The Escalation Is Outrunning the Strategy

The Paranoidist | Flash Issue #3 By Paul Morin | March 2, 2026

Ten days ago, in Flash Issue #1, I described five correlated risk vectors and argued that the probability of simultaneous containment was far lower than anyone was pricing.

Two days ago, in Flash Issue #2, I reported that all five vectors had activated within six hours of the first strikes. I called it an alarm, not a victory lap.

Today, on Day Three, every vector has intensified. Several have crossed thresholds that the pre-war planning assumptions treated as worst-case scenarios. Hezbollah has formally entered the war. Six American service members are dead. Iran's Revolutionary Guard has declared the Strait of Hormuz closed and threatened to set fire to any ship that attempts passage. Lloyd's of London has suspended war risk coverage for the Persian Gulf, meaning that no commercial vessel transiting those waters can obtain the insurance required to operate, effectively converting a military closure into a commercial one. The conflict has expanded to include direct strikes on energy infrastructure in Saudi Arabia, Qatar, and the UAE, a drone attack on a British military base in Cyprus, and Israeli bombing campaigns across Beirut and southern Lebanon.

The Supreme Leader is confirmed dead. The administration says the operation could take four to five weeks. The Senate Minority Leader emerged from his briefing and said it raised more questions than it answered. Senator Warner, the ranking member of the Intelligence Committee, says he has heard four different objectives from the administration in nine days.

The escalation is outrunning the strategy. That is the core problem. And it is the problem that every decision-maker reading this needs to confront this week, not next month.

In Flash Issues #1 and #2, I framed the risk as a portfolio of five correlated vectors. The logic was simple: even if each individual vector had a moderate probability of containment, the system-level probability that all five remained contained simultaneously was dramatically lower. That framework has now been validated by events. What follows is an updated assessment of each vector as of Monday evening, March 2.

Flash #2 status: Iran launched "Operation True Promise 4," striking U.S. installations in six countries.

Day Three status: Six U.S. service members have been killed. Three died Sunday in an Iranian attack on a U.S. base in Kuwait. A fourth, seriously wounded in the initial strikes, succumbed to injuries. Two more were killed Monday. Missiles struck near the U.S. Embassy compound in Kuwait City. Two U.S. Air Force F-15E fighter jets were shot down over Kuwait by Kuwaiti air defenses during active combat, a friendly fire incident that underscores the chaos of a multi-front, multi-nation engagement. (All six crew members ejected safely and were recovered.)

Iran's ballistic missile capability is being degraded but has not been neutralized. Israeli officials said Monday they expect Iran's ability to fire ballistic missiles to be "significantly impacted" within 24 hours. That assessment tells you two things: first, the capability still exists as of this writing; second, "significantly impacted" is not "eliminated." Iran has continued to launch successive missile barrages at Israel, striking cities and killing at least 10 people, including nine in a single strike that destroyed a synagogue and bomb shelter in Beit Shemesh outside Jerusalem.

Trajectory: Iran has demonstrated the capacity to sustain multi-day missile operations across multiple fronts despite three days of intensive strikes. The degradation is real. But the assumption that decapitation of leadership produces rapid collapse of military capability is being tested in real time, and it has not yet been confirmed.

Flash #2 status: Iran fired missiles at six Gulf states. One person killed in Abu Dhabi. The conflict had expanded from two participants to more than a dozen.

Day Three status: This vector has undergone a qualitative transformation. Hezbollah formally entered the war on March 2, launching rockets and drones at an Israeli military base in northern Israel. The group called it "revenge for the blood of the Supreme Leader." Israel responded with massive strikes across Beirut and southern Lebanon, issuing evacuation orders to over 50 communities. At least 31 people have been killed in Lebanon and 149 wounded. Israeli strikes reportedly killed Hezbollah's intelligence chief and two senior Iranian intelligence officials in Beirut. Hezbollah political leader Mohammad Raad's body is being searched for in the rubble.

Lebanon's Prime Minister Nawaf Salam condemned Hezbollah's attacks, banned its military activities, ordered the group to surrender its weapons, and told security forces to arrest those responsible. The United States declared the November 2024 ceasefire over and said it would not interfere to stop Israeli strikes on Lebanon, adding that unless the Lebanese state designates Hezbollah as a terrorist organization, "there will be no distinction between the two."

Beyond Lebanon: Iraqi Shiite militia Saraya Awliya al-Dam launched drone attacks on U.S. forces at Baghdad Airport and a base in Erbil. The Houthis in Yemen have threatened to escalate in the Red Sea. Iran struck RAF Akrotiri in Cyprus, a British military base on a NATO member's territory, prompting evacuation of military families. A Chinese national was killed in Tehran crossfire. Over 300 Chinese nationals have been evacuated.

