Introduction

The events in Sweida in southern Syria in which hundreds of Druze were massacred by Syrian army forces and regime-backed Bedouin gunmen serve as a stark warning for Israel. Despite IDF actions, including airstrikes on Syrian targets, the horrific slaughter could not be prevented. Syrian forces, together with the regime-aligned Bedouin militias, managed to penetrate the city and carry out atrocities. Although the Druze fought back and, at this stage, appear to have the upper hand—thanks in large part to strong Israeli backing—the damage has already been done. The event reveals disturbing parallels to the massacre of October 7, 2023.

There is a danger that other actors may draw inspiration from this model and seek to emulate it. It is therefore critical to draw the right lessons from the incident and translate them into an operational approach that will minimize the risk of similar events occurring in other arenas.

This article analyzes the emerging threat of jihadist attacks against Israel, with a focus on the lessons of Sweida. It surveys the different arenas where similar flare-ups could occur—Lebanon, Syria, Jordan, the West Bank, and, under certain conditions, the Gaza Strip—and offers recommendations for how Israel should prepare for and confront this threat.

The Events in Sweida: An Anatomy of Failure

In July 2025, deadly clashes broke out in the Sweida province of southern Syria, the heartland of the country’s Druze population. The violence began when Bedouin gunmen backed by the Assad regime, under the leadership of Ahmed al-Sharaa (Abu Mohammad al-Julani), attacked, robbed, and severely wounded a Druze civilian. In response, the Druze detained several Bedouins, and the situation rapidly escalated into armed confrontations that included abductions, shelling, and destruction of property. According to reports, more than 1,300 people were killed or injured, including over 530 Druze—some of whom were brutally executed.

Israeli intervention succeeded, at least temporarily, in limiting harm to the Druze and in sending a message to al-Julani and to the foreign powers backing his regime that Israel would not allow regime forces to advance south of Damascus and would insist on the creation of a demilitarized zone. Nonetheless, the airstrikes failed to prevent the massacre. Regime and Bedouin forces succeeded in breaching the city and committing atrocities.

The Sweida incident must be analyzed through multiple lenses:

Intelligence

Although it is unclear whether Israel had concrete advance warning of the intentions of extremist Islamist actors to attack the Druze, it did possess general intelligence indicating plans to harm them—particularly in the wake of the massacre of Alawites and a series of attempts to target Druze in neighborhoods near Damascus. The mistaken assumption was that the Syrian regime would not allow such an event to occur, given that it was at the time engaged in negotiations with Israel over security arrangements. In hindsight, the intelligence picture and its interpretation by assessment personnel in Military Intelligence (AMAN) and Northern Command are deeply troubling. In some respects, the situation recalls the handling of intelligence prior to the events of October 7.

Prevention

Without prior warning, Israel was unprepared to launch preventive strikes against the staging areas of Islamist and regime forces. While there were indeed Israeli strikes against regime forces heading south toward Sweida—and later, attacks in central Damascus and other zones—these came too late to prevent the massacre of the Druze.

Operations

Once the order was given, the IDF launched a series of strikes in the Sweida region with the aim of putting an end to the massacre. The IDF conducted the operations resolutely, but there appears to have been a lack of actionable intelligence—both on infrastructure targets and on real-time objectives. In the end, the strikes were neither fast nor wide-ranging enough to stop Syrian and Bedouin forces from reaching Sweida. At the same time, preparations along the Golan Heights border were inadequate. Hundreds of Druze managed to cross into Syria, while Druze from the village of Hader, near the border, entered Israel without any control or oversight. An event of this kind could have had severe consequences had Israeli civilians been abducted into Syria, or hostile actors used the chaos to infiltrate Israel.

Support for the Druze

In the wake of the events, the State of Israel transferred medical and humanitarian aid to the Druze. It is also possible that equipment was provided to help them defend themselves.

The Druze in Sweida succeeded—albeit with considerable difficulty—in pushing back the attacking forces. This outcome demonstrates the community’s resilience and its ability to mobilize quickly. However, it does not diminish the severity of Israel’s failure to prevent the massacre. The event stands as another warning sign of the dangers inherent in relying on flawed assumptions and in failing to prepare adequately for emerging threats. It also highlights a lack of strategic thinking and the mistaken belief that diplomatic arrangements with an unstable, jihadist-rooted regime like that of Ahmed al-Sharaa are sufficient to stabilize the situation without contingency planning for alternative scenarios.

