Mapping India’s Internal Security Threat Landscape

Having settled the vocabulary, we now put the map on the table. This section answers four questions in sequence: what kinds of threat exist, why they arose here, where they are located on the ground, and how their character is changing. It closes with the numbers, because an internal security answer that carries no data reads as opinion, and an answer that carries stale data reads as carelessness.

A Typology of Threats

Threats can be classified by what they attack. This typology is more useful than a simple list of problems, because it tells you which instrument of the state is the appropriate respondent in each case — and examiners reward a candidate who classifies before he describes.

Type	What it attacks	Manifestations in India
Territorial	The physical integrity of the state and the uniformity of its writ over territory. The adversary seeks to detach, or to establish alternative authority within, a portion of the national space.	Secessionist insurgency in parts of the North‑East; militancy in Jammu and Kashmir; the erstwhile Maoist attempt to build a Compact Revolutionary Zone; contested and porous stretches of the land border.
Ideological	The legitimacy of the constitutional order itself. The adversary rejects not a particular government but the framework of the state.	Maoist doctrine of protracted people’s war; religious extremism and jihadist recruitment; ethno‑nationalist secessionism; violent separatist campaigns run from diaspora bases.
Economic	The fiscal and financial foundations of the state, and the integrity of its economic institutions.	Terror financing, hawala, money laundering, fake Indian currency notes (FICN), narco‑trafficking, extortion and levy collection, smuggling, and organised crime’s penetration of legitimate business.
Technological	The networked systems on which the state, the economy and society now depend — a domain in which strategic damage can be inflicted without crossing a border.	Cyber attacks on critical information infrastructure; ransomware against hospitals and utilities; drone‑borne delivery of arms and narcotics across the western frontier; encrypted and dark‑web communication by hostile networks.
Social	The cohesion of the plural society — the shared belief that makes a diverse population a single political community.	Communal violence; caste conflict; ethnic conflict and land‑identity disputes; mob violence; disinformation, deepfakes and algorithmically accelerated polarisation.

Two observations turn this table into an argument.

• First, the categories are not sealed: a terror strike is simultaneously territorial, ideological and economic in its logic, and increasingly technological in its execution.
• Second, the centre of gravity has migrated down the table.

In 1990 India’s gravest problems were territorial. In 2026 the territorial threats are at their lowest ebb since Independence, while the technological and social categories are expanding fastest — and these are precisely the two categories where the state’s traditional instrument, the armed policeman, is least effective.

Factors Responsible — Why Here, Why These

No society generates insurgency simply because it is poor, and no state escapes it simply because it is rich. The Indian pattern is produced by the interaction of the following factors, and the analytical skill being tested is your ability to show that interaction rather than to recite the list.

Social factors

• Communal divide — fragmentation along religious, ethnic or cultural lines, deliberately worked upon, converting difference into hostility and hostility into violence.
• Caste tension — conflict over reservation, dignity and unequal social status, which routinely escalates from an agitation into a public‑order emergency.
• Weak human capital — deficits in education and skilling that produce a large pool of unemployed young people, converting a demographic dividend into a demographic liability.
• Social media and information asymmetry — rumour and fabricated content spreading faster than verification or official correction can travel.

Economic factors

• Unemployment, particularly youth unemployment, which supplies the recruitment pool for stone‑pelting, riot mobilisation and armed cadre alike.
• Regional disparity — growth concentrated in particular corridors, generating a sense of exclusion in regions left outside them.
• Income inequality — a widening gap between rich and poor, with shrinking means for the poor to live with dignity.
• Poverty — which makes smuggling, extortion and paid participation in violence economically rational choices for those with no alternative.

Political factors

• Inter‑State disputes over boundaries and shared natural resources, particularly water, which strain the federal fabric and periodically turn violent.
• Separatist and secessionist tendencies exploiting genuine regional and ethnic grievance.
• Vote‑bank politics — the political mobilisation of ethnic, religious and sectarian identity, which institutionalises insecurity as an electoral resource.
• Administrative and governance failure in resolving long‑pending grievances, so that the absent or extractive state becomes the adversary’s best recruiting argument.
• A weak criminal justice system — delayed trials and poor investigation, which lower the expected cost of organised crime to near zero.
• Criminalisation of politics — the criminal–police–politician nexus, which converts law enforcement itself into a contested resource.

