Somalia remains a country where competent organisations operate successfully and unprepared ones fail quickly. The security environment is layered rather than uniformly severe, and the difference between the two outcomes is almost entirely a function of ground truth and movement discipline.
Threat picture
- Al-Shabaab complex attacks against hotels, government compounds and locations frequented by internationals in Mogadishu.
- VBIED and PBIED activity on the airport corridor and main approach routes.
- Targeted assassination of officials, contractors and journalists — the group's preferred instrument over mass-casualty operations.
- Extortion and informal taxation of commerce and transport, which reaches most supply chains transiting the south-central regions.
- Islamic State Somalia in the Puntland highlands, and renewed piracy incidents in the Somali basin approaches.
Political and stabilisation risk
Federal–member-state relations, particularly with Puntland and Jubaland, remain the principal political risk. Constitutional review, the electoral model and revenue sharing are all unresolved, and each dispute consumes attention that the counter-insurgency campaign needs. Transition of security responsibility from the AU mission continues to leave uneven coverage in recovered districts.
In Somalia, political risk and security risk run on the same clock.
Operating implications
- Refresh country risk assessments against the current mission footprint rather than legacy AMISOM-era assumptions.
- Apply strict journey management on the airport corridor and treat inter-city road movement as exceptional.
- Assume infiltration risk in hiring pipelines and screen accordingly, without collective suspicion of local staff.
- Audit supply-chain payments for informal taxation exposure — it is a compliance issue as well as an operational one.
- Rehearse complex attack and hostage scenarios with the roster that would actually take the call.
The country rewards organisations that combine disciplined security management with genuine local access, and it punishes those that substitute one for the other.