Years ago, at an arms fair outside Paris, a contractor screened a promotional reel for a roomful of buyers: a Patriot battery intercepting a drone in a clean fireball, a kill-probability figure flashing ninety-six percent on the slide behind him. Nobody in the room asked what happens on the fortieth wave. I have not stopped thinking about that reel this week, because the fortieth wave is more or less what a cluster of new analyses says arrived this year — and broke something.

In the space of a few days, a small library of post-mortems has landed on Iran's missile campaign, on the state of American munitions stocks, and on what cyber wargames actually prove. Read separately, they look like three unrelated stories: a Middle East security note, a Pentagon budget explainer, an academic essay on hacking. Read together, they describe one collapse.

My thesis: deterrence — missile defense, cyber retaliation, and old-fashioned conventional presence alike — is failing simultaneously not because any single weapon underperformed, but because the industrial and political machinery behind all of it has quietly eroded. The war with Iran did not expose a weapons gap. It exposed a base.

Wave forty

Iran's Operation True Promise-4, launched on 28 February 2026, fired ballistic missiles and drones in waves of over a hundred at a time, mixing cheap, decades-old liquid-fuel missiles with newer maneuverable Fatah and Fattah-1 variants that can jink at more than Mach 5 — a saturation tactic designed to burn through expensive interceptors on worthless decoys, according to an analysis in Middle East Monitor. Israel expended roughly 81 percent of its Arrow interceptor stock over the course of the campaign, the same report notes.

The United States fared little better on the ledger. Washington deployed more than a thousand Tomahawk cruise missiles and up to 2,000 advanced interceptors; 150 to 290 THAAD interceptors, at roughly $15.5 million apiece, were consumed — more than half the pre-war national inventory, drawn from a reserve of only 3,000 to 4,500 missiles that represented about a quarter of the entire US arsenal, per Middle East Monitor. The Pentagon's FY2027 budget now requests 785 additional Tomahawks — an admission, the piece argues, that the war was a structural vulnerability, not a temporary inconvenience.

  • THAAD stockpiles will not be restored to pre-war levels until late 2029, per Middle East Monitor
  • China's accelerating missile and area-denial buildup has pushed the Pentagon to reassess Taiwan contingency planning against the same depleted magazines
  • The lesson analysts draw is that deterrence now requires both magazine depth (raw numbers) and magazine breadth (a mix of cheap and exquisite systems) — not technological superiority alone

Why the shelves are bare

A separate CSIS analysis lays out why the American magazine was thin before Iran ever fired a missile. Post–Cold War planning shifted from preparing for a superpower rival to sizing forces for "two limited regional conflicts," a far smaller requirement than Moscow once demanded. The defense-industrial base consolidated to match: the number of major aerospace and defense prime contractors fell from 51 to 5, optimizing the sector for steady peacetime output rather than wartime surge, CSIS finds. Munitions also keep losing budget fights to aircraft carriers and fighter jets, which serve for decades and look like deterrence on a runway; interceptors, as the report puts it, "go into a bunker after production" and disappear from public view. CSIS's bluntest line: "the immediate problem is not money, but time" — current deliveries reflect funding decisions made two to four years ago, a lag no supplemental budget can shorten.

  • 600 Patriot interceptors sent to Ukraine since the war there began
  • 150 THAAD interceptors expended during what CSIS calls the Twelve Day War with Iran
  • 135-plus Tomahawks fired at Houthi targets in the Red Sea, per CSIS

The ledger cyber deterrence can't balance

If missiles fail loudly, cyber deterrence fails silently — which is its own problem. Wargame research on cyber deterrence notes that a successful deterrent leaves almost no trace: a network stays up, the power stays on, and no government ever announces it aborted an attack after receiving a warning, so incident databases record failures far more readily than successes, according to debuglies.com. Retaliation alone, the piece argues, is rarely enough; real deterrence is a portfolio of resilience, intelligence, exposure, sanctions, prosecution and — for the gravest attacks — credible cross-domain consequences.

