Executive Summary: A Security-First Assessment for Decision-Makers

The June 22, 2025, ISIS suicide bombing at the Mar Elias Church in Damascus, which killed over 20 people, serves as the critical catalyst for this security-focused assessment of Syria. While recent diplomatic and economic overtures—including the lifting of U.S. sanctions—have generated significant optimism, this attack starkly demonstrates that the foundational stability required for sustainable recovery remains profoundly fragile. For investors, policymakers, and business leaders, understanding the security landscape is not a secondary consideration but the primary determinant of risk and opportunity.

This report moves beyond the economic headlines to provide a granular analysis of the interlocking security threats confronting Syria's transitional government. We conclude that while a window for a successful transition is open, it is narrow and precarious. The country faces a multi-front challenge from a resurgent ISIS, a persistent loyalist insurgency, geopolitical volatility driven by external military actors, and systemic instability rooted in the conflict's legacy.

Key Security Threats & Their Implications:

ISIS Resurgence & Adaptation: The group has evolved from a rural insurgency into a sophisticated asymmetric threat capable of high-casualty urban terrorism. Its strategic intent is to shatter public confidence and derail the transition. This poses a direct, high-impact threat to personnel, assets, and market stability in all major urban centers.
Loyalist Insurgency & Sectarian Risk: A well-armed insurgency in coastal and central regions is actively working to destabilize the state, often through sectarian violence. This threat directly impacts social cohesion and creates no-go zones for operations and investment, particularly in Latakia, Tartus, and Homs.
Geopolitical Flashpoints: Syria remains a theater for regional conflict. Regular Israeli military operations and responses to Iran-linked proxies create a constant risk of escalation that could disrupt supply chains, close airspace, and jeopardize infrastructure projects.
Endemic Instability: Pervasive unexploded ordnance (UXO) represents a lethal, daily operational hazard, while rampant vigilante justice and organized crime signal a weak rule of law, complicating contract enforcement and creating an unpredictable business environment.

Strategic Outlook for Decision-Makers: The Syrian transitional government has made credible progress in governance reform and has secured vital international support. However, its ultimate success hinges on its capacity to contain these security threats.

For Investors: The current environment demands a security-first approach. Capital deployment must be phased and geographically targeted, with robust contingency plans for security deterioration. The temporary nature of the U.S. sanctions waiver (expiring Nov. 23, 2025) adds a critical political risk layer that must be priced into any long-term commitment.
For Policymakers: The strategic priority is to bolster the transitional government's security capacity. This is the only path to a self-sustaining peace. Support must be targeted at building effective counter-terrorism and law enforcement institutions, funding large-scale de-mining efforts, and actively de-escalating regional military tensions.

Syria is at a tipping point. The path to stability is viable but requires a clear-eyed assessment of the severe risks. Failure to prioritize and mitigate these security threats will undermine all economic and political progress, risking a return to fragmented conflict.

1. Introduction: A Tale of Two Syrias

The fall of the Assad regime in December 2024 was met with a wave of external pessimism. Analysis from institutions like Brookings and the International Crisis Group rightly pointed to the risks of state collapse, a chaotic power vacuum, and renewed civil war. These forecasts, however, stand in stark contrast to the tangible momentum observed on the ground. SALT's Q1 2025 Syrian Business Sentiment Report captured an undercurrent of resilience and a strong desire for Western partnership, a sentiment now validated by billions in investment commitments.

This report seeks to reconcile these two narratives. Using the June 22 Damascus church bombing as a lens, we provide a clear-eyed assessment of the security risks that threaten Syria's recovery. We argue that while the dangers are acute, the concurrent progress in governance and economic reintegration provides a powerful, countervailing force. For decision-makers, success lies in understanding and navigating this paradox.

2. The Momentum for Recovery: A Foundation for Optimism

Despite the security challenges, the progress achieved by the transitional government in its first six months is substantial and forms the basis for a cautiously optimistic outlook.

Economic and Diplomatic Breakthroughs

A rapid diplomatic thaw has unlocked significant economic potential. The pivotal moment was the May 23, 2025, issuance of U.S. General License 25, which lifted comprehensive sanctions and was accompanied by a 180-day Caesar Act waiver. This move, supported by the EU and UK, has catalyzed recovery:

Major Investments: Over $8 billion in foreign investment has been committed. This includes a $7 billion energy and reconstruction deal with a Qatari-Turkish-U.S. consortium, an $800 million MoU with DP World for Tartus Port, and a €230 million contract with CMA CGM for Latakia Port.
Financial Normalization: The Syrian Pound appreciated over 25% against the U.S. dollar following the sanctions announcement. The IMF and World Bank have re-engaged for the first time in over a decade, and the Central Bank is actively working to rejoin the SWIFT international payments system.
International Reintegration: President Ahmed al-Sharaa's official visit to Paris and high-level meetings with U.S., Turkish, and Gulf leaders have firmly placed Syria back on the international stage.