The Kurdish Coalition of Political Forces said its forces are "deep inside Iran" and along the Iran-Iraq border, preparing for a new phase. Iran's president appointed an IRGC general as acting defense minister after the previous one was killed in the strikes.

Trajectory: This is no longer a two-front conflict between the U.S./Israel and Iran. It is a multi-theater regional war. The Lebanon front alone could sustain months of operations. Israel has signaled that "all options are on the table" including a ground incursion. Iraqi militias are demonstrating that U.S. forces across the region remain exposed. And the Houthi threat to the Red Sea, if activated, would create a second major shipping chokepoint crisis simultaneous with Hormuz. The administration's insistence that this is "not a war" and that strikes are "defensive in nature" is not consistent with events on the ground.

Flash #2 status: Vessel tracking showed tankers avoiding the Strait. I wrote that Iran did not need to formally close it; it only needed to make transit credibly dangerous. I called the de facto closure through risk pricing "exactly the mechanism I described last week."

Day Three status: Iran has now formally closed the Strait. An IRGC commander declared it shut and threatened to "set any ship on fire" that attempted passage. This goes beyond the de facto mechanism I described. Four vessels have been hit in Gulf waters since the conflict began. A drone boat killed a mariner on a Marshall Islands-flagged tanker in the Gulf of Oman. Lloyd's of London has suspended war risk coverage for the Persian Gulf, which means that even if a shipping company wanted to send a tanker through, it cannot obtain the insurance required to do so. No insurer, no transit.

Tanker traffic has come to a complete halt. Rystad Energy's chief economist said the world has "not seen anything like this in pretty much the history of the Strait of Hormuz," comparing it to blocking the aorta in a circulatory system. About 14 million barrels per day, roughly a third of the world's seaborne crude exports, normally pass through the Strait. Three-quarters of those exports go to China, India, Japan, and South Korea.

Saudi Arabia has contingency plans to reroute oil through its East-West pipeline via the Red Sea. But that pipeline has limited capacity, it does not help Iraq, Kuwait, or the UAE, and the Red Sea itself faces Houthi threats.

Trajectory: The Strait is closed. The question is no longer whether it closes but how long it stays closed and whether the alternative routes (which are limited and themselves threatened) can absorb the displaced volume. Every day the Strait remains closed, the disruption becomes more structural. Shipping companies will not return on a handshake. They will return when insurers resume coverage, and insurers will resume coverage when the military situation changes. That creates a lag between any eventual ceasefire and the resumption of normal oil transit that most economic models are not accounting for.

Flash #2 status: Israel's offensive cyber campaign was massive. Iran's retaliatory operations had not yet materialized publicly. I noted that the absence of visible retaliation did not mean it was not coming; it may have meant it was being prepared.

Day Three status: This remains the slow vector. No major Iranian cyber operation against U.S. or Western infrastructure has been publicly reported as of Monday evening. However, the indicators are accumulating. Sophos issued a cyber advisory noting that Iranian state-linked actors have "shown a willingness to conduct disruptive and psychologically oriented operations" during periods of escalation. The Iranian hacktivist group Handala Hack, linked to Iran's Ministry of Intelligence, has claimed attacks in Jordan and threatened regional countries. Their capabilities include data theft and wiper malware.

The structural vulnerability I identified in Flash #1 and #2 has not changed. CISA, the lead U.S. cyber defense coordinator, entered the DHS shutdown on February 14. It lost the majority of its workforce. It changed acting directors on February 27, one day before the strikes began. The Cybersecurity Information Sharing Act expired during the shutdown. The nation's cyber defense posture is degraded at the precise moment when the threat environment has reached its highest level in decades.

Trajectory: There are two scenarios. In the first, Iran's cyber command infrastructure was sufficiently degraded alongside conventional command and control systems that large-scale offensive operations are delayed or disrupted. In the second, pre-positioned capabilities and external operators (Iran's cyber operations have historically been partially distributed) are being prepared for deployment on a timeline of days to weeks. The first scenario is comforting. The second is consistent with how Iranian cyber operations have historically worked: slow preparation, then sudden and often destructive execution. Neither scenario changes the fact that U.S. defensive posture is compromised. The worst case is an attack that arrives while CISA is still reconstituting.

Flash #2 status: Brent crude had closed at $73. Markets were closed for the weekend. Analysts projected $80+ at Monday open, with estimates ranging to $100+.

Day Three status: Monday delivered. Brent crude settled approximately 7-9% higher near $78-79 per barrel, with prices extending toward $100 after the IRGC's formal Strait closure announcement after the market close. WTI rose approximately 8% to close around $72-73. Energy stocks surged (Exxon up 4%+, Chevron up nearly 4%). S&P 500 opened down about 1.2%. European natural gas surged more than 20%. Diesel futures settled at their highest level in nearly three years.

