MAX Intelligence: Colombia’s Hardline Security Shift & Operational Risks

Executive Summary

• Recent security operations targeting armed groups confirm newly inaugurated President Abelardo de la Espriella’s (ADLE) intent on following through with campaign promises on the adoption of hardline security measures and revocation of previous dialogue platforms.

• This suggests heightened security saturation across rural areas and major metropolitan centers to tackle sustained trafficking and gang-related violence. Additionally, foreign policy will revert to traditional alignment with the USA, while also expanding multilateral security cooperations.

• Over the coming months, the security environment will likely be volatile amid anticipated rise in retaliatory and symbolic violence. There is a credible risk for commercial entities to be targeted by armed actors to extort revenue to finance operational costs, while exercising territorial control to undermine state security to investments in targeted regions.

• Travel to Colombia can continue while avoiding nonessential travel to remote and rural regions marked by a limited state security presence due to ongoing security operations and retaliatory violence by armed groups.

Introduction

Since his inauguration on August 7, President Abelardo de la Espriella (ADLE) of the Defensores de la Patria (Defenders of the Homeland, in Spanish) has enacted facets of his vowed crackdown targeting narcotics trafficking organizations and armed groups. This includes the enforcement of an aggressive “Mano Dura” (iron fist, in Spanish) platform, that includes rollbacks of former President Gustavo Petro’s Paz Total (Total Peace, in Spanish) framework, and which helped ADLE secure the presidency, enabling the ongoing security pivot.

During Petro’s administration, Colombia’s armed groups experienced a sustained expansion, with total active personnel surging from 13,000 in 2022 to approximately 27,000 by the end of 2025, highlighting a surge of over 107 percent. This growth was driven primarily by the narco-paramilitary Ejercito Gaitanista de Colombia (EGC, formerly Clan del Golfo), which emerged from far-right Autodefensas Unidas de Colombia (AUC) paramilitary’s demobilization between 2003-06. Parallelly, left-wing insurgencies of the Ejercito de Liberacion Nacional (ELN), and dissident factions of the Fuerzas Armadas Revolucionarias de Colombia (FARC), including the Estado Mayor Central (EMC-FARC) and the Estado Mayor de Bloques y Frentes (EMBF-FARC) outfits, have continued their offensive against the state during negotiation periods.

This proliferation of armed groups is widely attributed to the unintended consequences of Petro’s Paz Total, where bilateral ceasefires and a de-prioritization of offensive military actions gave armed groups the operational environment to support expanded recruitment and consolidation of territorial influence as well as illegal narcotics trafficking and other criminal activities to fund operations. To counteract this expansion, ADLE has anchored his security platform on aggressively restoring state territorial control, disrupting criminal supply lines and communications, and unleashing the country’s experienced security forces through sweeping offensive campaigns.

Reactivation of combined warfare tactics to escalate threat environment across rural conflict zones

Since his assumption of office on August 7, ADLE has prioritized early, publicized results of security operations cracking down on armed groups, involving the use of combined strike capabilities to reinforce his platform’s hardline ‘anti-narcoterrorism’ approach. However, hardline measures are expected to heighten risks of retaliatory violence and escalation in threats nationwide.

FORECAST: Over the coming months, ADLE is anticipated to continue prioritizing high-value targeting and aggressive military offensives in rural conflict zones. On the ground, ADLE intends to orchestrate heavily bolstered, highly coordinated offensive campaigns designed to dismantle armed groups, including senior leadership and operational substructures. This will be aided by aggressive troop saturation and clear-and-hold operations executed across high-risk rural municipalities, particularly in the Catatumbo region of Norte de Santander, the San Juan and Atrato river basins of Choco, the Piedemonte llanero region of Arauca, and the Canon de Micay region of Cauca and Valle del Cauca. Rather than engaging solely in passive territorial presence, the armed forces are expected to be deployed in operations directly targeting the senior leadership and command fronts of fractured FARC dissidents, the ELN, and the EGC, prioritizing high-value capture and combat targets to neutralize command structures.

Moreover, troop saturations will enable broader disruptive operations targeting the financial and logistical drivers of armed groups in impacted regions by systematically destroying narcotics production and processing sites, illegal gold mining infrastructure, and dispersed clandestine weapons caches supporting armed groups. Further, security forces are also likely to intensify focus on riverine security, particularly in departments such as Cauca and Choco. Here, armed groups rely on river systems to transport contraband material from the coca-rich interior to Pacific Coastline-based maritime trafficking nodes connecting to international markets.