Minnesota just supplied the test case. Malicious actors began targeting internet-exposed Rockwell Automation and Allen-Bradley programmable logic controllers at water utilities in at least seven states starting 27 July 2026; more than 30 community water systems in Minnesota alone were affected, including in South St. Paul, Braham and Plymouth, prompting a joint FBI, EPA and CISA advisory, per CBS News. Investigators have not definitively attributed the intrusion to Iran and are weighing whether the actors deliberately mimicked Iranian tradecraft to sow discord — but the political response is where deterrence actually broke down.

I don't think there was an Iranian cyberattack. I think that Minnesota ought to get its act together.

President Donald Trump, per CBS News

This is what modern warfare looks like, and it further illustrates there's no plan to win.

Minnesota Governor Tim Walz, per CBS News

Tehran's use for instability

None of this happens in a vacuum on the other side, either. A comprehensive peace deal, one analysis argues, would create "profound structural questions" for Iran's own regime — undermining the resistance doctrine embedded in the IRGC and Basij, the logic of proxy networks stretching through Iraq, Lebanon and Yemen, and a militarized posture built around threatening roughly one-fifth of global oil flows through the Strait of Hormuz, per Global Security Review. Controlled conflict, in this reading, is not a failure of Iranian strategy but a survival tool: it rallies domestic support, preserves bargaining leverage, and prevents a consolidated anti-Iranian coalition from forming — which is why negotiation and escalation run in parallel rather than in contradiction.

A separate Iranian-facing analysis makes the mirror-image argument from the inside: Tehran needs a "great jolt" — a fundamental reconstruction of an aging air force through fifth- and sixth-generation fighters, layered air defense and electronic warfare, alongside economic, social and diplomatic repair — to become genuinely "unassailable," rather than merely useful as a source of instability, according to Countercurrents. Strip away the different audiences, and Washington and Tehran are being told the same thing by their own analysts: your deterrent looks solid on the slide and hollow in the stockroom.

HYPOTHESIS: these four stories describe one failure mode in different uniforms — a credibility erosion running from the White House briefing room to the Pentagon's contractor rolls to Tehran's own force structure. Supporting this: the drop from 51 prime contractors to 5 was a political choice made over three decades of peacetime budgeting, not an accident; a president publicly waving away a plausible Iranian attack on US water utilities sends the same signal of low consequence that an empty THAAD magazine sends; and Iran's own commentators describe their military in the same structural language CSIS uses about America's. Against this: attribution for the water-system hack is formally unconfirmed, so reading it as proof of Iranian follow-through — rather than a copycat or false-flag operation — risks overreading a single unresolved case; and Iran's structural weaknesses are largely a product of sanctions and isolation, a different kind of erosion from a wealthy state simply choosing not to fund its own supply chain.

The case that this is a blip, not a collapse

The fair rebuttal is that militaries have run low on munitions before and rebuilt. The US restocked after the Gulf War, NATO restocked after Kosovo, and precision and alliance networks still give Western forces a qualitative edge no adversary matches system-for-system. Iran's proxy network, whatever its rhetorical value in Tehran, is materially degraded regardless of the regime's survival logic. On this reading, 2026 is a rough patch in a decades-long cycle, not evidence that deterrence itself has stopped working.

I don't think that reading survives contact with CSIS's own diagnosis. The constraint, in their words, is "not money, but time" — and time is exactly what a five-firm industrial base cannot manufacture on demand. A THAAD line that will not refill until late 2029 is not a blip; it is a multi-year window in which the same thin stockpile is supposed to cover a possible second round with Iran and a Taiwan contingency at once, while an administration that will not confirm who attacked Minnesota's water towers is simultaneously trying to signal resolve. That is the same arithmetic failing in two theaters and a third, quieter one, all at the same time.

I keep returning to that ninety-six-percent slide. The number was true, and it was also useless, because it described one intercept in isolation rather than a magazine built to survive a campaign. That is the mistake sitting underneath every story this week — mistaking a single successful intercept, a single inconclusive wargame, a single degraded proxy network, for a system that can hold under repetition. Deterrence was never supposed to be a demo reel.

What to watch next: whether Congress funds the Pentagon's FY2027 request for 785 additional Tomahawks in full; whether CISA or the FBI ever formally attributes the water-utility intrusions to Iran; how the THAAD replenishment timeline holds up against any flashpoint over Taiwan; and whether Tehran's internal reform rhetoric, per Countercurrents, produces any structural change before the next round of missile diplomacy.