The Containment Assumption Failed in Six Hours

The Paranoidist | Flash Issue #2 By Paul Morin | February 28, 2026

Seven days ago, in The Paranoidist's first flash issue, I made a simple argument. A U.S. strike on Iran would not create one retaliation pathway. It would create at least five, running concurrently. And the system-level probability that all five remained contained was dramatically lower than the probability that any single one did.

I described it as a portfolio of correlated risks: Strait of Hormuz disruption, cyber operations, regional proxy activation, direct missile retaliation against U.S. assets, and an energy supply chain cascade. I argued that the containment assumption, the belief that strikes would be a discrete event with a beginning, a middle, and an end, was the crux of the entire strategic calculus. And I assessed the probability that markets had adequately priced the correlated scenario as "near zero."

The strikes began this morning. Within six hours, every vector in the portfolio was active.

This is not a victory lap. It is an alarm.

At approximately 10:00 a.m. Tehran time on Saturday, February 28, the United States and Israel launched coordinated strikes across Iran. In a significant departure from standard military doctrine, the operation began in broad daylight, deliberately designed to catch Iranian defenses off guard. The operation, which Israel codenamed "Operation Roaring Lion" and the Pentagon calls "Operation Epic Fury," hit targets in Tehran, Isfahan, Qom, Kermanshah, Karaj, Tabriz, and Bushehr. U.S. officials described it as "not a small strike." President Trump, in a video posted at approximately 2:30 a.m. Eastern time, announced "major combat operations in Iran."

This was not the limited, surgical strike that the containment assumption required. Three features of the operation reveal why.

First, the targeting was explicitly aimed at regime decapitation. Israeli strikes hit the compound of Supreme Leader Khamenei, the presidential palace, the National Security Council, and IRGC command infrastructure. Israel targeted the entire leadership chain: Khamenei, President Pezeshkian, IRGC commander Pakpour, Defense Minister Nasirzadeh. Israeli officials assess that Pakpour and Nasirzadeh were killed. Khamenei's compound has been reduced to rubble. His status is unknown; contact has been lost. Iran's Foreign Minister Araghchi stated only that Khamenei is alive "as far as I know."

Second, the stated objective is regime change. Trump called on Iranians to "take over your government. It will be yours to take. This will be probably your only chance for generations." Netanyahu said the operation would continue "as long as needed" and was designed to "create the conditions for the brave Iranian people to take their destiny into their own hands." There is no defined endpoint. There is no off-ramp being offered.

Third, the operation included one of the largest known cyberattacks in history as a simultaneous component. Israel drove Iran's internet connectivity to 4% of normal traffic, took state media offline, disrupted IRGC communications systems, and reportedly degraded drone and missile launch coordination capabilities. This was not a supporting action. It was an integrated warfare operation designed to blind and paralyze the regime simultaneously with the kinetic strikes.

Vector 1: Direct Missile Retaliation Against U.S. Assets. Iran launched "Operation True Promise 4" within hours. The IRGC targeted U.S. military installations in six countries simultaneously: the Fifth Fleet headquarters in Bahrain (confirmed struck), Al Udeid Air Base in Qatar, Ali Al Salem Air Base in Kuwait, Al Dhafra Air Base in the UAE, Muwaffaq Al-Salti Air Base in Jordan, and a base in northern Iraq. Multiple Gulf states activated missile defense systems and closed their airspace. The U.S. Embassy in Bahrain issued shelter-in-place orders. This is not localized. This is regional.

Vector 2: Regional Proxy and Multi-Front Activation. This went regional immediately. Iran did not limit its response to the parties that struck it. It fired missiles at every Gulf state hosting U.S. assets: Bahrain, Kuwait, Qatar, the UAE, Jordan, Saudi Arabia. Explosions were heard from Doha to Dubai to Riyadh. One person was killed in Abu Dhabi from falling missile debris. An Israeli drone strike hit a Kataib Hezbollah headquarters in Iraq, killing two. Warplanes and missiles were tracked crossing Iraqi airspace. Iran's Foreign Minister warned all regional states that any nation allowing the U.S. or Israel to use its territory for operations would become a "legitimate target." The Gulf states that tried to stay neutral have been pulled in. Saudi Arabia condemned what it called "brutal Iranian aggression" and pledged solidarity with the targeted countries. The conflict has expanded from two participants to more than a dozen in under six hours.

