Key Reflections
* Iran prioritises the use of asymmetrical warfare tactics over conventional, particularly through the use of cheap drones and cyber technology, which are both central to their warfare strategy.
* Iran operates through a cost imposition strategy, disproportionately increasing the money, effort and resources their rivals must use to achieve their objectives.
* The IRGC uses horizontal escalation to expand the scope of conflict by opening new fronts via its expansive proxy network, timing the opening of these fronts carefully to ensure maximum disruption.
* The Iranian state frames war as an existential threat in order to garner support from internally and to justify their repressive measures against those they deem to be anti-state actors.
* Dissidents, activists, journalists, academics and former state officials are all targets of Iranian transnational repression and are subject to online surveillance and harassment and threats to their families in Iran.
* Iran tends to favour indirect, low-level and deniable tactics, like targeting the ticketing system of a large sporting event through a cyber attack.
Transcript:
SG: Dr. Sajjan M. Gohel
MC: Dr. Mahmut Cengiz
SG: Welcome to the NATO DEEP Dive podcast. I’m your host, Dr. Sajjan M. Gohel, and in this episode, I speak with Dr. Mahmut Cengiz, Managing Editor for Counterterrorism at Homeland Security Today.
Dr. Cengiz is a long-standing member of the Homeland Security Today editorial board and is also an Associate Professor at the Schar School of Policy and Government at George Mason University.
Mahmoud Cengiz, warm welcome back to NATO DEEP Dive.
MC: Thanks for inviting me.
SG: It’s great to have you here. So let’s talk about the situation right now in the Persian Gulf and what Iran is doing. How would you characterise Iran’s strategy in this conflict?
MC: So far what we have seen in the region, Iran has used its forward defence strategy very effectively in the Middle East, using more of its proxies, because it was giving plausible deniability for the regime. And so far we have seen in Iraq, in Syria, Lebanon and Yemen, this active use of these proxies and non-state actors.
But more specifically for this war, what we have seen so far is more asymmetric warfare and then heavily relying on drones, cyber and irregular tactics than a conventional war. So that’s why here there is a deterrence by punishment and a cost imposition. The Tehran regime aims to seek to raise the cost of conflict.
That’s why so far we have seen missile strikes, disruption of shipping and energy, and pressure in the Strait of Hormuz. So, in the Western countries we have seen the rising gas prices and inflation. So it seems that it is a successful strategy, this deterrence by punishment and the cost imposition by the regime.
SG: So if we look at that a bit more, have we seen a fundamental shift in Iran’s military doctrine compared to previous conflicts, particularly in its willingness to act more directly?
MC: Yes, I think it’s an evolution, not a complete break, because so far Iran’s core doctrine is based on asymmetric warfare proxies, like your first question, and today they remain intact. And what has changed so far is how and when it applies direct force. And that’s why historically we have seen Tehran regimes avoiding direct state-to-state confrontation and they have relied heavily on proxies and now there is more risk acceptance with their escalated behavior.
I think also we should talk about some notable events in the early days of the conflict, and the decapitation of the Supreme Leader, because he represents the Velayat-e Faqih [Guardianship of the Islamic Jurist], and he was the most powerful figure of the regime, ideologically and religiously.
Iran is using episodic bursts of attacks rather than continuous escalation. So it is focusing on infrastructure and the strategic targets. So what I can say is yes Iran hasn’t abandoned its proxy-based strategy, but it has crossed a threshold and is still managing escalation to avoid full-scale war.
SG: Building on that, to what extent are Iran’s missile and drone capability central to their strategy, and what advantages do they give Iran?
MC: Yes, they’re absolutely central, and they are like the backbone of Iran’s strategy, and as we all know, the country lacks a modern air force, so missiles and drones substitute for air power. And these missiles and drones serve as equalizers, so they strike regional adversaries at long range, and US bases and the Gulf infrastructure.
So in terms of cost asymmetry, they’re extremely cheap compared to Western interceptors and missiles. And in terms of creating cost imposition and strategy, they are forcing adversaries to spend far more to defend than Iran’s cheaper drones and missiles. And what about flexibility and scalability? Increasingly, we have seen accuracy against infrastructure and military targets. And the missiles are mobile, hidden underground, so they can give more survivability and resilience.
So what about psychological and economic warfare? So these weapons create uncertainty and fear across the region. I think one final thing about their exportability is that they can be easily transferred. So I think what we can say here is that missiles and drones aren’t just tools, they are like a strategy for the Tehran regime, and without needing air superiority, Tehran competes now with far stronger militaries.