State-Building and Governance Reform

The transitional government has taken credible steps to dismantle the old regime's repressive structures and build new, more accountable institutions.

Security Sector Reform: The May 24 restructuring of the Interior Ministry, which abolished the notorious Political Security Directorate, is a landmark reform. The establishment of new departments for counter-terrorism and border security signals a shift toward a professional, non-ideological security apparatus.
Transitional Justice: The formation of a Transitional Justice Commission and a National Authority for Missing Persons in May addresses a core grievance of the population and is a crucial step toward national reconciliation.
Rule of Law: A new military code of conduct was announced on May 30, and a Supreme Fatwa Council decree on June 6 explicitly forbade acts of vigilante revenge, aiming to re-establish the state's monopoly on justice.

3. The Security Challenge: A Realistic Risk Assessment

This positive momentum is constantly tested by a multifaceted security environment. The Damascus bombing was not an anomaly but a symptom of deeper, persistent threats.

The Asymmetric Threat: ISIS 2.0

Having lost its territorial caliphate, ISIS has adapted into a potent insurgency. Its primary objective is to spoil the transition and prove the new state is illegitimate and incapable of providing security.

Urban Terror Capability: The June 22 attack demonstrates the group's ability to plan and execute high-casualty operations in the heart of the capital. This tactic is designed to maximize fear and stoke sectarian divisions.
Rural Insurgency: The group maintains a persistent campaign of IED attacks, ambushes, and assassinations in the central and eastern deserts, targeting security patrols and energy infrastructure to disrupt state control.
Strategic Intent: ISIS propaganda now explicitly targets the transitional government. Intelligence suggests a strategic shift to move experienced operatives into urban sleeper cells, posing a long-term threat to all major population centers.

The Loyalist Insurgency: A Sectarian Fault Line

A well-armed and motivated insurgency, comprised of former Assad loyalists, operates in coastal and central regions. While not an existential threat to the state, it is a significant driver of instability and sectarian violence.

Geographic Focus: The insurgency is concentrated in the Alawite-majority governorates of Latakia and Tartus, preying on the community's fears and grievances.
Tactics: The group employs classic guerrilla tactics, including checkpoint ambushes, assassinations, and infrastructure sabotage. The discovery of large, sophisticated weapons caches indicates a high degree of organization.
Sectarian Risk: The conflict has a sharp sectarian edge. The massacres during the March clashes in Jableh highlight the risk of this insurgency sparking wider communal conflict, which would be devastating for national reconciliation efforts.

Geopolitical Volatility & External Actors

Syria's stability remains hostage to regional power dynamics, primarily the ongoing conflict between Israel and Iran.

Israeli Military Operations: Israel has adopted a proactive and aggressive posture to prevent hostile entrenchment on its border. Our SITREPs have tracked a significant increase in Israeli ground incursions (over a dozen per week at times in June) and continued airstrikes on military and alleged proxy targets across the country.
Risk of Escalation: These actions create a high-risk environment. The June 3 rocket attack from Syria into Israel and the subsequent, large-scale Israeli retaliation demonstrate how quickly localized incidents can escalate, threatening to disrupt trade, investment, and the broader stabilization effort.

4. Systemic Risks and Pathways to Mitigation

Beyond active armed groups, the legacy of the conflict has created systemic risks that challenge recovery. However, for each, the government is pursuing clear mitigation strategies.

The Rule of Law Vacuum: The collapse of the old regime created a void where vigilante justice and organized crime flourished. This is the most significant social risk. Our data shows retaliatory killings were a leading cause of violent death in early 2025.
- Mitigation: The government's establishment of transitional justice mechanisms and the restructuring of the Interior Ministry are direct responses. The deployment of professional Public Security forces to flashpoints like Sahnaya and Suwayda aims to replace militia rule with state authority and rebuild public trust in the rule of law.
The Unseen Hazard: Unexploded Ordnance (UXO): The landscape is dangerously contaminated with landmines and UXO, which kill and injure civilians weekly and severely hamper economic activity, especially agriculture and construction.
- Mitigation: The government has announced plans for a national demining center and is actively cooperating with international partners like the Syrian Civil Defense to address this threat. This is a clear "win" where international support can have a direct and immediate impact.