Vector 3: Strait of Hormuz. Vessel tracking data shows oil tankers are already avoiding the Strait. Ships are piling up on either side. The Strait is now described by energy analysts as a "war zone." Iran has not formally closed the waterway, but it does not need to. It needs only to make transit credibly dangerous, which it has. Insurance costs for Gulf transit will spike. Shipping companies will reroute or pause. The physical closure the containment assumption worried about is less important than the de facto closure that risk pricing creates. This is exactly the mechanism I described last week.

Vector 4: Cyber Operations. Israel's offensive cyber campaign against Iran was massive and immediate. Iran's retaliatory cyber operations against U.S. and Western infrastructure have not yet materialized publicly. This is the vector that may take days or weeks to manifest. The conditions I identified last week remain fully in place: Iran has spent two decades building capabilities specifically for this scenario; CISA, FBI, and NSA have all warned that Iranian actors routinely target U.S. critical infrastructure; and the scale of the current operation provides the strongest justification Iran has ever had for proportionally ambitious cyber retaliation. What has changed since last week is that CISA, the nation's lead cyber defense coordinator, entered the DHS shutdown on February 14, lost the majority of its workforce to furloughs, and changed acting directors again on February 27. The absence of visible cyber retaliation today does not mean it is not coming. It may mean it is being prepared.

Vector 5: Energy Supply Chain Cascade. Brent crude closed Friday at approximately $73 per barrel, already up roughly 12% from recent lows on the pre-strike buildup. Markets are closed for the weekend. Analysts are projecting an immediate jump to $80 or above when trading opens Monday, with estimates ranging to $100 or beyond if the Strait remains contested. Lombard Odier has estimated a temporary spike beyond $100 is plausible. Capital Economics has warned that such an increase could add up to 0.7 percentage points to global inflation. Bitcoin crashed roughly $2,500 in 45 minutes on the news, erasing $75 billion in crypto market capitalization. Gold, up 22% year-to-date, will likely surge further as a haven. Gulf equities are expected to drop 3-5% when they open Sunday. The cascade has not arrived yet. Monday will begin to show what it looks like.

Last week, I argued that the risks were correlated: the same Iranian decision calculus drives all five vectors, and if one escalates, it changes the calculus on every other front simultaneously. That argument was correct. But the reality is worse than the portfolio model suggested, for three reasons.

The operation was designed to prevent calibrated response. A limited strike on nuclear facilities would have given Iran the option of a calibrated, proportional response, the scenario where containment was most plausible. Instead, the U.S. and Israel targeted the regime itself: the Supreme Leader's compound, the president, the military chain of command, communications infrastructure. They simultaneously degraded Iran's ability to coordinate any response at all by collapsing its digital infrastructure. When you attack a regime's existence while blinding its command structure, you do not get calibrated response. You get survival response. The architecture of the operation was incompatible with the containment assumption from the first sortie.

The regime change framing eliminates the off-ramp. In every prior confrontation between the U.S. and Iran, including the Soleimani killing in 2020 and the June 2025 strikes, both sides maintained the fiction that the conflict was bounded. Strikes were presented as punitive or preventive. Channels remained open. Face-saving compromises were available. Today, the President of the United States called on the Iranian people to overthrow their government. The Prime Minister of Israel said the operation was designed to "remove an existential threat." When you tell a regime that the goal is its elimination, it has no incentive to de-escalate. It has every incentive to maximize damage in what it perceives as a fight for survival. This is the game theory problem that the flash issue warned about. Now it is operational.

Iran went after the Gulf states. The most significant escalation may not be the strikes on U.S. bases. It is that Iran fired missiles at sovereign nations that were not parties to the attack: Qatar, Kuwait, the UAE, Saudi Arabia, Jordan, Bahrain. Iran's Foreign Minister explicitly warned that any nation supporting the U.S. or Israeli operations becomes a legitimate target. This transforms a bilateral conflict into a regional war. It pulls in countries that were actively mediating against strikes. Oman's Foreign Minister, who just hours earlier described the U.S.-Iran talks as making "significant progress," expressed dismay at the strikes. The diplomatic architecture that might have managed de-escalation has been destroyed along with Khamenei's compound.