Geographical and historical factors

• Porous borders across difficult terrain — forest, riverine, desert, high‑altitude and maritime frontiers that cannot be sealed by fencing alone, enabling infiltration, smuggling and sanctuary across the line.
• Inaccessible interior terrain — dense forest and hill tracts where the state’s physical presence was historically thin, which is exactly where insurgency took root.
• Inherited fault lines — the violence of Partition and the birth of communalism as a permanent feature; the unresolved accession question in Jammu and Kashmir; the colonial administrative isolation of the North‑East; and the non‑implementation of constitutional protections for tribal areas.

Technological and external factors

• Technology diffusion — encrypted communication, commercially available drones, cryptocurrency and social platforms have collapsed the capability gap between a state and a small hostile network.
• Unfriendly neighbours — sustained external sponsorship of terrorist organisations as an instrument of state policy, the classic proxy strategy of bleeding an adversary by a thousand cuts.
• Sanctuary across borders — leadership, training camps and finance located beyond the reach of Indian jurisdiction.
• Diaspora and external funding networks, including the misuse of charitable and non‑governmental channels.

Environmental factors

• Climate stress — projected declines in rainfed crop yields, sea‑level rise, heat waves and landslides, which drive displacement, intensify competition over land and water, and add pressure to already strained receiving regions.

THE ANALYTICAL GROUPING THAT EARNS MARKS Do not present these as eleven unrelated causes. Group them, and the answer acquires a spine: Inherited at Independence — poverty, unemployment, inequitable growth, communal fault lines, unsettled borders. India did not create these; it failed to resolve them. Administrative failure — governance deficit, the absent state in remote areas, poor scheme implementation, corruption. Failure of political practice — the deliberate mobilisation of sectarian, ethnic and linguistic identity for electoral advantage. Governance deficit in the justice system — a criminal justice apparatus so slow that impunity becomes the norm, permitting the criminal–police–politician nexus to consolidate. Externally supplied — sponsorship, sanctuary, finance and weapons, which do not create grievance but weaponise it. The causal chain to state in one line: external actors cannot manufacture an insurgency: they can only arm one that domestic failure has already produced. That single sentence converts a list into an argument, and it is the analytical core of this section and of the argument on development and extremism.

The historical trajectory

The problems did not arrive together. Each decade after Independence added a distinct layer, and each layer persists in some form.

1947 Partition & communalism

→

1950s North‑East revolt

→

1967 Naxalbari

→

1980s Punjab

1990s J&K militancy

→

2000s hinterland terror

→

2010s cyber & radicalisation

→

2020s hybrid & drones

Read that sequence and the pattern is visible: the theatre keeps shifting from the periphery to the interior, and from physical space to information space. Territorial insurgency at the frontier gave way to terrorism in the hinterland, which is giving way to contestation in the cyber and cognitive domains. The state has become progressively better at the first and remains weakest at the last.

Theatres of Conflict

Six theatres organise the operational picture. Each has a distinct adversary, a distinct terrain logic and a distinct response template — which is why a single national counter‑insurgency doctrine has never fitted India.

Theatre	Nature of the challenge	Principal instrument	Status, 2026
Red Corridor	Ideological insurgency seeking capture of state power through protracted people’s war; forest terrain across the eastern tribal belt.	CRPF and CoBRA, State police and District Reserve Guard, Greyhounds; security‑plus‑development template.	Officially resolved. Declared free of LWE‑affected districts with effect from 31 March 2026.
North‑East	Ethno‑nationalist insurgency, statehood and autonomy demands, inter‑community conflict over land and identity; cross‑border sanctuary.	Assam Rifles and Army in aid of civil authority; peace accords and Suspension of Operations agreements; AFSPA rollback.	Sharply improved overall, but Manipur remains the outlier, accounting for the great majority of regional incidents.
Jammu & Kashmir	Externally sponsored terrorism; low‑signature hybrid militancy; over‑ground worker networks; infiltration across the Line of Control.	Army, CRPF, J&K Police; NIA for investigation; UAPA and the terror‑finance route.	Incident numbers at historic lows, but the theatre remains live and externally driven, as 2025 demonstrated.
Hinterland	Module‑based and lone‑actor terrorism in cities; radicalisation online rather than in camps; communal and mob violence.	State police and ATS units, IB, NIA; prosecution rather than area domination.	The displaced centre of gravity of terrorism — no territory to dominate, so intelligence is the only real defence.
Coastline & maritime	A long coastline with numerous landing points, fishing traffic that cannot be fully screened, offshore assets and island territories.	Indian Navy, Indian Coast Guard, marine police; layered coastal security grid built after 26/11.	Structurally strengthened, but marine police capacity and inter‑agency seams remain the acknowledged weak point.
Cyberspace	Attacks on critical information infrastructure, mass financial fraud, disinformation and cognitive operations; attribution is slow and often impossible.	CERT‑In, I4C, NCIIPC, State cyber cells; the IT Act and DPDP regime.	The fastest‑growing theatre, and the one where capability lags the threat by the widest margin.