Parallels with October 7

The events in Sweida reveal troubling parallels with Hamas’s surprise attack on October 7, 2023. Analyzing these similarities is essential, as they may serve as inspiration for future attacks. The parallels between the two incidents are evident across several dimensions:

Rapid and lethal infiltration
In both cases, the attacking forces relied on high mobility and relatively simple tools—pickup trucks and small arms—to bypass obstacles, penetrate deep into target areas, and inflict mass casualties. The October 7 assault demonstrated how fast-moving units can disrupt even advanced defense systems. The Sweida massacre again underscored the effectiveness of this operational method when used against unprepared, undefended targets. In both attacks, the assailants made use of extreme brutality and deliberate humiliation of victims.

Misplaced strategic assumptions
In both instances, the Israeli security establishment operated under false assumptions. Prior to October 7, the assumption of the Israeli defense establishment was that Hamas was deterred and uninterested in escalation—particularly in light of economic incentives provided to Gaza. Similarly, ahead of the Sweida attack, it was assumed that the Syrian regime would not permit an assault on the Druze due to its desire to engage with the West and its ongoing dialogue with Israeli officials.

Intelligence failures
In both cases, early warning signs were either missed or dismissed. Before October 7, surveillance reports from female spotters were ignored. In the wake of the March 2025 massacre of Alawites by jihadist groups under regime direction, Israeli intelligence should have recognized the increasing risk to the Druze. Nevertheless, the attack and its scale came as a complete surprise, preventing any advance preparation for such a scenario. This is reminiscent of Israel’s shock at the rapid collapse of the Assad regime.

The success of both Hamas and the Syrian–Bedouin forces in Sweida in penetrating quickly, operating in a decentralized manner, and inflicting severe damage—along with repeated Israeli intelligence failures—raises real concerns that other jihadist actors in the region will adopt this model and attempt to replicate it in other theaters.

Where Might the Next Threat Come From?

Despite differences across theaters in terms of the abilities of terrorist groups, several arenas display conditions that could enable similar scenarios drawing on operational models and methods seen in Gaza and Syria.

Lebanon

The Lebanese border remains a volatile front following the IDF’s Operation Northern Arrows, during which thousands of Hezbollah assets were destroyed and the organization’s leader, Hassan Nasrallah, was eliminated. Despite the ceasefire agreement signed in November 2024 and significant enforcement actions by the IDF, Hezbollah continues its efforts to rebuild its forces and reestablish its grip on southern Lebanon. Despite the partial security zone the IDF maintains in southern Lebanon, the area still enables individuals or groups to organize and launch attacks on nearby border communities.

Syria

The IDF maintains a security zone in the Golan Heights along the Syrian border, but the presence of hostile populations—including pro-Iranian formations—poses a constant threat. The Sweida events demonstrated that Syrian regime forces and jihadist actors are capable of operating rapidly and unexpectedly, exploiting weaknesses in Israel’s defenses. The recent incident in which hundreds of Druze crossed the border into Syria, and others from the village of Hader entered Israel without being stopped by IDF forces in the area, illustrates this vulnerability. A scenario in which hostile elements infiltrate Israel cannot be ruled out.

Jordan

The Jordanian border is Israel’s longest and least fortified. Although a decision was made to build an advanced barrier along the border, construction has not yet begun. There is no security buffer zone, the forces deployed along this extended frontier are limited in number, less experienced, and poorly equipped, and an emerging radical Islamist threat exists on the Jordanian side. This threat was illustrated by the shooting attack at the Allenby Crossing in September 2024, in which three Israelis were murdered, and the attack in Neot HaKikar in October 2024, when two terrorists crossed from Jordan and injured IDF soldiers near the community.

Judea and Samaria

Despite the presence of fences and barriers, terrorism persists in this arena. There are frequent infiltrations by illegal Palestinian workers, as well as shootings, stabbings and vehicular attacks. Since the beginning of the Swords of Iron war, more than 1,100 significant attacks have been foiled, and approximately 4,700 wanted individuals arrested. However, the growing use of IEDs and Iran’s involvement in smuggling weapons through Jordan have increased the risk of attacks modeled on October 7.

What Needs to Be Done?