There is a developing story that will shape the trajectory of this conflict far more than the strategic targeting. Iranian state media reports that a strike hit a girls' elementary school in Minab, in Hormozgan province, killing at least 40 to 53 students. Iranian Foreign Minister Araghchi described it as bombing a school "in broad daylight, when packed with young pupils." Neither the U.S. nor Israel has confirmed or addressed the report.

An IRGC base is located in Minab, which may explain the proximity. But the political and strategic consequences of dead schoolchildren in an operation framed as "liberating the Iranian people" are profound. Trump's message to Iranian civilians was "the hour of your freedom is at hand." The images coming out of Minab tell a different story. Whether the targeting was intentional, a tragic error, or Iranian propaganda (and at this point, the facts are contested and unverified), the narrative damage is real and immediate. It complicates the regime-change argument domestically and internationally. It provides Iran with a galvanizing atrocity story. And it demonstrates a truth that military planners know but politicians rarely acknowledge: sustained bombardment of a populated country produces civilian casualties, and those casualties have strategic consequences that no targeting model captures.

Here is what I am watching, and what you should be watching.

The next 48 hours. Monday's market open will provide the first real-time pricing of the correlated scenario. Watch Brent crude, gold, the VIX, and the Israeli shekel. Watch whether major shipping lines announce formal suspensions of Gulf transit. Watch whether Lloyd's issues updated war risk designations.

The cyber vector. Iran's retaliatory cyber operations are the slowest-moving but potentially most disruptive vector for U.S. organizations. If CISA issues a "Shields Up" advisory specific to Iranian threats, treat it as a high-confidence signal that the U.S. government expects significant cyber retaliation against domestic infrastructure. But here is a complication that would be darkly comic if it were not so consequential: CISA is currently operating at roughly 38% capacity. The DHS shutdown that began February 14 furloughed the majority of CISA's workforce, leaving only 888 of 2,341 employees on the job, unpaid. The agency just underwent yet another leadership change on February 27, its latest acting director moving to a DHS strategy role while the Senate has still not confirmed a permanent director. CISA's acting director told Congress before the shutdown that the agency would be "strictly limited to those [activities] that are essential to protecting life and property" and unable to proactively scan for cyber vulnerabilities. The Cybersecurity Information Sharing Act, which provided legal cover for private sector threat intelligence sharing with CISA, expired during the shutdown and has not been renewed. The nation's lead cyber defense agency is hobbled, leaderless in any permanent sense, and operating on a skeleton crew at the precise moment when a state-level adversary has the strongest justification it has ever had for ambitious cyber retaliation against U.S. critical infrastructure. The 4% internet connectivity in Iran means Tehran's own offensive cyber teams may be degraded in the short term. But Iranian cyber capabilities include operators positioned outside Iran, pre-positioned access to U.S. systems, and proxy hacktivist groups that operate independently. Do not assume the communications blackout in Iran means the cyber threat is neutralized.

The Strait. Iran has not formally closed the Strait of Hormuz. The question is whether it needs to. If shipping companies and insurers effectively close it through risk pricing and operational decisions, the economic impact is similar. Watch for: formal insurance exclusion zones, shipping line route changes, and any reports of mines, fast-boat activity, or threats to commercial vessels. The de facto closure may arrive before any formal announcement.

Iran's internal situation. Khamenei's status is the single most consequential unknown. If he is dead, the succession crisis adds a layer of chaos to an already chaotic decision environment. Iran's constitution provides for the Assembly of Experts to select a new Supreme Leader, but that process assumes institutional continuity that may not exist in the middle of a bombing campaign. If the regime's command structure is sufficiently degraded, the responses may become less coordinated and more dangerous, not less.

The congressional response. War powers votes were already scheduled for next week. The Massie-Khanna resolution in the House and the Kaine-Paul resolution in the Senate will test whether Congress asserts its constitutional role. The political dynamics are complex: bipartisan opposition (Massie is Republican, Khanna is Democrat) and bipartisan support (Fetterman, a Democrat, praised the strikes; Graham, a Republican, celebrated them). The constitutional question is real. Trump launched major combat operations without congressional authorization. Whether that matters depends on whether enough legislators in both parties decide it matters.

