Daily Security Brief: 15 July 2026

Intelligence Brief: 15 July 2026

Sources cross-checked: Reuters, Bloomberg, AP, Lloyd's Market Association, NATO summit closing statement, Dutch NCSC advisory, FCDO and State Department travel guidance. Coverage window: 24 hours prior to 08:00 CET. Pro-EU and NATO-aligned sources only.

Global Threat Landscape

• Strait of Hormuz: day two, Lloyd's triples war-risk premiums [corroborated]
  The Hormuz closure entered its second full day with no signal of Iranian withdrawal. Lloyd's of London has tripled additional war-risk premiums on Gulf routing, which effectively prices most non-sovereign commercial traffic off the route. The US 5th Fleet has activated International Maritime Security Construct convoy-escort protocols for flag vessels. EU NAVFOR issued parallel guidance telling European-flagged tankers to hold position outside the Strait pending clearance. European energy traders and port operators should treat Gulf supply disruption as structural for at least the next 72–96 hours. Contingency sourcing and contract force-majeure clauses are live questions this morning.
• Three EU states expel Iranian diplomats [corroborated]
  France, Germany and the Netherlands each summoned Iranian ambassadors on 14 July and expelled diplomatic personnel in coordinated responses to the Gulf strikes. Iran has pledged symmetrical expulsions. European organisations with Iranian-linked commercial relationships, personnel or supply chains should brief their security and legal teams on the escalation implications. Those include potential informal retaliatory targeting of European business interests in third countries where Iranian influence networks operate.
• Gulf extraction window assessment — European nationals
  As of 08:00 CET, Dubai International Airport and Doha's Hamad International remain operationally open but with elevated diversion risk. The UK FCDO and Dutch Ministry of Foreign Affairs have updated travel advice to "do not travel" for Bahrain and Qatar. Kuwait remains at "reconsider travel." Organisations with non-essential staff in the GCC should make extraction decisions today rather than wait for airspace closure. Ground corridors via Saudi Arabia to Jordan remain viable but will close if the conflict expands westward. Relevant capability: hostile-environment safety planning and close protection deployment.

NATO & Allied Sphere

• Ankara summit closes: Russia formally designated principal adversary [corroborated]
  The NATO Ankara summit closed on 14 July with the Alliance's strongest collective language in 75 years. The revised Strategic Concept annex designates Russia as NATO's "principal and most direct adversary", replacing the previous "most significant and direct threat" formulation. The designation has practical consequences for procurement and contracting. Enhanced vetting requirements for suppliers working near Allied infrastructure will accelerate under the revised framework. Organisations previously assessed under the older standard should expect re-vetting requests from governmental clients.
• Netherlands confirmed as lead nation for Northern European CBRN cluster [corroborated]
  The Allied Preparedness Initiative announced at Ankara confirmed the Netherlands as lead nation for the Northern European CBRN rapid-response cluster. The role covers coordinated detection and response capability across the Netherlands, Belgium, Denmark and Norway. The designation formalises a significant procurement and training mandate for Dutch-based CBRN specialists over the 2026–2030 planning horizon. For private-sector CBRN training providers meeting NL governmental standards, it represents a multi-year demand signal. Mission Support's four-level CBRN curriculum is positioned to support both the governmental lead-nation mandate and the corporate clients whose supply chains sit inside the protected perimeter.
• Baltic SIGINT surge — Russian EW exercises coincide with Ankara
  Russian armed forces conducted coordinated electronic warfare exercises in Baltic airspace on 13–14 July. They generated GPS degradation across Finnish, Estonian and Latvian airspace and disrupted commercial aviation routing through Helsinki and Tallinn. Because the timing coincided precisely with the Ankara summit, the activity is assessed as deliberate signalling rather than a routine exercise. NATO Air Command activated enhanced surveillance protocols. Organisations operating in the Baltic states should validate non-GPS backup modes for their GPS-dependent logistics and communications systems, and document them as standard operating procedure rather than contingency.

Critical Infrastructure & Cyber

• NCSC-NL urgent advisory: Sandworm probing Dutch water-management SCADA [corroborated]
  NCSC-NL published an urgent advisory at 06:30 CET. It confirms that the same Sandworm-linked tooling identified in Tuesday's AIVD–BfV energy-grid advisory has been detected probing SCADA interfaces at Dutch regional waterboards (waterschappen). The campaign includes targeted spear-phishing against OT engineers, scanning of HMI login interfaces and attempted lateral movement from IT to OT network segments. Russian critical-infrastructure reconnaissance has now extended from energy to water, two of the four sectors most likely to be targeted in a pre-kinetic campaign. Organisations with OT environments in either sector should treat this as a live intrusion campaign, not a theoretical risk. The immediate actions are to segment IT–OT boundaries, enforce MFA on all HMI access and review SCADA remote-access policies. Mission Support's cybersecurity advisory practice covers OT/ICS environments.
• IP camera exploitation: scale assessment updated
  Today's NCSC-NL advisory follows the AIVD disclosure on 14 July. It estimates that approximately 340,000 internet-connected cameras in the Netherlands are potentially accessible to Russian state actors using publicly documented exploitation methods. That figure is significantly higher than initial assessments. The exploitable population includes consumer-grade doorbells, commercial CCTV systems and industrial monitoring cameras. Any organisation with networked cameras overlooking sensitive infrastructure, logistics operations or personnel movement should audit its network-accessible devices immediately, as baseline security work rather than a future project. TSCM sweep protocols now include networked-device assessment as standard.

Request a Tailored Threat Briefing

Mission Support prepares operator-grade threat assessments for governmental, diplomatic and Tier-1 corporate clients working across high-risk environments. Relevant capabilities: Hostile-Environment Safety Planning, Secure Communications, TSCM, and CBRN Training.