5. Strategic Outlook: The Race Between Recovery and Risk

Syria is at a critical inflection point. The race between economic recovery and the forces of destabilization will define its future. The positive momentum is real and powerful, but the security risks are equally significant.

Risk & Likelihood Assessment:

Likelihood of State Collapse (Low): The combination of broad international support, tangible investment, and the government's active state-building efforts makes a full-scale collapse unlikely in the short to medium term.
Likelihood of Contained, Low-Level Conflict (High): This is the most probable scenario for the next 12-18 months. ISIS attacks, loyalist insurgency, and localized criminal violence will continue to challenge the state. However, they are unlikely to halt the overall trajectory of recovery, provided the government's security capacity continues to improve.
Likelihood of Major Interstate Escalation (Medium): This is the primary wildcard. A direct, sustained conflict with Israel, triggered by proxy actions or miscalculation, could rapidly derail all progress. The recent establishment of de-escalation channels is a positive development that reduces this risk.

Implications for Decision-Makers

For Investors and Businesses: The investment thesis for Syria remains positive but is contingent on security. A security-first approach, involving phased capital deployment and localized risk assessments, is essential. The coastal ports and urban centers of Damascus and Aleppo offer the most secure entry points. The temporary nature of the U.S. sanctions waiver (expiring November 23, 2025) creates a critical timeline; its renewal will be the single most important indicator of long-term investment viability.
For Policymakers: The strategic priority is clear: support the transitional government's capacity to consolidate security. This is the foundational layer upon which all other progress depends. Targeted assistance for counter-terrorism, border security, de-mining, and rule-of-law initiatives will yield the highest returns for stability.

Final Assessment: The attack in Damascus is a reminder of the perils Syria faces. However, it should not overshadow the genuine progress being made. The country is moving forward, driven by a resilient private sector and a re-engaged international community. The path is difficult, but the momentum is in the direction of recovery. For those willing to navigate the complexities, the opportunity to participate in the rebuilding of Syria is significant and achievable.

APPENDIX

This appendix provides the granular, proprietary data underpinning the main report's analysis. It is designed to offer decision-makers a detailed, evidence-based foundation for assessing the complex security environment in Syria.

A. Threat Actor Profile & Activity Matrix

Threat Actor	Objectives	Tactics & Methods (Recent Examples from SITREPs)	Geographic Focus	SALT Capability/Intent Assessment
Islamic State (ISIS)	Undermine the transitional state, prevent stabilization, stoke sectarianism, re-establish safe havens, and recruit.	Urban Terror: Suicide bombings (Damascus church, June 22), IEDs in public spaces. Insurgency: Ambushes on patrols (Deir ez Zour, May), targeted assassinations, extortion ('taxation') of businesses. Propaganda: Calls for foreign fighters to join the fight against the new government (al-Naba, May).	Central & Eastern Syria (Deir ez Zour, Raqqa, Homs desert), with increasing sleeper cell activity in major cities (Damascus, Homs, Aleppo).	Capability: Degraded but resilient. Retains expertise in IEDs and asymmetric warfare. Proven ability to penetrate high-security zones. Intent: High. Views the transition as an existential threat and an opportunity. Seeks to prove the state cannot provide security.
Former Assad Loyalists	Destabilize the transitional government, protect community interests, exact revenge, create conditions for a potential counter-movement.	Insurgency: Checkpoint ambushes, assassinations of interim officials. Sectarian Violence: Attacks on non-Alawite civilians, massacres (Latakia, March). Sabotage: Arson, destruction of infrastructure (power lines, Latakia, March). Seizure of sophisticated IEDs & ATGMs indicates organized supply.	Coastal Governorates (Latakia, Tartus) and adjacent Alawite-majority areas in Hama and Homs.	Capability: Moderate but localized. Access to significant weapons caches and military experience. Lacks unified command. Intent: High but fragmented. Primarily defensive and reactive, but capable of coordinated, destabilizing attacks.
Israeli Military (IDF)	Prevent Iranian/Hezbollah entrenchment, create a demilitarized buffer zone, degrade Syrian military capabilities, and respond to cross-border threats.	Airstrikes: Targeting military bases, weapons depots, and alleged proxy infrastructure (Latakia port, March; Hama airport, April). Ground Incursions: Regular patrols, checkpoint establishment, demolition of former regime posts, arrests (Dozens of incursions in Quneitra/Daraa, May-June).	Southern Syria (Daraa, Quneitra, Rif Dimashq), with airstrike reach across the entire country.	Capability: Overwhelming military superiority. Precise intelligence and strike capacity. Intent: High and proactive. Seeks to shape the security environment on its border decisively. Actions risk unintentional escalation with government forces.
Organized Crime Networks	Profit-driven activities, exploitation of security vacuums.	Narcotics Trafficking: Large-scale Captagon production and smuggling (14 million pills seized in joint Syrian-Turkish op, May). Kidnapping for Ransom: Regular incidents in Homs, Rif Dimashq. Weapons Smuggling: Supplying all sides, including loyalists and regional actors (Hezbollah).	All governorates, concentrated along border regions (Lebanon, Jordan, Iraq) and in areas with weak state control.	Capability: High and adaptive. Deeply entrenched networks from the war economy. Intent: Purely financial, but actions directly undermine state authority and fuel violence.
Local Militias / Factions	Local security, protection of communal interests, settling scores, resisting central government control.	Vigilante Justice: Targeted killings of former regime figures (accounted for 71% of non-UXO deaths in one week in June). Inter-tribal/communal clashes: Disputes over land and resources (Daraa, Hama, Suwayda). Resistance to Disarmament: Clashes with government forces over control (Sahnaya, April).	Southern Syria (Daraa, Suwayda), parts of Aleppo, and other areas with strong local identities.	Capability: Varies from small groups to organized formations (e.g., Daraa's Eighth Brigade, Druze militias). Intent: Primarily local and defensive, but can be a major spoiler to national consolidation efforts.