Week three. This is the question I posed a week ago, and it remains the question nobody in power is answering. What is the plan for week three? For week six? The operation has been described as continuing "as long as needed." The military infrastructure suggests weeks of operations, not days. U.S. planners were reportedly preparing for a weeks-long sustained campaign even before the strikes began. If Iran's retaliation continues, if the Strait remains contested, if cyber operations escalate, if energy prices spike and stay elevated, what is the plan? The absence of that plan is not a gap in communication. It is a gap in strategy.

Everything I recommended in Flash Issue #1 remains relevant, but the timeline has compressed from preparation to response.

If you are a board director: The correlated scenario is no longer hypothetical. It is today's news. If your board has not received a briefing on simultaneous exposure to energy cost spikes, Gulf supply chain disruption, and elevated cyber threat, that briefing should happen this week, not next quarter. The question to ask management: "Walk me through our exposure assuming all of these persist simultaneously for six weeks. Not one at a time. All at once."

If you are a CRO or risk leader: Activate your crisis management protocols now, not when the impacts arrive Monday morning. Run the concurrent-failure scenario on your operations. Identify every point where your business touches the Gulf, directly or through suppliers. Validate that your cyber incident response plan accounts for a state-level adversary, not just criminal ransomware. And check your business continuity assumptions: if they were built around a two-week disruption, they were built around the wrong scenario.

If you are a CEO or founder: The strategic question is no longer theoretical. Your margins, your supply chain reliability, your digital infrastructure, and your market environment are all under simultaneous stress starting Monday. The single points of failure that were acceptable in a benign environment are now critical vulnerabilities in a hostile one. If you have not already identified them, the time to start is measured in hours, not days.

If you are a citizen and a thinker: The containment assumption failed in six hours. Every escalation vector activated simultaneously. The conflict has expanded from two nations to more than a dozen. The stated objective is regime change with no defined endpoint. Dead schoolchildren are being pulled from rubble in a country whose people we said we were liberating (still to be confirmed). Ask the people who advocated for this to explain, specifically, what happens next. Not the best case. The realistic case. Because the realistic case is already worse than what the markets, the strategists, and the politicians were prepared for twelve hours ago.

Probability that the conflict remains limited to air/sea strikes and does not expand further: Low. It has already expanded to six countries beyond Iran and Israel. The regime change framing provides no boundary conditions for termination.

Probability of sustained disruption to Strait of Hormuz transit (de facto or formal) persisting beyond one week: Moderate to high. Vessel tracking already shows avoidance behavior. Insurance and shipping decisions in the next 48 hours will determine whether the de facto closure becomes structural.

Probability of significant Iranian cyber operations against U.S. or Western infrastructure within the next 30 days: Moderate to high. Iran's degraded communications may delay but will not prevent this vector from activating. Pre-positioned capabilities and external operators remain functional.

Probability that markets on Monday adequately price the full duration and scope of the correlated scenario: Near zero, again. Markets will price the shock. They are unlikely to price a multi-week sustained campaign with simultaneous energy disruption, cyber threat, and regional instability, because most models still assume this ends quickly. The containment assumption is dead, but its ghost will haunt the pricing models for days or weeks before reality catches up.

Where I might be wrong: It is possible that the strikes achieve their decapitation objectives so thoroughly that the Iranian regime's ability to sustain retaliation collapses within days. If Khamenei is dead and the command structure is sufficiently degraded, Iran's response could fragment and dissipate rather than escalate. It is possible that U.S. naval forces in the Gulf effectively secure the Strait against meaningful disruption. It is possible that Gulf states, despite being struck by Iranian missiles, quickly re-stabilize and the regional expansion remains limited. And it is possible that markets, having partially priced the risk over recent weeks, absorb the shock more efficiently than expected. Each of these is plausible. None of them is the base case.

The Paranoidist publishes weekly, with flash issues when events warrant. If this changed how you think about one thing, consider subscribing. If it didn't, tell me what I'm missing.

Paul Morin is the founder of DeepStrategy.ai and publisher of The Paranoidist, BoardroomRadar and ScenarioWatch. He has spent more than three decades in entrepreneurship, finance, risk management, and insurance, which is why he worries about the things that keep other people awake at night.

Researched, written, and edited in collaboration with Claude by Anthropic.