SG: I feel like you’ve answered it already, but perhaps it’s worth refocusing again on it, is that in Iran, what we’re seeing is that they seem to be deliberately trying to regionalise the conflict through multiple pressure points, and that is causing quite a lot of economic paralysis along with the infrastructure damage.
MC: Yes, I think this is deliberate and central to Iran’s strategy. And for example, horizontal escalation is a strategy that we have seen opening multiple fronts simultaneously by Hezbollah in Lebanon, Iraq, and targeting U.S. assets and the military, and also in Syria as well.
And in Yemen, we have seen the most recent involvement of Houthis in the war, and also in the Strait of Hormuz. This is a maritime domain area and a strategic area for the Tehran regime. I think it’s also about distributing the cost of war, as the regime believes that if it suffers, the entire region should feel the pain, through energy markets, and the shipping lanes.
So, they are creating multiple pressure points on adversaries and forcing them to defend many fronts at once. I think also there is strategic messaging, so any actor supporting its adversaries is potentially a target. So, yes, Iran is deliberately regionalising the conflict, and by opening multiple fronts and the pressure points, and it turns a localised war into a region-wide problem, raising the cost for everyone.
SG: Building on this, how much of Iran’s military behaviour is driven by regime survival rather than battlefield objectives?
MC: Yes, I can say a very large portion, arguably the dominant driver. So, Iran’s military doctrine is not purely about winning battles, and since its launch in the early days, it’s fundamentally about ensuring the survival of the Islamic Republic. So, that’s why we have seen the creation of the IRGC {Islamic Revolutionary Guard Corps) in the region, and the aim to protect the regime.
War is viewed as existential, not optional, and Iranian leadership increasingly frames conflict as a struggle for state continuity and internal stability. The regime uses external conflict to reinforce internal cohesion and justify repression. So, I think also in terms of Mosaic Defence so far, that’s why there was a question about the decapitation of the Supreme Leader, because according to this mosaic defence, it reflects survival thinking.
Iran’s doctrine assumes leadership may be killed and infrastructure may be destroyed, so it builds a decentralised system that keeps functioning under attack, more importantly blurring regime survival with national survival. So, Tehran increasingly presents, for example, the regime as equal to the state, and the state as equal to the nation. It’s helping legitimise sacrifices, and mobilising support for the regime, and of course, framing opposition as existential threats.
SG: I’m glad you brought up the Mosaic Defense strategy, because that’s such an important aspect. You also had previously spoken about the Houthis being utilised. Why did the Houthis join the conflict almost a month after it began? Why is it that it’s taken that long?
MC: The Houthis also played another active role right after the October 7th Hamas terror attacks, and we also saw how the Houthis were involved in targeting the commercial ships in the Red Sea. Again, if we go back to our earlier argument about proxies and their roles in the Middle East, you can see, for example, the division of labour within Iran’s network, with Hezbollah in Lebanon and high-end deterrence versus Israel.
And then Iraqi militias, where we have seen their involvement in attacks pressuring U.S. forces, and the Houthis who are still keeping a very strategic position, as they are part of economic warfare via maritime disruption. So, the Houthis bring something unique to the region, threatening Red Sea shipping and choke points. Iran and its partners so far avoid all fronts igniting at once, but this delay allowed an initial assessment of the battlefield and the calibration of U.S. and Israeli responses.
So, the Houthis involvement and entry was meant to show the conflict is no longer localised and that it’s regional, and also in terms of avoiding early overwhelming and retaliation. For the Houthis, immediate entry could have triggered rapid U.S.-led escalation in Yemen, so the waiting allowed a more crowded and complex battlefield, making retaliation harder.
Also, in terms of maximising strategic impact and joining later, the Houthis avoided being just another front, now instead becoming a decisive escalation moment, where timing was used to increase the psychological and economic shock value. So, what I can say is the Houthis did not enter late, they entered on cue, and their delayed involvement reflects a coordinated escalation strategy, opening any front at the most strategically valuable moment to maximise pressure on global trade and to complicate the conflict.
SG: We also had briefly spoken about Hezbollah, and we’ve seen that there’s been conflict with Israel as well during this period. What state is Hezbollah in? Because they had suffered quite a few setbacks, leadership decapitation previously, but what would you say their position is right now?
MC: Hezbollah was another organisation in the context of the October 7th attacks, so the group paid huge costs because of its involvement in war right after October 7th. For example, according to Global Terrorism Analysis Centre data, Hezbollah conducted just two attacks until October 7th in 2023, but it happened, and there were then 294 after the October 7th attacks in 2023. Then in 2024, the G-Tech data recorded more than 1600 Hezbollah attacks in the region.