B. Geographic Security Risk Assessment (As of June 2025)

Region	Primary Threats	Recent Key Incidents (from SITREPs)	Overall Stability/Risk Rating
Damascus & Rif Dimashq	ISIS urban terrorism, organized crime, localized loyalist/sectarian clashes.	June 22: ISIS suicide bombing at Mar Elias Church kills 20+. Late April: Heavy sectarian clashes in Sahnaya kill dozens. May/June: Ongoing arrests of loyalist cells and seizure of weapons caches.	Medium-High Risk
Coastal Region (Latakia/Tartus)	Pro-Assad loyalist insurgency, sectarian violence, organized crime.	March 7: Coordinated loyalist attacks in Jableh kill >15 government forces. May/June: Regular assassinations of Alawite figures and pro-Assad gunmen. May 15: Discovery of >1,000 sophisticated IEDs in a loyalist warehouse. May 30: Israeli airstrikes on coastal military sites.	High Risk
Southern Region (Daraa/Suwayda/Quneitra)	Israeli military operations, tribal clashes, vigilante justice, drug smuggling, ISIS cells.	June: 18 Israeli ground incursions in one week. June 3: Rocket fire from Daraa into Israel prompts major Israeli retaliation. April/May: Major clashes between government forces and local factions in Daraa and Sahnaya. June 12: Israeli raid/arrests in Beit Jinn.	High Risk
Central Region (Homs/Hama)	Loyalist insurgency, ISIS desert cells, organized crime, vigilante justice.	June 4: Assassination of 8 Alawite men in rural Hama. May 25: Seizure of 120+ Grad rockets intended for smuggling to Lebanon. June 10: Government officer killed in outlaw attack in Tal Kalah. Regular UXO incidents.	High Risk
Northeast (Hasakeh/Raqqa/Deir ez Zour)	ISIS insurgency, tribal clashes, unresolved SDF-government tensions.	May/June: Dozens of ISIS attacks on SDF and civilians. May 2: Completion of U.S. military withdrawal from Deir ez Zour bases. June 2: Major government-SDF prisoner exchange. June 1: ISIS IED kills 3 Asayish fighters on Raqqa-Hasakeh highway.	Medium Risk (but volatile)
Northwest (Aleppo/Idlib)	Inter-factional clashes (SNA), organized crime, foreign fighter elements, UXO.	June 2: Government-SDF demilitarization of Tishreen Dam frontline. May 31: Seizure of 800kg of hashish in al-Safira. June 10: Suspected U.S. drone strikes target al-Qaeda figures in Idlib. High concentration of UXO casualties.	Medium Risk

C. Systemic Instability Tracker: UXO & Vigilante Killings (2025)

Month	Confirmed UXO-Related Deaths (Civilian & Combatant)	Confirmed Vigilante/Targeted Killings (Former Regime Figures & Associates)
January	29	11
February	41	18
March	35	24
April	48	31
May	52	39
June (1-20)	27	19

Source: Aggregated from SALT weekly SITREPs. These figures represent a baseline and the actual numbers are likely higher.