The single most important structural observation for a Mains answer: India has been decisively winning in the theatres where the adversary must hold ground, and losing ground in the theatres where he need not. Forest insurgency and frontier militancy have been rolled back by area domination, force density and infrastructure. Cyber crime, disinformation and drone‑enabled smuggling present no ground to dominate — and it is exactly there that the numbers are rising.

The Changing Character of Conflict

The adversary has concluded that conventional confrontation with India does not pay. What follows is not peace but a displacement of competition into domains below the threshold of war.

Fourth‑ and fifth‑generation warfare

Fourth‑generation warfare describes conflict in which the battleground is civil society itself, and the objective is to recruit, subvert and demoralise the population rather than to defeat an army. The classical aim of conquering territory is replaced by the aim of controlling minds, pursued through psychological operations and perception management.

Fifth‑generation warfare extends this further into a contest fought almost entirely through information, narrative, and cognitive manipulation, in which the target population may not know a conflict is under way.

Hybrid warfare

Hybrid warfare combines conventional and unconventional instruments against the same adversary at the same time — economic pressure, cyber attack, support to local unrest, proxy militancy, lawfare and diplomacy, blended so that no single action justifies a conventional response.

Dimension	How it operates
Multiple attack vectors	Damage is inflicted simultaneously through economic restriction, cyber intrusion and support to non‑state actors, so that no single channel can be isolated and countered.
Difficulty of attribution	Cyber operations and lone‑actor attacks are hard to trace before execution and hard to attribute after it — preserving the sponsor’s deniability and the element of surprise.
Ambiguity and guerrilla logic	Deliberate ambiguity about who acted and whether an act constitutes aggression makes a proportionate response difficult to design and to justify internationally.
Exploitation of societal vulnerability	The attack is aimed at existing social fault lines — communal, caste, ethnic, regional — because these are cheaper to widen than to create.
Flexibility	The adversary shifts between vectors as each is countered, moving from cyber operations to support for local unrest to pressure on the frontier.
Psychological operations	Social platforms are used to turn a population against its own government, which is the cheapest and least attributable of all the instruments.

Grey‑zone operations

Grey‑zone operations occupy the space between peace and declared war: coercive activity calibrated to remain below the threshold that would trigger a military or legal response.

Salami‑slicing along a disputed frontier, drone incursions, sustained disinformation, economic coercion and the use of proxies all belong here. The strategic problem they pose is precise — each individual act is too small to justify escalation, but their cumulative effect is a significant loss of position.

A state organised to respond only to threshold events will therefore lose steadily without ever being attacked.

WHY THIS MATTERS FOR INSTITUTIONAL DESIGN Hybrid and grey‑zone competition is deliberately engineered to fall between the jurisdictions of existing agencies. A drone that carries narcotics across the western frontier is simultaneously a border‑guarding problem, a narcotics problem, a terror‑finance problem and an airspace‑regulation problem — and therefore, in practice, risks being nobody’s problem. This is the strongest available argument for the integration agenda: unified intelligence architecture, a stated national security strategy, and Centre–State mechanisms that can act faster than the adversary can shift vectors. Fragmented institutions are not merely inefficient against hybrid threats; they are the vulnerability the strategy is designed to exploit.

Trend Data

The figures below are the quantitative backbone of any answer in this chapter. Use two or three, not all of them, and always give the year.

CURRENT STATUS (AS OF JULY 2026) All figures below are current as of July 2026 and must be refreshed before the next examination cycle.