The supply-side damage is compounding. Saudi Arabia shut down the Ras Tanura refinery as a precaution after intercepting Iranian drones targeting the facility. Iran struck two QatarEnergy facilities. An energy analyst at RBC described OPEC barrels in the region becoming potential "stranded assets in an extended war scenario." Iraq may have to shut in production entirely (halt extraction at the wellhead because there is nowhere to send the oil) if it cannot access the Strait.

Traders are still pricing a short conflict. Multiple analysts noted that China has substantial oil stockpiles, the global market was recently oversupplied, and the conflict might resolve quickly. These are the same assumptions that produced the pre-war pricing that this newsletter assessed as inadequate. The question is not whether the world can weather a two-week disruption. It is whether the world is prepared for a four-to-five-week disruption (the timeline the President himself stated) with simultaneous damage to Gulf energy infrastructure, a closed Strait, and no defined endpoint.

Trajectory: The cascade is underway. The rate of escalation in the energy sector is a direct function of how long the Strait stays closed and whether Iran continues targeting Gulf energy infrastructure. Barclays projects Brent could hit $100. UBS says a material disruption could push spot prices above $120. Those numbers assume the conflict stays at its current intensity. If it escalates further (and Hezbollah's entry, the Houthi threats, and ongoing strikes on infrastructure suggest it may), the models may again underestimate.

There is a narrative forming that the decapitation of Khamenei and the destruction of senior leadership means Iran's capacity to fight is collapsing. This is a dangerous oversimplification, and it is important to understand why.

Iran has lost its supreme leader, senior IRGC commanders, its defense minister, and significant military infrastructure. Those are real and consequential losses. But the evidence of the past 72 hours demonstrates several things about remaining capability.

Sustained missile operations. Iran has maintained multi-day, multi-front missile barrages targeting Israel, Gulf states, and U.S. installations. The degradation is visible (Israel projects significant impact on ballistic missile capability within 24 hours), but the capacity to launch has not been eliminated.

Proxy activation. Hezbollah's entry into the war was coordinated, not spontaneous. Iraqi militias have conducted multiple operations. The Houthis are threatening escalation. These proxy networks were designed to operate with degrees of autonomy precisely for a scenario like this, where central command is degraded. They do not require daily instructions from Tehran to function.

Asymmetric naval capability. The Strait closure is being enforced not through a conventional naval blockade but through selective drone and rocket attacks that make transit uninsurable. This is an asymmetric strategy that requires relatively modest resources to maintain. Iran does not need to sink a carrier group. It needs to sink (or damage) enough commercial vessels that insurers refuse to cover the rest.

Cyber operations. These have not been deployed at scale. Whether that represents degraded capability or strategic patience, the pre-positioned tools and distributed operators remain a live threat.

The calculus of a wounded regime. This is the factor that most game-theoretic analysis gets wrong. A regime that has lost its leader, is under sustained bombardment, and faces potential collapse does not become more cautious. It becomes less predictable. The restraints that might have governed Iranian decision-making a week ago (concern about regime survival, desire to maintain economic relationships, fear of escalation) have been substantially removed by the strikes themselves. A regime fighting for survival, or individual commanders acting with degraded coordination and personal survival instincts, may take actions that a unified, rational command structure would not. This is the scenario where the models break down most completely.

The planning horizon has changed. Flash #1 was about preparation. Flash #2 was about activation. Flash #3 is about recalibration. The decisions made this week need to account for a conflict that the President says will last four to five weeks, that has already exceeded the scenarios most organizations were modeling, and that has no defined endpoint or off-ramp being offered.

If you are a board director: The question from Flash #2 ("Walk me through our exposure assuming all of these persist simultaneously for six weeks") should now be the centerpiece of your next board discussion, not an agenda item. Three specific things to push for this week: First, demand a scenario analysis that models a sustained Strait closure through the end of April. Not a probabilistic range; a concrete operational plan for what happens if the Strait does not reopen for eight weeks. Second, ask whether your company's cyber incident response plan has been updated to reflect the current threat environment, and whether it assumes access to federal coordination resources (through CISA) that may not be available at full capacity. Third, ask your D&O and property insurers what your current coverage posture is for war-related disruptions. War exclusions in commercial insurance policies are about to become very relevant, and the time to understand your exposure is before the claim, not after.

If you are a CRO or risk leader: Your concurrent-failure scenario is no longer a scenario. It is the operating environment. Three priorities: First, map your full supply chain exposure to the Gulf region, including second- and third-tier suppliers, and identify which inputs have single-source dependencies on Gulf transit. If your organization depends on any commodity that transits the Strait, build an alternative sourcing plan this week. Second, elevate your cyber threat posture to the highest level your organization maintains. The absence of a major Iranian cyber attack to date is not evidence of safety. It is a window that may be closing. Coordinate with your sector ISAC if your direct relationship with CISA is degraded. Third, stress-test your business continuity assumptions against a disruption timeline of eight to twelve weeks, not two to four. If your continuity plan breaks at week six, you need to know that now.

