Executive summary
Ethiopia is not a single risk environment. Addis Ababa functions as a low-to-moderate risk capital with a serviceable duty-of-care baseline, while Amhara, western and southern Oromia and parts of Tigray present active conflict conditions with limited state control outside major towns.
The dominant exposure for international organisations is movement, not premises. Road travel between regional capitals crosses zones where armed group activity, drone strikes, checkpoints and abduction for ransom coexist on the same corridor.
Programme risk is concentrated in access negotiation and communications: internet and mobile shutdowns are used as a routine instrument during operations, and organisations that have not planned for silence lose situational awareness before they lose access.
Sources · [7] GDELT Project · [10] UKMTO
Full report
Threat environment by region
Amhara: insurgent activity is dispersed and locally led, with regular clashes on the Bahir Dar, Gondar and Dessie corridors, periodic drone employment by federal forces, and administrative control that flips between state and armed group presence within the same district over weeks.
Oromia: the operating problem is predictable in type and unpredictable in location, road ambush, abduction of staff and contractors, attacks on transport and utility infrastructure, and extortion at informal checkpoints. Western Wollega, Guji and Borena require corridor-specific assessment rather than a regional rule.
Tigray: hostilities have ceased but the political settlement has not consolidated. Movement is largely feasible with clearances; the risk is a rapid change in posture rather than day-to-day threat.
Somali and Afar regions: cross-border dynamics, clan competition over grazing and water, and drought-driven displacement produce localised violence that rarely targets internationals but readily traps them.
Sources · [6] NASA FIRMS / Copernicus · [9] INGO ADVISORY analyst desk
Duty of care implications
Treat inter-regional road movement as an authorised operation with named approval, current corridor intelligence dated within seventy-two hours, defined communications checks and a written abort trigger. Where an assessment is older than that, the movement is unassessed, not low risk.
Air movement between Addis Ababa and regional capitals materially reduces exposure and should be the default for staff transfers wherever a scheduled service exists and the marginal cost is defensible.
Plan explicitly for communications loss. Satellite messengers with tested check-in protocols, offline copies of contact trees and pre-agreed rally points convert a shutdown from a crisis into an inconvenience.
Access and acceptance
Acceptance in Ethiopia is negotiated with multiple authorities in parallel, federal, regional, zonal and, in contested areas, whichever armed formation holds the ground. Organisations should record who granted access, on what basis, and when that understanding was last re-confirmed.
Bureaucratic access constraints are as consequential as armed threat. Permit cycles, movement notifications and partner registration requirements can suspend delivery without a single security event occurring.
Sources · [7] GDELT Project · [10] UKMTO
Economic and political stress indicators
Monitor fuel and staple pricing in Addis Ababa and regional capitals, parallel-market currency spreads, public sector salary arrears and any move to compress subsidies. These have preceded urban protest activity more reliably than political announcements.
Election-cycle preparation, constitutional debate on regional boundaries and any federal move against a regional administration should each be treated as a trigger for reviewing contingency plans rather than as background noise.
Sources · [7] GDELT Project · [10] UKMTO
Indicators and warnings
Escalation: reimposition of a state of emergency; sustained drone employment near populated centres on main corridors; mass detention of regional officials; nationwide rather than localised communications shutdown; convergence of Amhara and Oromia armed activity on the same supply routes.
De-escalation: credible national dialogue with participation from armed formations; sustained reopening of the Bahir Dar and Gondar corridors to commercial traffic; verified demobilisation payments; return of banking and telecommunications services to conflict-affected woredas.
Sources · [2] UCDP · [5] FEWS NET
Outlook to 2027
Most likely (assessed likely): protracted low-intensity insurgency in Amhara and Oromia alongside a functioning capital, with international operations viable under disciplined movement control and realistic access assumptions.
Alternative (assessed unlikely, high impact): renewed conflict involving Tigray, or a federal–regional rupture that closes multiple corridors simultaneously. Hold a trigger-based contingency plan with pre-identified relocation routes and a funded evacuation option rather than a generic annex.
Sources · [6] NASA FIRMS / Copernicus · [9] INGO ADVISORY analyst desk
Key findings
- Fano-aligned formations in Amhara remain fragmented and locally commanded, which makes negotiated access unreliable, an agreement in one woreda does not travel to the next.
- The Oromo Liberation Army retains capability for road ambush, abduction and infrastructure attack across western and southern Oromia, with kidnap-for-ransom now a routine funding mechanism rather than an exception.
- The Tigray settlement remains unconsolidated; intra-Tigrayan political competition and unresolved Western Tigray claims are the two indicators most likely to precede renewed conflict.
- Telecommunications and internet shutdowns should be assumed as a standing feature of any security operation, not treated as an anomaly.
- Macroeconomic stress, currency reform effects, fuel pricing and import constraints, is now a measurable driver of urban unrest risk in a way it was not two years ago.
Analyst assessment
We assess with high confidence that regionalised conflict in Amhara and Oromia will persist through 2027, and that neither theatre will produce a decisive military outcome in that period.
We assess with moderate confidence that Addis Ababa will remain operationally viable for international organisations, with disruption arriving through movement restrictions, communications outage and periodic security operations rather than direct threat to premises.
The single most likely serious incident affecting an international organisation is a road ambush or abduction on an inter-regional route travelled without current, corridor-specific clearance.
Related reports
Footnotes & sources
- [1] ACLED — Armed Conflict Location & Event Data — Africa event recordsL1 Conflict · reliability A
- [2] UCDP — Uppsala Conflict Data Program — organised violence datasetL1 Conflict · reliability A
- [3] UN OCHA / ReliefWeb — Situation reports, access snapshots and humanitarian updatesL2 Early warning · reliability A
- [4] GDACS — Global Disaster Alert and Coordination System alertsL2 Early warning · reliability B
- [5] FEWS NET — Food security outlooks and alertsL2 Early warning · reliability A
- [6] NASA FIRMS / Copernicus — Active fire detections and open satellite imagery for corroborationL3 GEOINT · reliability B
- [7] GDELT Project — Global media event and tone monitoringL5 Strategic · reliability C
- [8] Institute for Security Studies (ISS Africa) — Regional political and security analysisL5 Strategic · reliability B
- [9] INGO ADVISORY analyst desk — Practitioner interviews, field reporting and imagery verificationL6 Verification · reliability B
- [10] UKMTO — Maritime incident advisories — Gulf of Aden and Red Sea approachesL2 Early warning · reliability A
- [11] IOM DTM — Displacement Tracking Matrix — movement and displacement flowsL2 Early warning · reliability A
- [12] INSO — NGO safety incident reporting and access advisoriesL1 Conflict · reliability A
- [13] OpenSanctions — Sanctions, PEP and enforcement screening dataL5 Strategic · reliability A
Supporting capability statement
Horn of Africa security capability pack
Download the experience summary, applied risk frameworks and sample operational brief supporting this country threat assessment.
Free operational toolkit
Act on this assessment
Six free operational tools for NGO and charity teams — no sign-up, nothing leaves your browser.
- Travel risk authorisationRisk-tiered approval form with control verification before movement is signed off.
- Vehicle & convoy check13-point pre-departure inspection with go / no-go clearance logic.
- Safeguarding / PSEA referralAnonymised referral log for PSEA and misconduct concerns.
- Cyber hygiene assessmentScored self-assessment producing a prioritised remediation workplan.
- Staff accountability roll callReal-time headcount and status tracking during an incident.
- Endurance calculatorContingency stock planning for water, food, fuel and cash.