Assessment: Global Physical Security Intelligence Forecast – November 2026

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 7:00 AM (EST) on November 9, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

• The clearest pattern ZeroFox observed in multiple regions in October is the targeting of systems that keep businesses running, including power, airports, roads, markets, and transit.
• Kinetic strikes on energy, aviation, and transport nodes are very likely to continue in Ukraine and Sudan, and a strike on a civilian airport in Saudi Arabia or Yemen is also likely.
• A renewed large-scale U.S.-Israeli campaign against Iran is unlikely in November, but low-level U.S.-Iran exchanges are likely to continue. A large campaign would likely move the Middle East and North Africa (MENA) region from elevated to exceptional levels of risk. Confidence is moderate, because available sources diverge in tone and detail.

Nine of the 14 threats are very likely or almost certain, yet ZeroFox has rated only three of those as CRITICAL, and we rate the hoax threat that dominates North American (NA) alert volume as LOW.

Overview

The cross-regional pattern of targeting systems that keep businesses running (including power, airports, roads, markets, and transit) that ZeroFox observed this month comes from 12 October and early November incidents in which the target was a node on which many people and businesses depend.

Eurasia (EA), MENA, and Sub-Saharan Africa (SSA) are the only regions ZeroFox has rated CRITICAL, and in each the rating comes from infrastructure denial or mass-casualty attacks. NA’s highest rating, MODERATE, is based on scheduled hazards, hoax calls, and public shootings.

Regional Risk Profiles

Asia-Pacific (APAC) | HIGH. ZeroFox has set APAC’s November risk based on two scheduled hazards rather than regional totals. Diwali on November 8 moves India’s explosion peak into November, and Australia’s fire season builds under a strengthening El Niño. Pakistan is the persistent risk: 225 militant attacks in September, the most in 12 years, and a decade-high kidnapping count indicate sustained danger on roads in the northwest and southwest. Explosions are likely to rise, structure fires are likely to rise modestly, and gun violence is likely to fall as Pakistan eases from its September peak.

Eurasia (EA) | CRITICAL. Ukraine is the basis for this rating. Explosions rose approximately 9 percent in October, and a further increase is likely as kinetic strikes on energy infrastructure continue into the heating season. Structure fires rose approximately 25 percent from August to October and are likely to stay elevated with a slight decline.

Latin America and the Caribbean (LAC) | HIGH. Policy shifts drove the outlook: Colombia’s November 4 bill, Venezuela’s strike on the Ejército de Liberación Nacional (ELN) or National Liberation Army camp, and Ecuador’s curfew. Commercial predation adds a second layer, with extortion and killings of transport workers in Peru and cartel violence in Sinaloa and Michoacán.

Middle East and North Africa (MENA) | CRITICAL. The incident count was flat this month, but the target set is widening. Explosions rose approximately 4 percent in October after an 83 percent surge in September, yet Houthi strikes moved to civilian airports. ZeroFox’s recorded counts rank the Palestinian territories and Yemen first for explosions, so Iran is an escalation driver and not a volume driver.

North America (NA) | MODERATE. Risks in the region have been seasonal. Hoax calls drove much of the disruption this month: a swatting call kept a Halifax high school locked down for more than three hours and was traced outside Canada, and a bomb threat put several Virginia schools on lockdown.

Sub-Saharan Africa (SSA) | CRITICAL. Mass-casualty violence continued this month: gunmen killed at least 20 people in Zamfara, Islamic State Sahel Province fighters killed at least 48 in Mali, and the Abyei market strike killed at least 80. East Africa’s heavier-than-usual rain forecast supports a modest decline in structure fires there.

Attacks on Operating Infrastructure

Energy and connectivity. In Ukraine, one combined operation of 289 drones, 17 ballistic missiles, and 59 cruise missiles struck energy facilities more than 20 times across nine oblasts as the heating season began, and other strikes hit data centers and bridges. In Sudan, drone strikes damaged five substations on October 26 and the Al-Markhiyat power station on October 27 and were reportedly the seventh round of strikes on Sudanese power stations in under a week. Grid failures and fuel scarcity in Cuba and Venezuela produced a similar effect, but reporting does not indicate deliberate targeting.

Aviation, shipping, and markets. Houthi strikes widened to civilian airports in Saudi Arabia (Riyadh and Abha) and Yemen (Aden), and October saw a record 28 confirmed and reported vessel attacks around the Strait of Hormuz. A drone strike on Amiet Market in Abyei on October 19 killed at least 80 people by the United Nations’ count and 153 by the count of local officials; attribution remains disputed. Jet fuel shortages cancelled international flights from Cuba, and passenger transport there is projected to fall 75 percent in 2026.

Assessment

The targets share three features. They are nodes with large downstream effects, the businesses are mostly incidental victims, and the effects cascade—outages cut communications, and lost communications and fuel cut movement. ZeroFox assesses that clients are exposed as users of these nodes, not as targets, and that dependency mapping should therefore precede threat mapping: clients should identify the single substation, airport, bridge, or road on which staff and goods depend and plan an alternative route.

Outlook

ZeroFox assesses that patterns we observed in October will likely extend into November: attacks on power, airports, roads, markets, and transit are expected to remain the main source of business disruption in conflict-affected regions. The structure of the threat is stable but likely depends on whether the U.S.-Iran track escalates.

ZeroFox assesses that the direction of the Ukrainian and Sudanese campaigns is settled for November and that tempo is the variable clients should track. Both campaigns have established cadences and show no visible pause, so a slower tempo—rather than a halt—is the most plausible change. An announced pause in strikes on Ukrainian energy infrastructure, or a fall in the pace of strikes on Sudanese power stations below October’s, would alter these judgments.

Appendix A: Threat Level Methodology

The Global Finished Intelligence team (GFI) rates each threat on two independent scales and combines them. Likelihood uses the ZeroFox probability scale for an event of that type affecting a location where clients may operate. Severity uses the ZeroFox criticality guidance, summarized below.