Meanwhile, recent security operations have indicated that aerial operations will serve as a key force multiplier in the new administration’s tech-driven counternarcotics strategy, leveraging surveillance, close air support, and air-assault insertions to target armed groups. The use of electro-optical surveillance technologies over densely forested regions where armed groups operate is expected to support precision airstrikes against isolated insurgent encampments and key logistics nodes, reversing previous restrictions on aerial bombardment in zones confirmed to be clear of non-combatants under Petro. Building on ADLE’s proposal, the Air Force is also anticipated to reactivate illicit crop fumigation campaigns across Colombia’s dense coca-growing hubs. Seeking to bypass previous legal bans on aerial glyphosate spraying, the administration has proposed employing specialized fleets of heavy-payload UAVs, low-altitude crop dusters, and bioherbicides or targeted chemical formulations designed to satisfy environmental restrictions. Such campaigns complement on-the-ground operations targeting the armed groups’ illegal economic drivers, thus supporting broader security efforts.

Security cooperation with US to increase, with particular focus on counternarcotics operations

The conservative ADLE administration is anticipated to trigger a major diplomatic realignment, particularly with the US. ADLE has asserted that under Petro, Colombia’s foreign policy had become driven by ideology at the expense of national interests, adding that his administration will transform the Foreign Ministry into an institution focused on commercial diplomacy, technological cooperation and international competitiveness, while rebuilding confidence among investors and traditional allies. Specifically, such realignment will seek to reinstate the traditional Respice Polum (Look North, in Spanish) doctrine that aligned Colombian foreign policy with the USA throughout the 20th and early 21st centuries.

This is evidenced in Colombia’s entry as the 19th member-state of the US-led Americas Counter-Cartel Coalition (A3C, Shield of the Americas) on August 12, authorizing joint Colombian-US military operations against drug cartels and “terrorist” networks, following its entry into the coalition. This aligns with ADLE’s stated intentions, along with his ideological alignment with US President Donald Trump. This elevates Colombia from a regional partner to a primary operational anchor for the US Southern Command (SOUTHCOM) in South America. This enables US forces to further implement potentially coordinated strikes targeting land-based targets, as part of “Operation Southern Spear,” which so far has primarily sought to dismantle maritime trafficking corridors in the Caribbean and eastern Pacific since mid-2025. Such developments come as US Secretary of War Pete Hegseth recently expressed Washington’s rising interest in extending that campaign against land-based targets and pursuing agreements authorizing US ground forces to operate on the ground in allied nations.

FORECAST: In this context, the plausibility of a surge in Colombian-US military-to-military cooperation beyond the intelligence realm cannot be completely ruled out. However, the likelihood of direct US involvement in military actions against suspected narco sites in Colombia remains limited. Amid the lack of precedent of this in the current counternarcotics campaign, this is largely given the significant political and legal constraints in authorizing direct foreign actions, alongside the immense risk of domestic political pushback such developments would carry, furthering anti-US rhetoric. Instead, such cooperation is expected to potentially include US UAV platform integration over Colombian airspace and embedded joint task forces targeting transnational criminal organizations. With this, the US designation of the ECG as a Foreign Terrorist Organization in December 2025 shifts the focus toward criminal narco-trafficking rather than left-wing insurgencies like the ELN and FARC dissidents. This reclassification expands the operational authority for both militaries in future counternarcotics operations, including potential US-involved airstrikes or air-assault raids against high-level command nodes. With this, increased kinetic engagements in rural, heavily contested territories will also heighten the risk of localized humanitarian fallout, including civilian collateral damage, forced displacements, and forced confinements.

Armed groups’ retaliation to heighten nationwide threat of asymmetric violence, including that specifically targeting businesses

Under a hardline defense strategy, these armed groups are expected to adapt their operational posture to asymmetric conflict and inflict maximum friction against security campaigns. FORECAST: Such retaliation is largely expected to materialize as the use of non-conventional weaponry, such as commercial UAVs modified to drop explosives, IEDs and VBIEDs, and antipersonnel landmine fields designed to restrict ground movement and ambush patrols. Moreover, armed groups are expected to continue employing conventional tactics involving hit-and-run attacks, sniper fire against police and military facilities and coordinated sabotage of critical infrastructure, such as oil pipelines, electrical grids, and telecommunication towers, leveraging non-conventional weaponry, such as weaponized commercial UAVs and IEDs.