(a) Left‑Wing Extremism — the decisive reversal

Year	Incidents of violence	Deaths (civilians + security forces)	Affected districts
2010 (peak)	1,936	1,005	—
2014	1,091	310	126
2019	501	202	—
2024	374	150	38 (April 2024)
2025	234	100	11 (October 2025)
31 March 2026	—	—	Nil — declared free of LWE‑affected districts

• Measured from the 2010 peak, incidents fell by roughly 88 per cent and deaths by roughly 90 per cent by 2025.
• The district count fell in stages: 126 → 90 (April 2018) → 70 (July 2021) → 38 (April 2024) → 18 (March 2025) → 11 (October 2025) → nil (31 March 2026). A category of Legacy and Thrust districts was created in 2024 to continue support to districts no longer classified as affected, so as to consolidate gains and prevent relapse.
• In 2025 alone, 2,337 cadres surrendered; the top leadership of the organisation, including its General Secretary and several Politburo and Central Committee members, was neutralised or surrendered.
• The target of a Naxal‑free India by 31 March 2026, set in August 2024, was formally reported as achieved on schedule, under a framework organised around the three pillars of Vishwaas, Nirman and Jan Kalyan.

(b) North‑East

• Insurgency incidents in 2024 were about 64 per cent below the 2014 level; security‑force casualties fell by about 85 per cent and civilian deaths by about 86 per cent over the same period.
• Incidents fell further from 294 in 2024 to 151 in 2025.
• Manipur accounted for roughly 77 per cent of all violent incidents in the region in 2024 — the single most important qualification to the regional success story, and the point to make if you are asked whether the North‑East has been pacified.

(c) Jammu & Kashmir

• Terrorist incidents declined from 1,587 in 2004 to 85 in 2024.
• Terrorist‑initiated incidents fell from 228 in 2018 to 12 in 2025; civilian deaths from 55 to 28, and security‑force fatalities from 91 to 16, over the same period.
• The Pahalgam attack of 22 April 2025, in which 26 civilians were killed, demonstrates that a low incident count does not equal a low threat level: capability has been degraded, but intent and external sponsorship have not been. This is the essential caveat for any answer that quotes declining J&K figures.

(d) Cyberspace — the counter‑trend

• In 2024, the national cyber crime reporting portal received about 19.18 lakh complaints, with reported losses of about ₹22,811.95 crore.
• Through the citizen financial cyber fraud reporting and management system, more than ₹8,189 crore had been saved from fraudulent transactions up to 31 December 2025, across more than 23 lakh complaints — a measure of both the response capability built and the scale of the underlying problem.
• This is the only theatre in which the trend line rises. Quote it alongside the LWE figures and your answer makes the argument by itself: the threat has not disappeared, it has relocated.

Critical Assessment

What has genuinely worked. The record in the territorial theatres is not spin, and a candidate who refuses to acknowledge it is not being critical but merely contrarian. Sustained force density and area domination, fortified police stations and forward camps, road, telecom and banking penetration of previously inaccessible areas, generous and credible surrender and rehabilitation terms, systematic attack on financing networks through investigative agencies, and improved Centre–State operational coordination together produced the collapse of an insurgency that had lasted almost six decades. The LWE template — security creating the space for development, development sustaining the security gain — is India’s single most transferable internal security lesson.

What the numbers do not settle. Four cautions belong in any balanced answer:

• Elimination of an organisation is not resolution of a grievance. The structural conditions identified above — land alienation, displacement, tribal dispossession, governance deficit — are not addressed by the removal of armed cadre. Whether the peace holds depends on whether the Nirman and Jan Kalyan components continue once the security urgency has passed. Historically, they have not.
• Success is uneven. Manipur’s share of North‑East violence, and the Pahalgam attack in a year of record‑low incident counts, both demonstrate that aggregate improvement conceals live and dangerous exceptions.
• The threat has migrated, not vanished. Every point of decline in the territorial theatres coincides with a rise in cyber, financial and information‑domain harm. The state’s capability is strongest exactly where the threat is receding and weakest where it is growing.
• Measurement is contested. Incident and fatality counts are compiled by the agencies whose performance they measure. Different official sources give materially different figures for the same year, and the classification of a district as “affected” is an administrative decision, not an objective fact. Use the numbers, but attribute them, and do not build an argument that only one figure can support.

SECTION TAKEAWAY India’s threat landscape in 2026 is defined by a single dominant fact and a single dominant caveat. The fact: the territorial insurgencies that shaped Indian internal security for six decades have been decisively rolled back, with Left‑Wing Extremism formally ended on 31 March 2026 and North‑East and J&K violence at historic lows. The caveat: the threat has relocated rather than disappeared — into cyberspace, into the financial system, into the information domain, and into hybrid and grey‑zone competition engineered to fall between the state’s institutional seams. The next decade’s internal security will be decided less by force density in the forest than by analytical capacity, institutional integration and social cohesion.