Iran Conflict: Week Three and Still No Off-Ramp

Welcome to your Tuesday briefing.

Three weeks ago, Operation Epic Fury killed Ayatollah Khamenei and triggered the Gulf retaliation that hit Dubai. We covered that last week. This week we are watching for what comes next.

The Strait of Hormuz is still closed. Twenty-one million barrels of oil per day normally move through that waterway. That flow stopped on March 10 and has not resumed. Spain just refused to let US military aircraft cross its airspace on the way to the Middle East. The American embassy in Tokyo got breached by pro-Iran demonstrators. And the United States quietly issued a sanctions waiver allowing Russian and Iranian oil back into global markets because the energy crisis became severe enough to override every other consideration.

The Strait of Hormuz has been closed for three weeks. The initial response focused on rerouting shipping around Africa, but the logistics could not catch up to the economic reality fast enough.

On March 23, the US Treasury issued General License U. The license temporarily allows the sale and delivery of Iranian and Russian crude oil that was stranded at sea when the conflict started. Over three million tonnes of Russian fuel oil are now heading to Southeast Asia and China as buyers scramble for alternative supply.

This is what happens when keeping fuel flowing becomes more important than maintaining sanctions. The US spent years building those restrictions. It waived them in less than three weeks because energy prices were spiking and the political cost of doing nothing outweighed the diplomatic cost of letting Russian and Iranian oil back into the market.

For compliance teams, General License U creates problems. The waiver is narrow and temporary. It covers specific cargo that was already at sea before March 10. If your supply chain accidentally sources oil that does not meet those exact terms, you are engaging in sanctioned transactions. Once the immediate crisis passes, those violations will be prosecuted.

Energy prices have spiked globally. Transportation costs are up. For operations that depend on cheap, reliable energy, the financial hit compounds the security risk.

Energy infrastructure is now being treated as a legitimate military target by all sides. Pipelines, power grids, fuel depots. For businesses and operations that depend on stable power or fuel supply, your dependence is now a vulnerability waiting to be exploited.

Security directors managing industrial sites, logistics hubs, or data centers with heavy power requirements need to plan for infrastructure being targeted, not just failing by accident. Physical protection for fuel storage, backup generator security, and contingency plans for prolonged grid outages are no longer theoretical exercises.

Spain closed its airspace to US military aircraft on March 28. No American planes heading to the Middle East can fly through Spanish territory. This is the first time a NATO ally has denied the US military air access during an active operation.

Spain cited opposition to the Iran conflict and concern about being pulled into a wider war. The decision follows weeks of tension within NATO over the Strait of Hormuz closure and whether collective defense obligations apply when one member starts a unilateral military action.

US military logistics are now routing through longer flight paths, adding hours to transit times and straining operational capacity. But the bigger issue is not the logistics. The bigger issue is what Spain's decision means.

Other European nations have quietly reduced intelligence sharing and logistical support tied to the Iran operation. Spain's airspace closure is just the most visible example. The assumption that NATO allies will coordinate during regional conflicts, share intelligence, and provide backup when needed is outdated.

For corporate security planning crisis extraction or relying on allied military support during instability, this matters. Do not assume NATO infrastructure will be available when you need it.

The Strait of Hormuz closure forced the US to waive sanctions it spent years building. That tells you how seriously governments take energy security. When the choice is between maintaining diplomatic pressure and keeping the lights on, energy wins every time.

For corporate security, that means two things. First, energy infrastructure is fair game now. If your facilities depend on uninterrupted power or fuel, you need security plans that account for someone deliberately targeting that supply. Second, navigating sanctions just became far more complex. Temporary waivers like General License U create legal traps. Get the details wrong and you will face penalties once the crisis ends and enforcement resumes.

Two decades of expert insights you can trust.

🇲🇲 MYANMAR — Senior General Min Aung Hlaing stepped down as armed forces chief after five years of military rule. The resignation is a calculated move to transition into a civilian presidential role. Myanmar remains deeply unstable, with ongoing armed resistance and widespread human rights violations. The political transition creates additional unpredictability in an already volatile environment.

🇻🇪 VENEZUELA — Following the US military intervention that removed Nicolás Maduro in January, the country remains volatile. The State Department maintains a Level 4 Do Not Travel advisory. Armed cartels have consolidated control over infrastructure and border regions. The risk of express kidnapping and targeting of US-affiliated individuals has increased since the intervention.

🇯🇵 JAPAN — Pro-Iran demonstrators breached the outer perimeter of the US Embassy in Tokyo on March 26, injuring eleven police officers. The incident proves that American facilities in tier-one capitals are now vulnerable to proxy mobilization tied to regional conflicts. Security postures at US-branded corporate locations globally need to be elevated immediately.

🇾🇪 YEMEN — The UN Secretary-General condemned the detention of 118 UN staff members globally, with the vast majority held by Houthi authorities in Yemen. The unprecedented arrest wave represents the highest level of detention of humanitarian workers in UN history. Organizations deploying personnel to Yemen or similar environments need hostage incident management protocols and K&R insurance in place before deployment.

CONTENT MODERATION — The US Justice Department entered a consent decree permanently barring federal agencies, including CISA, from coercing social media companies to remove or suppress protected content. The decree stems from Missouri v. Biden and represents a significant constraint on how government agencies can engage with platforms on content policy. For corporate security teams using social media monitoring for protective intelligence, the practical effect is unclear. Platforms may reduce cooperation with government requests, which could affect the quality of threat intelligence flowing through official channels.

GLOBAL THREAT ADVISORY — The State Department issued a worldwide alert advising Americans to stay cautious. Groups supportive of Iran may target US interests anywhere following nearly 300 attacks on American facilities since late February. Security protocols need to be elevated globally, treating previously safe environments with higher caution.

Q: What has done the most to drive corporate investment in executive protection?

🟨🟨🟨🟨🟨⬜️ The Brian Thompson assassination specifically (36%)
🟩🟩🟩🟩🟩🟩 The broader rise in executive targeting and threats (42%)
🟨⬜️⬜️⬜️⬜️⬜️ Legal and liability pressure from boards and insurers (11%)
🟨⬜️⬜️⬜️⬜️⬜️ Something else driving it in your world? Let us know → (11%)

Your Comments:

JM: "Thompson made it visible, but the threat was already there. Boards just needed someone to die on camera before they'd fund what we've been asking for since 2019."

PG: "One exec gets hit and the corporate lawyers are all over it. Covering their backs to see if policies written 3 years ago were actually implemented."