GCTA Foresight Audit, Part 9: ISKP, the Islamic State’s Engine Room

CommandEleven Intelligence // Central Asia Desk. Foresight Audit, status as of November 3, 2026. This audit scores the 2026 Global Counter-Terrorism Assessment (GCTA), published in April 2026, against evidence published afterwards.

Bottom Line Up Front

We called ISKP “the single most significant evolution in the 2025/2026 threat landscape” and the center of excellence for the whole Islamic State brand (pages 59 to 61 and 87). Of four judgments, three are partly confirmed and one is open: 1.5 of 3 on the three that can be judged. The facts in these pages are checked separately as baseline facts and do not count.

The strongest evidence is the UN monitoring team’s report of August 10, 2026. It describes ISKP as having suffered serious setbacks and being in a rebuilding phase, while keeping the intent to attack abroad and a renewed ability to carry out infrequent, high-profile mass-casualty attacks. It confirms ISKP as a propaganda innovator that uses AI tools for translation. It does not show ISKP exporting funds or strike capability to other affiliates, and we found no coordinated campaign of simultaneous plots in Western cities. The al-Siddiq Office funding claims, which we presented as confirmed by UN and US reports, do not appear in the UN report we reviewed.

Key Judgments

KJ1: ISKP is a propaganda innovator with external intent. It is not shown to be the engine of the whole movement. The UN reads it as rebuilding after setbacks. [PARTIALLY CONFIRMED]

KJ2: Remote handling of recruits is alleged in one Dutch case. A proven remote-directed attack is not on the record. [PARTIALLY CONFIRMED]

KJ3: We found no evidence yet of a deliberate campaign of simultaneous Western plots. The year is not over. [OPEN]

KJ4: The Taliban have degraded ISKP but have not suppressed it. The sanctuary claim holds. The resurgence claim does not. [PARTIALLY CONFIRMED]

How We Scored

Every call is scored under the Foresight Record rules, set out in full in the GCTA Foresight Audit introduction. The original is quoted and dated, the score rests on evidence published after the GCTA appeared, and confirmed counts 1 and partly confirmed counts 0.5. Where an official attributes something without publishing evidence, we score partly confirmed. A call that depends on a verdict or a data release is held open. Only our own judgments count.

This audit covers the ISKP section (pages 59 to 61) and the ISKP governance and recruitment section (page 87). The Afghanistan-Pakistan conflict and the TTP are scored in the Indian Subcontinent audit, and the financing claims about the Islamic State network in the first part of the series. We scored the statements that characterize ISKP’s role or predict its behavior in 2026, and we checked the rest as baseline facts. One limit applies: the UN report covers the first half of 2026 and some of its period overlaps the GCTA’s release.

The Scored Calls

IK-01. ISKP as the center of excellence

What we said (GCTA, p. 60). “In 2026, ISKP acts as the Center of Excellence for the ISIS brand, exporting propaganda innovation, financial stability, and external strike capabilities to every other affiliate.”

What the record shows. The UN monitoring team’s thirty-eighth report (S/2026/651, August 10, 2026) says ISIL-K suffered serious setbacks and is in a rebuilding phase, with intent to attack abroad and a renewed capability for infrequent but high-profile mass-casualty attacks. It says ISIL-K’s group strength remained largely unchanged. On propaganda, the report says some affiliates, notably ISIL-K, appear to use AI tools to translate and circulate material quickly. ISIL-K output fell in 2025 and resumed in early 2026, including a Pashto edition aimed at the Taliban’s religious authority, and Kazakh was added to its languages. It also circulated instructions for ricin over the past 12 months. The report does not describe ISIL-K supplying money or strike capability to other affiliates. One member state reported that ISIL-K shares facilitation networks with the Baloch Liberation Army. A summary of the report by the Foundation for Defense of Democracies adds that the Islamic State overall is at a lower ebb after two deputy leaders were killed, and that about two-thirds of Islamic State and al-Qaeda fighters are now in Africa.

Score: PARTIALLY CONFIRMED. The propaganda role holds. The claim that ISKP supplies finance and strike capability to every affiliate is not shown, and the UN describes setbacks, not a center of excellence.

IK-02. Remote direction of recruits

What we said (GCTA, p. 61). “ISKP has transformed ISIS’s external operations from expeditionary (sending teams) to distributed (remotely directed).” We described a Virtual Handler model on Telegram that vets and guides recruits at home without meeting them.

What the record shows. In late July, Dutch police arrested a 20-year-old in Bergen op Zoom on suspicion of planning to join ISKP, as NL Times reported on August 4. The Dutch intelligence service had alerted police to his plans the week before, and he allegedly had contact with people orchestrating attacks for the group. Prosecutors charged him with participating in a terrorist organization and preparing a terrorist crime, and gave no target or plan. The UN report notes that ISIL-K promoted the Bondi Beach attack as a model, and that its media encourages plots in the West, but it does not attribute that attack to the group. We found no ISIL-K-attributed plot in Europe or Russia in the sections of the UN report we reviewed.

Score: PARTIALLY CONFIRMED. One case alleges remote contact and ISKP media urges attacks, but no completed attack is shown to have been remotely directed, and the Dutch allegation has not been tested in court.