D. State Security Apparatus: Key Reforms & Appointments (2025)

March 29: Formation of transitional government with technocrats in key economic ministries. HTS members retain Defense, Interior, Justice.
May 15: Establishment of a Transitional Justice Commission and a National Authority for Missing Persons.
May 24: Comprehensive restructuring of the Interior Ministry. Political Security Directorate is abolished. New departments for Counterterrorism, Border Security, and Prisons/Correction are established.
May 30: Announcement of a new military code of conduct for the Syrian Army.
June 1: Formal dissolution of the Syrian Civil Defense (White Helmets) and integration into the Ministry of Emergency and Disaster Response.
June 2: First round of substantive government-SDF talks in Damascus results in agreement to form joint subcommittees.
June 6: Supreme Fatwa Council issues a decree forbidding individual acts of revenge, mandating use of the judiciary.

E. Documented Links Between the Assad Regime and the Islamic State (ISIS)

The following outline summarizes key findings from the Washington Institute's report "The role of the islamic State in the Assad regime’s Strategy for regime Survival", authored by Matthew Levitt, detailing the Syrian government's multifaceted support for ISIS and its precursor, al-Qaeda in Iraq (AQI).

1. Strategic Rationale & Deliberate Policy

Self-Fulfilling Prophecy: The Assad regime made a strategic decision to enable the rise of ISIS to portray all opposition as "terrorists," thereby forcing the international community into a choice between "Assad or we burn the country."
High-Level Coordination: This strategy was formulated by the Central Crisis Management Cell (CCMC), a top national-security body reporting directly to Bashar al-Assad and comprising his most loyal intelligence chiefs and relatives.
Targeting Priorities: The regime focused its military efforts on moderate rebel groups like the Free Syrian Army (FSA), while largely avoiding conflict with ISIS, especially in the group's early expansion phase (2012-2015).

2. Operational & Tactical Support

Systematic Prisoner Releases: Beginning in 2011 (e.g., Decree No. 61), the regime granted amnesties that released numerous hardline Islamist militants from prisons like the notorious Sednaya facility. Many of these "Sednaya graduates" went on to become senior leaders in ISIS and other jihadist groups.
Military Non-Aggression & Collusion:
- The regime frequently refrained from targeting major ISIS headquarters and positions, such as its de facto capital in Raqqa.
- Evidence suggests the regime conducted air-strikes in support of ISIS advances against other rebel factions, notably in Aleppo (June 2015).
- The regime and ISIS engaged in evacuation deals that redirected ISIS fighters away from regime forces and toward moderate rebel-held areas.

3. Financial & Economic Interdependence

Oil & Gas Trade: The Assad regime was a primary customer for oil and gas from ISIS-controlled fields. This trade was facilitated by regime-linked middlemen, including:
- George Haswani (HESCO): Designated by both the EU and U.S. for acting as a middleman for oil purchases by the regime from ISIS.
- Muhammad al-Qatirji: Designated by the U.S. Treasury for facilitating fuel trade between the regime and ISIS, and for providing supplies to ISIS-controlled areas.
Grain Trade: Regime-linked businessmen, such as Samer Foz, were involved in transporting grain to and from ISIS-controlled territory.
Banking & Financial Services: Unlike Iraq, the Assad regime allowed Syrian banks in ISIS-held territory to remain connected to their Damascus headquarters and the international financial system, providing ISIS with critical financial access (FATF, 2015).

4. Historical Precedent: Support for al-Qaeda in Iraq (AQI)

Facilitation of Foreign Fighters: Prior to the 2011 civil war, the Assad regime tolerated and facilitated "rat routes" through Syria, which were essential for moving foreign fighters, funds, and weapons to AQI (the precursor to ISIS).
Known Terrorist Networks: The U.S. Treasury designated the Syria-based "Abu Ghadiyah Network" in 2008 for controlling the flow of personnel and resources to AQI with the knowledge of the Syrian government.
Direct Support to Operatives: The regime provided direct financial and material support to AQI facilitators. Fawzi al-Rawi, a leader of the Iraqi Ba’ath Party wing in Syria, was appointed by Assad himself, had close ties to Syrian intelligence, and facilitated hundreds of thousands of dollars, weapons, and bombers to AQI on behalf of the regime.

Syria's Security and Stability: Assessment and Outlook