The events in Sweida, following those of October 7, underscore the need for a conceptual shift and an updated operational posture across Israel’s security establishment. Although it appears that no formal inquiry has yet been conducted into the Sweida incident, it is already possible to outline several concrete recommendations to reduce the risk of similar events in the future, based on the lessons learned:

Improve intelligence coverage

Israel must create a dedicated intelligence framework focused on detecting threats of cross-border infiltration. Each regional command should control its own collection apparatus. This intelligence should prioritize enemy capabilities over intentions, while still providing early warning. That includes developing a common conceptual framework for identifying jihadist-style attacks across multiple theaters, using advanced tools such as artificial intelligence and pattern analysis.

More broadly, the Sweida incident once again underscores the need for an independent intelligence assessment center that can challenge Military Intelligence assumptions. This center should sit outside the IDF. This unit should report to the National Security Council as a national body, or alternatively under the Knesset Foreign Affairs and Defense Committee as part of its oversight of the defense establishment.

Security zones

Israel should establish buffer zones several hundred meters deep along each of its borders. These zones should, as far as possible, be free of physical cover and designed to prevent any unauthorized movement through them. They must be continuously monitored and held under fire control, using automated detection and response systems rather than relying on human vigilance. Where feasible, lethal deterrents such as mines or other explosive devices should be deployed to prevent unauthorized crossings.

Construction of advanced barriers

Israel should expedite construction of advanced barriers along the Jordanian border and throughout Judea and Samaria. These barriers must block vehicle and armored-platform crossings and incorporate flat-trajectory firing capabilities. A well-designed barrier should significantly slow any attempted breach and be integrated with responsive fire systems—artillery, mortars, and loitering munitions—that field units can operate independently, without waiting for higher-level authorization.

Proactive defense

Clear operational procedures should be established to allow field units to strike immediately in response to attempted infiltrations. These should include the use of both flat- and high-trajectory fire without requiring approval up the chain of command. Forces in each sector should drill localized counterattacks.

Disruption of enemy preparations

If intelligence locates enemy preparations, Israeli forces should disrupt them with preventive aerial and artillery fire, including strikes on routes of advance. Air Force assets—fighter jets, attack helicopters, and UAVs—and artillery units, including cannons, mortars, and low-altitude loitering drones, should be employed.

Rules of engagement

Rules of engagement should be updated to authorize immediate fire on any unauthorized person within a buffer zone, while minimizing the risk of harming non-combatants.

Fortification of outposts

IDF outposts in all sectors must be positioned and constructed as fortified military positions, not as camps. They should be positioned for mutual fire and observation support and be located ahead of civilian communities, not behind them. Readiness protocols at these outposts should reflect operational requirements at all times, including weekends and holidays.

Community response teams

Community response teams must be expanded and equipped with arms that allow them to delay infiltration attempts until military reinforcements arrive. These teams should also conduct joint drills with neighboring communities to ensure mutual support when needed. Communities adjacent to the border must be protected by their own dedicated barriers. Authorities should ensure that their rapid response teams are fully equipped and trained.

Rapid response

Israel should establish and regularly drill local counterattack capabilities to respond rapidly to jihadist invasion attempts. Each sector must maintain a mobile reserve force capable of quick reaction, including fast deployment of armed drones and the ability to call in supporting fire from air and artillery units. Target maps should be prepared in advance, as was done in the Golan Heights following the Yom Kippur War.

Advanced technologies

Advanced technologies must be integrated into border defense efforts. These should include drones, cyber systems, and underground sensors for threat detection, as well as the development of counter-drone systems and cyber defenses to protect critical security infrastructure.

Conclusion

The Sweida and October 7 attacks highlight the danger of relying on faulty assumptions and of failing to prepare for evolving threats. Israel continues to face the risk of jihadist-style attacks, including rapid, decentralized infiltrations—especially along its borders with Lebanon, Syria, and Jordan, and in Judea and Samaria. To prevent similar events in the future, Israel must overhaul its defensive posture as part of a broader security doctrine. This requires emphasis on improved intelligence, including independent assessments outside Military Intelligence and the IDF; the establishment of buffer zones; proactive defense; and rapid response capabilities. Only by adopting these measures can Israel translate past failures into stronger future border security.

JISS Policy Papers are published through the generosity of the Greg Rosshandler Family.