Mogadishu is workable. Organisations deliver programmes and run commercial operations in the city every day. What separates those who sustain it from those who suffer an avoidable incident is not appetite, it is the quality of the movement, site and decision architecture underneath the work.
What happened
The city's security pattern over 2026 has held a recognisable shape: complex attacks and VBIEDs against government, security and hotel targets; grenade and IED incidents at lower intensity across districts; criminal robbery and armed carjacking away from the secured corridors; and periodic security force operations that close routes without notice.
What is changing
Two changes matter operationally. Attack timing is being set against movement peaks and fixed queues rather than against building profiles alone, which shifts exposure from the compound to the journey. And the practical footprint of the secured area has become narrower than many organisations' internal maps assume, protection has concentrated, and the gradient between protected and unprotected ground is now steeper over a shorter distance.
Why it matters
Most incidents involving international and national staff in Mogadishu are not the result of targeting. They are the result of pattern: the same vehicle, the same route, the same hotel, the same 08:30 departure. Predictability is the vulnerability that a hostile actor needs and the one an organisation controls entirely.
Assessment by threat
- Terrorism, SEVERE. An attack is likely. Complex attack and VBIED capability is retained inside the city.
- Armed conflict, SUBSTANTIAL in and around the city periphery; higher on routes into central regions.
- Crime and armed robbery, SUBSTANTIAL, concentrated away from secured corridors and after dark.
- Kidnap for ransom, SUBSTANTIAL for identifiable international staff, higher outside the city.
- Civil unrest, MODERATE, rising around political milestones and security-force pay disputes.
- Infrastructure and utilities, SUBSTANTIAL: power, water and connectivity failures are routine planning factors.
Where the exposure sits
The airport approach and the KM4 to Halane axis carry the highest concentration of both movement and attack history. Hotel entrances used for external meetings are a recurring target set. Fixed queues at any hardened entrance are the single most consistent point of exposure. Outside the secured corridors, criminal risk rises quickly and after dark movement should be treated as an exception requiring authorisation.
What organisations should watch
- Any change in checkpoint locations or the security force posture on the airport corridor.
- Attack interval and target set, whether commercial and NGO-adjacent premises are appearing in the pattern.
- Security force pay and command disputes, which precede both unrest and checkpoint extortion.
- Political milestones on the electoral timetable, and the two weeks either side of each.
- Accommodation and venue security standards, reassess rather than inherit a previous assessment.
What organisations should do
- Run journey management for every road movement, with written abort criteria and no-move conditions.
- Break pattern deliberately, vary route, timing, vehicle and meeting venue.
- Never queue at a hardened entrance; arrive off-peak or wait off-site.
- Set and enforce a movement curfew, with named authorisation for exceptions.
- Hold communications redundancy, two independent means, tested weekly, plus a satellite fallback.
- Maintain a current risk register with owners and review dates, and exercise the crisis plan at least twice a year.
- Brief every arrival before their first movement, not after it.