These armed groups are also expected to intensify their adoption of “armed strikes” (paros armados), enforcing strict curfews through intimidation, forcibly confining rural communities, and utilizing locals as human shields to hinder military operations and trigger humanitarian crises that complicate state counter-insurgency efforts. These groups maintain embedded intelligence networks and leverage locals being coerced into impeding troop movements, often triggering civil unrest potentially involving the abduction of troops, referred to as “asados”. Ground security operations will face severe friction given the armed groups’ known engagement in installing landmines in the vicinity of their encampments and the complexities of traversing Colombia’s Amazonian and Andean topography.

Given ADLE’s far-right political leanings, left-wing groups including FARC and ELN can be expected to heighten their rhetoric concerning collusion between state security forces and right-leaning narco-paramilitaries such as the EGC. Moreover, ADLE’s vowed revival of relations with Israel and intensified cooperation with the USA may trigger further rhetoric calling for left-wing violence against the government. This was noted in the calls for a regional alliance and summit of insurgent groups to oppose alleged US imperialism in Latin America by EMC-FARC leader alias “Ivan Mordisco,” following US military operations against Venezuela in early January. Although the operational follow-through on these declarations remained largely absent, such rhetoric continues to present a rallying mechanism, rather than outlining an immediate escalation in on-ground conflict. Framing state policy under ADLE as an extension of foreign US hegemony enables fragmented insurgencies to project a unified anti-imperialist front, temporarily setting aside localized competition and in-fighting in favor of shared political legitimacy. Such signaling seeks to rebrand attacks on infrastructure, foreign targets, and security forces as acts of regional defense. However, such signaling is unlikely to drive a unified offensive by left-wing Guevarist armed groups in Colombia against the government. That said, the persistence of this narrative ensures that anti-US and anti-government sentiments remain a credible catalyst driving an elevated risk of isolated, low-intensity attacks to demonstrate ideological commitment.

Over the coming months, there is likely to be elevated supply chain friction and direct security threats to personnel. Such risks are likely to manifest as extortionate violence targeting businesses, including kidnappings-for-ransom, or targeted killings to enforce the payment of floor charges. Moreover, rural supply routes, riverine transit corridors, and critical infrastructure projects face persistent risk of disruption and temporary blockades due to retaliation against state offensives. Such targeting of private and commercial entities exists, primarily, to secure revenue streams that finance their operational costs. Beyond monetary drivers, targeting high-profile commercial assets and critical infrastructure allows these groups to project power, exert territorial dominance, and demonstrate the inability of the state to guarantee security to business investment in targeted regions. This is evidenced in the recurrent attacks on infrastructure operated by the state-owned energy firm Ecopetrol, and its midstream infrastructure subsidiary, Cenit, including against the Cano Limon-Covenas and Bicentenario pipelines in Arauca and Norte de Santander, respectively. Further, the ELN’s Frente de Guerra Occidental has also previously declared Tiendas D1, a major supermarket network, a “military objective” across Choco and Risaralda departments, citing the company consistently refused to pay “war tax.” This direct threat forced severe operational challenges and logistical suspensions across western Colombia, with the ELN also having torched company vehicles and supply infrastructure supporting the retail of consumer goods.

Moreover, any US-involved military operations will heighten the rhetorical threat of anti-US and anti-imperialist narratives pushed by Colombia’s left-wing insurgencies. Associated risks may potentially materialize as targeted, symbolic violence involving the use of low-yield explosives or incendiaries against US interests in Colombia, including US government-linked facilities such as the US Embassy in Bogota and the Consular Agency in Barranquilla. Having said that, the elevated security monitoring and presence at such facilities limits the risks of such plots materializing. Such armed groups may also resort to targeted violence against comparatively more accessible private facilities owned or operated by US- and Israel-based companies, to symbolize their animosity towards ADLE and US interests. This is particularly given the comparably lower security measures deployed at such locations, including both state and private options. Consequently, such companies are expected to witness a major shift in operational risk profiles, wherein soft targets like commercial and industrial facilities, associated supply chains and critical infrastructure will emerge as primary vectors for low-intensity asymmetric violence. Such violence, including in rural and peri-urban locations, may manifest as arson, vandalism, extortionate threats, and sporadic low-yield IED attacks to signal political resistance rather than trigger casualties. Having said that, the ADLE government’s promised introduction of specialized security blocs, particularly in urban locations, is anticipated to mitigate major disruptions posed, specifically, by such threat actors.