IK-03. Tactical overload against Western agencies

What we said (GCTA, p. 61). We wrote that ISKP’s 2026 strategy was “tactical overload”, launching or inspiring multiple small-scale plots at the same time across different Western cities to exhaust the capacity of agencies such as Europol and the FBI.

What the record shows. Dutch police raided homes in Rotterdam, Eindhoven and Alkmaar on July 29 and arrested three teenagers aged 16, 17 and 19. A fourth man was arrested the next day in Bergen op Zoom, in a separate case that officials had not linked to the teenagers. Prosecutors had not said whether the cases are connected, and no plot details were released. Europol’s 2026 trend report, which counts 2025, found 45 attacks in the EU, down from 58 in 2024, and 24 jihadist attacks, the same as the year before. We found no official statement that ISKP directed or coordinated simultaneous plots in 2026.

Score: OPEN. Clusters of arrests are not a coordinated campaign. We will score this at the December 31 review and will count it as confirmed only if officials attribute simultaneous plots to ISKP direction or inspiration.

IK-04. The security vacuum and local sanctuaries

What we said (GCTA, p. 87). “The primary driver of ISKP’s resurgence is the vast security vacuum in the region.” We said the Taliban could not police their borders or remote provinces, which gave ISKP local sanctuaries.

What the record shows. The UN report says the Taliban are combating ISIL-K but have been unable to suppress the terrorist problem. It says Taliban operations, mainly in the north and in cities including Kabul, reduced ISIL-K’s capabilities, that the group reportedly moved to northern Afghanistan, and that its attacks declined in Afghanistan and rose in Pakistan. The group expanded kidnapping of foreign workers and companies in northern Afghanistan. On July 28, ISKP shot dead a Taliban information official and his guard in Badakhshan, an attack Dawn described as rare.

Score: PARTIALLY CONFIRMED. The sanctuary and the Taliban’s inability to suppress the group are supported. The UN describes a degraded group in a rebuilding phase, which does not fit our word resurgence.

Baseline Facts Checked

These are factual statements in the GCTA that were checkable. They are not forecasts and are not counted in the Foresight Record totals. A claim we could not reproduce is marked unverified, which is not the same as wrong.

What Would Change These Scores

• An official attribution of two or more simultaneous Western plots to ISKP direction before December 31 would move IK-03 to confirmed.
• A court finding in the Bergen op Zoom case that the suspect was remotely handled would move IK-02 toward confirmed.
• A UN or Treasury finding that links the al-Siddiq Office to transfers would move the funding row from unverified.
• A mass-casualty ISKP attack outside Afghanistan and Pakistan in 2026 would change how we score IK-01 and IK-04.

What We Learned

The propaganda claims held up better than the organizational ones. Where we named offices, transfers and amounts, we cannot find the source in public reporting, and our own text said UN and US reports confirmed them.

We used the word resurgence for a group the UN describes as degraded and rebuilding. The more careful word, and the one we will use, is persistence.

What This Audit Does and Doesn’t Establish

• It establishes that ISKP keeps the intent to attack abroad and is a leading source of AI-assisted propaganda among Islamic State affiliates.
• It establishes that the Taliban have not suppressed ISKP but have degraded it.
• It does not show that ISKP funds or equips other affiliates.
• It does not show that any Western plot in 2026 was directed from Afghanistan.
• It does not review ISKP’s activity in Pakistan, which belongs to the Indian Subcontinent audit.

Frequently Asked Questions

Is ISKP still a threat to the West?

Yes, as an intent and an ideological source. The UN says ISKP keeps the intent to conduct external operations and can still mount infrequent, high-profile mass-casualty attacks. We found no completed ISKP-directed attack in the West in 2026.

Did the UN confirm our funding claims?

Not in the report we reviewed. It describes crypto fundraising appeals but does not link the al-Siddiq Office to transfers, so we have marked the claim unverified.

What was the Dutch case?

A 20-year-old was arrested in Bergen op Zoom in late July on suspicion of planning to join ISKP and of contact with people orchestrating attacks. Prosecutors gave no target. It has not been tested in court.

What comes next?

Part 10 covers cyber-kinetic convergence and Part 11 is the closing synthesis.

Sources

• UN Security Council, Thirty-eighth report of the Analytical Support and Sanctions Monitoring Team, S/2026/651 (August 10, 2026; text as mirrored)
• FDD’s Long War Journal, The UN Monitoring Team’s latest report: Where the global jihad stands now (September 2026)
• NL Times, Man, 20, arrested in Bergen op Zoom terrorism investigation (August 4, 2026)
• NL Times, 3 teens in custody in terrorism investigation; Eindhoven suspect known ISIS supporter (July 29, 2026)
• Dawn, Islamic State-Khorasan claims killing of Taliban official in Afghanistan (July 31, 2026)
• eucrim, Europol TE-SAT 2026 (2026)

Related CommandEleven Intelligence Reporting

• The GCTA Foresight Audit
• GCTA Foresight Audit, Part 2: The Indian Subcontinent
• GCTA Foresight Audit, Part 6: North Africa, Southeast Asia and the Sulu Sea
• GCTA Foresight Audit, Part 7: Europe and North America
• The Foresight Record: Every Call We Have Scored, Misses Included
• 2026 Global Counter-Terrorism Assessment (download)