So, Hezbollah was always one of the most active actors in the region, but as a result, the organisation paid huge costs, like you mentioned, the decapitation of the leadership. Of course, the group has been weakened after the October 7th attacks. But today, we can say that Hezbollah is bruised, but not broken, and they’re holding back by choice, not weakness.
So, they remain Iran’s most powerful card, and its full entry into the conflict will be a game-changing escalation. Materially, they are degraded, but far from defeated. With sustained strikes recently that we have seen in the region, and clashes, these have reduced some capabilities and infrastructure, but Hezbollah still remains, retains, a large missile and rocket arsenal. Hezbollah has not fully entered the war, instead engaging in limited and calibrated attacks in the region.
I think also, in terms of their strategy entering the war, internal and political constraints inside Lebanon, there is an economic collapse, and then the political fragility limits appetite for war. So, Hezbollah must balance its regional role versus domestic backlash in terms of leadership and the command under pressure. Targeted killings and surveillance have increased pressure on leadership structures, but what we can say is that the organisation remains cohesive and functional today.
SG: If we move away from the Persian Gulf, and look at the global picture, should we be worried about transnational repression increasing in the West, and delivered through Iran, its proxies, organised criminal groups, because it’s something that Iran has definitely been engaging in for a while, but could the conflict intensify that?
MC: Yes, there’s a credible and a growing concern, and the states like Iran tend to expand efforts to monitor, intimidate, or silence diaspora communities. Like you mentioned before, the Tehran regime is very familiar with this transnational repression, and we have seen how the regime collaborated with Eastern organised crime groups, in one case in the U.S., just to target the regime dissidents.
So, this is an area the Tehran regime already has experience of, and so far, the likely targets included by the regime are dissidents and activists, the journalists, and the academics, and the former officials, or defectors. And what tactics they have used so far? We have seen their online harassment, and their surveillance, and threats to family members back home, and the coercion through intermediaries or proxies.
And occasionally, we have also seen plots for attempted attacks, but they are very rare, and they’re very high risk. I think also, as discussed earlier, external repression is tied to internal stability concerns, so Tehran sees diaspora dissidents as a security vulnerability. I think also we should talk about the intelligence and law enforcement pressure and their capacity, and how countries like the U.S. and Europe are much more alert than before, which is why they have disrupted multiple plots in recent years.
SG: Do you think that the football World Cup, the soccer World Cup, that’s going to be held jointly in the United States, Canada, and Mexico, could potentially be a vulnerable target for Iranian clandestine activities?
MC: The FIFA World Cup 2026 is high visibility, a symbolic target, which always increases risks. So, the threat is more likely indirect, deniable, and low level, not a major mass casualty attack.
And we all know that mega events are inherently attractive targets, and then this World Cup offers a massive global audience, and concentrated crowds, and political symbolism, especially because it’s being hosted in the U.S. Already there are some intelligence assessments about extremists and the retaliatory threats linked to the Iran conflict. Iran’s interests would be strategic, they’re not indiscriminate, because the Iranian doctrine suggests it would avoid actions that trigger direct, overwhelming retaliations.
So, a large-scale attack on the World Cup venue is unlikely. What could happen? I think we can see some more plausible threat vectors. If Iran were to act, it would likely be through cyber operations. I mean, like the ticketing systems, infrastructure, media narratives, and the drone threats or attempted disruptions is another one, and already flagged by officials, and as we all know about it, using proxy or lone actor activity with a plausible deniability.
What we can say is this World Cup has a high visibility, and is a symbolic target, so the risk is real, but not in the way people often think, and the greater concern is indirect and deniable disruption. I think we should be worried about cyber drones or proxy activity, rather than a large-scale attack, because Iran’s strategy is to pressure and signal without triggering full-scale retaliation.
SG: Well, thank you for clarifying that, and I’m glad you also brought up the cyber dynamic too, because that was something that was on my mind. I’m very grateful, Mahmut, to have you back on the podcast, third time, I think, and hopefully we’ll have you again soon. So, thank you for joining us.
MC: Thanks for having me.
SG: It’s been our pleasure.
Thank you for listening to this episode of NATO DEEP Dive, brought to you by NATO’s Defence Education Enhancement Programme (DEEP). My producers are Marcus Andreopoulos, Victoria Jones, Eve Register and Henry McCabe. For additional content, including full transcripts of each episode, please visit: deepportal.hq.nato.int/deepdive.
Disclaimer: Please note that the views, information, or opinions expressed in the NATO DEEP Dive series are solely those of the individuals involved and do not necessarily represent those of NATO or DEEP.
This transcript has been edited for clarity