Resurrection of security blocs to record intensified security operations, saturated police presence, across urban centers

Within Colombia’s urban centers, reports have attributed failures of the Paz Total negotiations with major armed groups as having triggered an expanded presence of affiliated proxies inside major cities, establishing sophisticated violent franchises to control profitable urban trafficking networks and illicit financial streams. The Ministerio de Defensa reported a 3.4 percent increase in intentional homicides between January and October 2025 (11,327 cases) compared to the same period in 2024 (10,952 cases). Additionally, kidnappings-for-ransom registered its highest figure in a decade, with 477 cases in all of 2025, compared with 209 in 2024. While the specialized anti-extortion task force, Grupos de Accion Unificada por la Libertad Personal (GAULA) succeeded in influencing a 12 percent decline in physical extortion by 12 percent in 2025, compared with 2024, authorities reported a transition in such crimes to the digital space, including extortion by calls, messages, and social media. Moreover, competition between micro-trafficking and urban street gangs has witnessed a simultaneous escalation in utilized tactics. This includes multiple grenade detonations recorded across central and western Bogota, primarily in the Bosa, Kennedy, and Santa Fe localities throughout 2024-25. That said, official data should be considered with caution given that it does not distinguish between criminal activity perpetrated by criminal gangs or armed groups, or between the threat landscape in rural and urban areas.

To this end, ADLE proposed the creation of “Bloques de Defensa para Seguridad Urbana” (BODSU, Defense Blocs for Urban Security). These units will reportedly be structurally designed to achieve deep institutional synergy, combining the tactical maneuverability of the National Police, military intelligence capabilities, and local municipal authorities to actively uproot criminal networks. As such, this security policy is expected to launch a saturated police presence and entail highly militarized tactics designed to dismantle organized criminal groups and micro-trafficking corridors across key metropolitan hubs, including Barranquilla, Bogota, Cali, and Medellin. FORECAST: While an aggressive state security campaign against urban crime may temporarily destabilize local criminal networks, it carries a high likelihood of triggering violent retaliatory actions by heavily armed urban cells, including those linked to armed groups. Suich actors are anticipated to counter state pressure through asymmetric tactics, including targeted assassinations of law enforcement personnel, localized grenade attacks on police stations, and the detonation of IEDs in high-density urban areas, including to enforce racketeering. Furthermore, saturated security presence in gang contested neighborhoods carries the potential to accelerate turf fragmentation, driving splinter groups to engage in retaliatory violence against municipal infrastructure, public transit nodes, and local commercial establishments to project strength and enforce territorial control. Consequently, urban environments face elevated risks of collateral damage, crossfire incidents, and sudden security disruptions as criminal groups adapt to state offensives.

Alongside this, ADLE’s implementation of Mano Dura in Colombia is also expected to entail the construction of high-capacity mega-prisons, mirroring El Salvador’s Centro de Confinamiento del Terrorismo (CECOT, Terrorism Confinement Center). Aided by separate inquiries seeking to dismantle and neutralize corruption among prison security staff, such initiatives likely seek to physically isolate incarcerated organized crime leadership from conducting criminal operations from within prisons, including the enforcement of extortion-related violence, contract killings (sicariato), and street-level drug distribution. This is underscored in ADLE’s ordered transfer of 117 high-profile inmates linked to peace negotiations to maximum-security prisons in different regions of the country, immediately following his inauguration, citing critical infrastructure failures impeding full penitentiary control, and preventing prisons from functioning as criminal command centers. Such orders likely triggered criminal retribution targeting prison security staff, as seen with the multiple targeted attacks against Instituto Nacional Penitenciario y Carcelario (INPEC, National Penitentiary and Prison Institution) personnel since August 6. This includes attacks by unidentified assailants near Palo Gordo prison in Giron, Santander department, on August 6, La Picota prison in Bogota on August 7, and La Paz prison in Itagui, Antioquia, on August 13. Such attacks exhibit criminal networks’ deliberate attempts to demoralize prison staff, weaken state resolve, and force concessions on inmate transfers.

FORECAST: The implementation of the BODSU introduces a major shift toward decentralized, high-intensity urban policing and inter-agency operations in major metropolitan areas. While such units are expected to entail multi-agency coordination, involving police, military personnel, and reserve formations, the current lack of clarity concerning command hierarchies between municipal authorities and national forces could potentially trigger delayed tactical responses during crises. Given the elevated threat of retaliatory violence by targeted outfits, coupled with the administration’s indicated interest, BODSUs are also expected to advance the formalization and expansion of security coordination with private security companies to fortify critical commercial, industrial, energy, and transit infrastructure, establishing a multi-layered shield intended to disrupt the flexibility of criminal groups. Such security operations are expected to manifest through specific high-visibility, shock-and-containment maneuvers, potentially involving militarized checkpoints at transit hubs, major commuter routes, and in the vicinity of marginalized communities marked by a higher vulnerability to street crime.

