This report is not an official T2COM product. It was written by graduate student analysts as an independent assessment at the request of T2COM. Its findings in no way represent the official opinions of the U.S. Government, U.S. Department of War, U.S. Army, or T2COM.

The United States faces a hybrid threat environment centered on the evolving danger of violent non-state actors (VNSAs) and their increasing cooperation with state adversaries, raising the overall risk to the U.S. homeland. The most serious danger is not any one terrorist organization, cartel, militia, or state power, but the system they create together. This report examines and assesses the threat posed by twenty international VNSAs—using major state powers as strategic benchmarks for comparison—and analyzes how the convergence between the two groups is altering and confounding the U.S. Government (USG) threat landscape. Over the last 30-plus years, the threat from international VNSAs has monopolized the operational environment and dictated policy and engagement. However, as of 2025, this has shifted. This report, conducted as a consultancy project by Pennsylvania State University graduate students for the U.S. Army’s Transformation and Training Command (T2COM)—is an independent academic assessment rather than an official T2COM product. It aims to address core questions such as: How does the USG view the threats posed in this contemporary ecosystem of violent non-state actors, such as Violent Extremist Organizations (VEOs), Foreign Terrorist Organizations (FTOs), and Transnational Criminal Organizations (TCOs), relative to strategic competition with traditional state actors? Which VNSAs present the greatest threat to the U.S. homeland? What emerging trends or affiliations can be identified with VNSAs and state actors?

This assessment applies a standardized Will and Capability framework, which ranks the will and capability of international VNSAs and states to attack the U.S. homeland. Using a 0-10 scale on both metrics and multiplying the two values together produces an Overall Threat Score (0–100) for each international VNSA and state. These findings are then organized by Combatant Command to align with U.S. Army planning and resourcing rhythms. The results show a clear hierarchy across both state and non-state actors (see Figure 1). By incorporating state actors primarily as a comparative baseline, the analysis highlights that while states generally score higher on Capability metrics and often rely on proxies and cyber tools rather than direct kinetic action, numerous VNSAs sustain strong Will metrics and exploit global networks, safe havens, and ideological reach. The headline picture is convergence: Iran’s continued support to proxies, alleged links between Chinese criminal networks and cartels, and the broad investment by all four major state adversaries—China, Russia, Iran, and North Korea (or CRINK)—in information and cyber operations combine to strain U.S. defenses below the threshold of open conflict. This report finds the following:

• Ideologically Centered VNSAs Maintain the Strongest Will: Variation in Will scores by international VNSAs is closely tied to ideological alignment. The core Salafi-jihadist groups, namely the Al-Qaeda Core and Islamic State – Central, demonstrate a sustained and uncompromising adherence to extremist ideologies and objectives, thus representing the two highest Will scores in our analysis of VNSAs. Decentralized nodes of the core groups —international affiliates or provinces of Al-Qaeda and the Islamic State—display lower Will scores to attack the U.S. homeland than the core “parent” groups. This can be attributed to these international affiliates’ preoccupation with local politics, including clashes with local security forces, local civilian resistance, territorial challenges, power vacuums, and struggles that diverge from “parent” groups’ ideological motivations.
• Regional VNSA Threat Patterns Vary by Combatant Command: Of the three Combatant Commands investigated, CENTCOM presents the highest overall VNSA risk, driven by dense Salafi-jihadist activity and persistent Iranian enablement. NORTHCOM/SOUTHCOM poses the most immediate danger to the homeland through cross-border cartel operations and illicit trade. AFRICOM presents the lowest direct homeland risk, though expanding Chinese and Russian influence warrants continued monitoring.
• State Actors, Not VNSAs, Rank Highest in Overall Threat Score: Despite this report’s focus on the threats posed to the U.S. homeland by international VNSAs, it finds that overall, state actors, not VNSAs, exhibit the highest Overall Threat Scores. North Korea holds the top Overall Threat Score (84), driven by entrenched anti-U.S. ideology and advanced nuclear and cyber programs. China (80) and Russia (76.7) follow closely, reflecting extensive global reach and multidomain capabilities, but with lower desires to kinetically engage the U.S. Iran ranks lower (56.2) but remains pernicious due to its sponsorship of proxies that elevate the capabilities of groups such as Hezbollah and the Houthis.
• Hybrid Cooperation Defines the Global Threat Environment: The contemporary international threat landscape is no longer shaped by isolated actors working alone, but rather, by a multiplicity of U.S. adversaries — both VNSAs and states — cooperating in various domains and to differing degrees. Sustaining decisive United States readiness for large-scale combat must be paired with persistent, integrated competition against proxies, facilitators, and cyber actors that collectively erode U.S. security below the level of open warfare.
• NORTHCOM/SOUTHCOM VSNAs Expose a Structural Anomaly in Threat Scoring: The generally low rankings of Overall Threat that this report ascribes to VNSAs from the NORTHCOM/SOUTHCOM region belie the reality of the threats that they pose to the U.S. homeland. At its core, this is because the region’s unique threat landscape confounds the standard Will and Capability calculus used by this report. Despite causing the most aggregate damage to the United States, these groups rank artificially low because they lack traditional ideological hostility. Instead of viewing the United States as a political enemy, they view it as a market for exploitation. This distinction underscores the discrepancy between economically motivated groups and ideologically driven insurgents, exemplifying the complexities of the contemporary threat landscape and the challenge of creating a holistic Will and Capability taxonomy.