of connecting ideas, individuals and methods across borders. For the next 25 years, confronting that convergence is likely to remain a central task for European counterterrorism institutions.