Additionally, in such neighborhoods, sudden, high-visibility security sweeps remain likely to be conducted during business hours or late nights to target racketeering and extortion in flagrante delicto, as well as raids targeting identified mid-to-high-level gang leaders and criminal safehouses, specifically targeting contraband trafficking. Consequent to high-density military and police saturation within inner cities and urban centers, organized criminal networks may potentially transfer operations to bases within peri-urban regions with a lower policing presence, including in suburban sectors and adjoining municipalities. In major border cities, such as Ipiales in Narino and Cucuta in Norte de Santander, such spillovers are likely to exacerbate illegal cross-border movement by armed and criminal actors with Ecuador and Venezuela, respectively.

Current limited state security capacities, capabilities, to limit crackdown effectiveness or influence significant gains

FORECAST: Colombia’s existing military, police, and financial structures present significant operational gaps, with ADLE’s militarization of public safety demands likely to severely strain the state’s actual logistics, personnel reserves, and defense budget. Deploying sustained, high-density saturation policing and militarized checkpoints across major metropolitan centers requires a volume of continuously deployed personnel that the current security apparatus is unlikely to be able to maintain indefinitely without slashing security coverage in rural and border regions, risking the effective suppression of armed groups.

Furthermore, the intense consumption of weapons, ammunition, surveillance technology, armored transport, and tactical gear for BODSUs presents a severe logistical hurdle, given that existing armories are already heavily allocated toward ongoing counter-insurgency operations against rural guerillas. While foreign defense assistance and security packages, such as proposed US financial aid, provide essential funding and technical assets to bridge capability gaps, the sheer material and human capital required to execute simultaneous urban shock-and-containment maneuvers while defending peri-urban and border frontiers creates a high probability of overextension, rendering the policy’s complete implementation logistically unsustainable over the long term without significant structural compromises.

Bolstered security operations involving mass arrests will likely strain local detention facilities, risking procedural delays and legal challenges over pre-trial detentions without scaled prosecutorial and prison capacity. Concurrently, high-density urban policing across major metropolitan centers will cause criminal networks to displace operations into suburban, peri-urban, and border regions, driving up localized extortion, cyber-racketeering, and retaliatory violence against state institutions. Although heightened urban security deployments may curb street crime locally, commercial and industrial enterprises will still face higher operating costs to fortify private security against digital extortion, even as security coordination with authorities increases.

Conclusion

The expansion of armed groups under the previous administration has set the stage for an aggressive security pivot under ADLE. The administration’s hardline Mano Dura doctrine, characterized by heavy military offensives, high-value targeting, alongside high-payload UAV fumigation in rural landscapes, and the anticipated deployment of specialized task forces in urban landscapes, will fundamentally reshape Colombia’s risk environment. In rural regions like Catatumbo, the Canon de Micay, the Amazon, and the Pacific River Basins, the revival of combined warfare tactics and targeted raids by security forces against the EGC, ELN, and FARC dissidents will trigger a sharp, increase in retaliatory violence involving the use of asymmetric tactics.

Specifically, such threat vectors remain liable to increase the occurrence of low-cost attacks involving weaponized UAVs, IEDs, VBIEDs, indiscriminate shootings, targeting government facilities and critical infrastructure. Additionally, such risks will parallelly increase for local and international businesses with a higher visibility, involving heightened extortion and abduction risks. At the same time, ADLE’s foreign policy realignment, marked by joining the US-led A3C and reviving ties with Washington and Tel Aviv, will intensify anti-imperialist rhetoric among left-wing insurgencies, elevating the risk of targeted symbolic attacks, low-yield explosives, or localized sabotage against US- and Israeli-affiliated commercial facilities, multinational corporate assets, and international supply chains nationwide.

Recommendations

1. Travel to Colombia can continue while maintaining heightened vigilance due to the risk of petty crime, particularly in tourist areas, and remain cognizant of the latent threat of criminals using dating apps to lure foreign nationals to then rob them, particularly in Bogota and Medellin.

2. Avoid all travel to Colombia’s border regions, particularly Norte de Santander, Narino, and Cauca, as well as to rural and semi-urban areas in departments such as Guaviare and Valle del Cauca, due to the entrenched presence of organized criminal and armed groups.

3. Maintain heightened vigilance in the vicinity of military and police establishments across the country, particularly in states with high levels of guerrilla violence, due to the elevated threat of attacks targeting those sites.