If you are a CEO or founder: The strategic question has moved from "what is our exposure?" to "what is our organizational posture for an extended period of elevated risk across multiple dimensions simultaneously?" This is the environment where single points of failure become existential vulnerabilities. Three things to do this week: First, identify every contract, supplier relationship, and revenue stream that depends directly or indirectly on Gulf energy pricing, Gulf logistics, or Middle Eastern stability, and make a decision about hedging, diversification, or acceleration of alternatives. Second, communicate with your team. The uncertainty is real and your people can see it. Leaders who acknowledge the situation and describe what the organization is doing about it will retain trust and talent better than those who pretend it is business as usual. Third, if you are a startup with less than twelve months of runway, model what happens to your fundraising timeline if markets remain volatile through Q2. The capital environment just changed.

If you are a citizen and a thinker: The administration says this is not a war. Six American service members are dead. Missiles are striking cities across a dozen countries. A British military base on a NATO ally's territory has been hit. The Strait of Hormuz is closed. Hezbollah has opened a new front. The Senate Minority Leader says the briefing he received was "completely and totally insufficient." The ranking member of the Intelligence Committee says he has heard four different objectives in nine days.

Ask the question that Senator Warner asked: which objective, if achieved, means this is over? If the answer is destroying missile capability, that is a measurable goal with a timeline. If the answer is regime change, that is a generational commitment with no defined endpoint. If the answer is "all of the above," then the honest response is that nobody has defined what victory looks like, and a military operation without a defined objective is not a strategy. It is an escalation in search of a purpose.

The war powers votes will happen this week. They will likely be symbolic. But the constitutional question is real regardless of whether Congress asserts itself: a President launched major combat operations, killing foreign heads of state and engaging in sustained warfare across multiple countries, without a declaration of war, without congressional authorization, and, according to the Senate Minority Leader, without a coherent explanation of the objectives. Whether that troubles you depends on your politics. That it is happening is a matter of public record.

Probability that the conflict resolves within one week: Very low. The President has stated four to five weeks as the operational timeline. Iran is sustaining retaliatory operations. Hezbollah has opened a new front. There is no diplomatic channel active and no ceasefire framework being discussed.

Probability that the Strait of Hormuz remains effectively closed for more than two weeks: Moderate to high. The formal closure, the suspension of insurance coverage, and the demonstrated willingness to attack commercial vessels create structural barriers to reopening that will persist beyond any near-term military outcome.

Probability that the conflict expands to include additional fronts (Houthis, additional Iraqi militia operations, or broader regional involvement): Moderate to high. The Houthis have explicitly threatened escalation. Iraqi militias are already conducting operations. Kurdish forces claim to be positioned inside Iran. Each additional front compounds the complexity and reduces the probability of a clean resolution.

Probability that significant Iranian cyber operations against Western targets materialize within 30 days: Moderate. The delay to date may reflect degraded capability or preparation time. The vulnerability of Western targets has not decreased.

Probability that energy prices remain elevated (Brent above $85) through the end of March: Moderate to high. Even a rapid resolution would face structural lags in the resumption of Strait transit, insurance coverage, and tanker scheduling. A prolonged conflict pushes this probability toward near-certain.

Probability that the market has adequately priced the duration, scope, and cascading effects of this conflict: Low. Markets moved on Monday, but the pricing reflects a conflict that resolves in weeks. The indicators suggest a conflict that may persist for months, across multiple fronts, with compounding effects on energy, shipping, cyber security, and regional stability. The gap between the market's implied timeline and the operational reality remains the single largest mispricing in the current environment.

Where I might be wrong: Iran's military capability may degrade faster than the 72-hour evidence suggests. The decapitation of leadership may produce a rapid fragmentation that makes sustained, coordinated retaliation impossible. Hezbollah's entry into the war may prove to be a one-time symbolic gesture rather than a sustained campaign, particularly if Israeli strikes destroy enough of its reconstituted capability. The Strait may reopen quickly if the U.S. Navy establishes a credible convoy system that allows insurers to resume coverage. And markets may prove more sophisticated than I am giving them credit for, having partially priced the tail risk over the weeks of buildup before the strikes. Each of these is possible. The balance of evidence as of Monday evening does not favor any of them as the base case.

The Paranoidist publishes weekly, with flash issues when events warrant. If this changed how you think about one thing, consider subscribing. If it didn't, tell me what I'm missing.

Paul Morin is the founder of DeepStrategy.ai and publisher of The Paranoidist, BoardroomRadar and ScenarioWatch. He has spent more than three decades in entrepreneurship, finance, risk management, and insurance, which is why he worries about the things that keep other people awake at night.

Researched, written, and edited in collaboration with Claude by Anthropic.