European policy appears to focus on securing a role for Europe in maintaining the peace after a peace agreement is signed, including support freedom of navigation in the region. [1]

In parallel, Reza Pahlavi, son of Iran’s former shah and a prominent opposition figure residing in the United States, addressed the Swedish Parliament on 13 April following invitations from the Christian Democrats and the Sweden Democrats. [2] The visit was not an official government invitation, but it still signals that Iran has the potential to become a domestic issue in Sweden, which has a large Iranian diaspora.

Even if Europe is not part of the conflict, it may still become a battleground as Iran targets Jewish, but also US organizations in Europe. Since the start of the war, several attacks have taken place in Europe against locations linked to U.S., Israeli, or Jewish interests.

Documented incidents include:

• 8 March: An improvised explosive device detonated near the U.S. Embassy in Oslo.
• 9 March: An explosion at a synagogue in Liège.
• 13 March: Arson attack against a synagogue in Rotterdam.
• 14 March: A bombing at a Jewish school in Amsterdam.
• Late March: Authorities disrupted a planned attack against a Bank of America site in Paris. The investigation showed that minors had been recruited online and promised payments of EUR 500 to 1,000, indicating the use of low-skilled, financially motivated proxies.
• 23 March: An arson attack in London destroyed four ambulances belonging to a Jewish medical charity service near the Golders Green synagogue. [3]

The war also indirectly affects European security through the strain on U.S. military stockpiles. The scale of U.S. munitions usage has reduced available volumes for export, contributing to delays and uncertainty in deliveries to European partners. [6]

Assessment

If European governments become more involved in the conflict or openly support the political opposition to Iran it will likely make Iran view those European countries as legitimate targets for pressure and retaliation. This does not necessarily imply direct state-on-state escalation. The pattern observed so far points toward actions designed to impose political and psychological costs while staying below the threshold of open conflict. This includes attacks carried out through proxies, low-cost sabotage, and limited cyber activity against symbolic or high-visibility targets.

It is also clear that regardless of what role European governments play in the conflict, Iran regards all Israeli, American and Jewish organizations in Europe, as legitimate targets for sabotage and possibly even assassination. The use of digitally recruited intermediaries and financially motivated actors lowers the barrier to conducting attacks and makes detection more difficult. This increases the importance of baseline physical security, staff awareness, and coordination with local authorities, for all organizations linked to Israeli, American or Jewish interests.

In the cyber domain, Iranian actors have demonstrated intent but remain constrained in capability. Their operations to date show limited sophistication and an opportunistic approach to target selection. Ongoing U.S. and Israeli kinetic and cyber pressure, combined with internet restrictions inside Iran, is likely degrading their ability to operate at scale. Under these conditions, rapid reconstitution of advanced cyber operations is less likely. That said, disruptive activity and influence-oriented operations should be expected to continue.

Taken together, Truesec Threat Intelligence assesses that the conflict is likely to affect the European security environment over the short, medium, and long term. The most probable impacts for most clients are not large-scale attacks, but an elevated background level of threat, increased use of proxies, and greater uncertainty in both the physical and cyber domains. Organizations should plan for a more persistent and complex risk landscape rather than a temporary spike tied to individual events.

If these challenges concern you or your organization, Truesec can support you with practical, experience-based guidance. Our specialists work closely with executive leadership and security teams across Europe and
understand the operational realities you face. If you would like to discuss your situation or consider next steps, please reach out to your contact.
References

[1] https://www.bbc.com/news/articles/c5yjz819vmgo
[2] https://www.lemonde.fr/en/international/article/2026/04/14/reza-pahlavi-s-controversial-visit-to-sweden-s-parliament_6752387_4.html
[3] https://thesoufancenter.org/intelbrief-2026-april-17/
[4] https://cyberscoop.com/iranian-hackers-cyberattacks-us-energy-water-infrastructure-plc-scada-warning/
[5] https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a
[6] https://www.iss.europa.eu/publications/commentary/assessing-damage-what-iran-war-really-means-europes-defence