For much of the period following the Pahalgam attack, the most striking feature of Kashmir's security landscape was the relative absence of major attacks.

That did not mean the threat had gone away. The Valley remained heavily guarded, intelligence operations continued and security agencies maintained a close watch over areas that had, at different points, been active theatres of militancy. But there was a noticeable difference between the Kashmir of recent years and the Kashmir of the past: violence had become less frequent, less organised and, in most places, far removed from the routines of ordinary life.

The attacks in Anantnag and Kulgam have disturbed that picture.

On July 22, Head Constable Ashiq Hussain Qureshi of the Jammu and Kashmir Police was killed in Anantnag while deployed for security arrangements connected with the Amarnath Yatra. Nine days later, two migrant workers from Chhattisgarh were attacked at a brick kiln in Kulgam. One of them died at the site and the other later succumbed to his injuries.

Neither incident, taken by itself, is evidence of a revival of the insurgency that once consumed large parts of the Valley. But together they are a reminder that the problem has not disappeared; it has changed shape. The distinction is important.

Kashmir today has a far denser security network than it did during the worst years of militancy. There are more layers of surveillance, better communications, stronger intelligence capabilities and a much greater ability to respond quickly when something goes wrong. The political and economic environment has changed as well.

However, none of these measures makes a determined attacker incapable of finding a gap. That may be the most useful way of looking at the latest incidents.

A different kind of vulnerability

The old image of militancy in Kashmir was built around numbers and territory: armed groups moving in large numbers, attacks on security installations, prolonged encounters and areas where the writ of the state was visibly contested. That is not the picture today. A small group, or even a single individual, can remain hidden for a considerable period and require very little infrastructure to carry out an attack. The objective need not be to hold ground or engage security forces in a prolonged confrontation. It may simply be to identify a vulnerable target, strike quickly and disappear. This is considerably harder to prevent.

A security force can dominate a road, guard a sensitive installation or conduct searches across an area. It cannot, however, know in advance which individual may have decided to attack a policeman, where that person will appear or what information he may have gathered before doing so. The killing in Anantnag illustrates that difficulty.

The policeman was on duty in an area where security arrangements had already been strengthened because of the Amarnath pilgrimage. The attack therefore does not necessarily point to a failure of the entire security apparatus. What it does show is that even a substantial security presence cannot close every small opening available to someone working clandestinely.

That is the nature of the problem now facing Kashmir. It is less about controlling territory than about denying an attacker the opportunity to exploit a moment.

The response after Anantnag

The response after an attack also exposes one of the less discussed difficulties of Kashmir's counter-insurgency apparatus. The Jammu and Kashmir Police remains a crucial part of the security grid and, after every militant incident, is under considerable pressure to produce a lead quickly. Its investigators and intelligence personnel work to reconstruct the attack, identify the perpetrators and trace the local network that may have provided them with shelter, movement, communications or other assistance. But the police do not always have the technological resources, intelligence depth or surveillance capabilities available to larger central agencies. In that environment, the first response can sometimes become necessarily broad. People with earlier police records, previous cases or known associations may be called in for questioning or subjected to renewed scrutiny, particularly when investigators are working against time and with incomplete information.

Some of these measures may yield useful leads; others can become deeply contested, especially when a person's past record is treated as an indication of present involvement without sufficient evidence. The difficulty is compounded by the fact that a section of Kashmir's population already lives with a heightened sense of vulnerability and suspicion. A large crackdown may therefore serve an immediate investigative purpose while simultaneously producing another, less visible cost: resentment, insecurity and a further weakening of the trust that the police need if they are to obtain reliable information from the community. The challenge for the security establishment is consequently not simply to act quickly after an attack, but to become increasingly precise in whom it investigates, why it investigates them and how it distinguishes an actual support network from people whose connection to militancy belongs only to their past. It is  where counter-insurgency becomes complicated. The security agencies need information quickly. The danger is that, in the immediate aftermath of an attack, the distinction between an actual support network and the wider population can become blurred. That distinction has long-term consequences.

Kashmir's security apparatus ultimately depends upon information from the people among whom it operates. If residents believe that providing information will bring them greater security, cooperation becomes possible. If they believe that security measures are likely to bring indiscriminate suspicion, cooperation becomes much more difficult. The challenge, therefore, is not simply to be tough. It is to be accurate.

Why Kulgam matters more than it may first appear

The Kulgam attack raises a somewhat different concern. The victims were migrant workers, part of a population that has become an increasingly visible component of Kashmir's economy. Workers from outside Jammu and Kashmir are employed in construction, agriculture, brick kilns, hospitality and numerous other sectors. They are also among the more exposed sections of the population.

Many live at their workplaces or in temporary accommodation. Their movements are often determined by employment rather than by security considerations. They may have little knowledge of local geography and few links to the communities in which they work. An attack against such workers therefore creates a particular kind of uncertainty.

The immediate victims are obvious, but the consequences can travel much further. Workers may leave. Others may hesitate before coming to Kashmir. Contractors may become more cautious. Families elsewhere may begin to view Kashmir as a less secure place for their relatives to work. There is an economic dimension to this that should not be overlooked.

Kashmir's return to a more active tourist and service economy has depended not only on visitors but also on the movement of labour. Construction projects, hotels, restaurants, farms and small businesses all require workers. A militant group does not need to stop the economy. Creating enough fear to slow it down can be sufficient.

This appears to be one reason the authorities have moved to review security arrangements around migrant workers following the Kulgam incident, including greater surveillance, patrolling and consideration of safer accommodation arrangements.

There is, however, an uncomfortable irony here. The more heavily a section of the workforce has to be protected,  the wider perception of vulnerability can grow. The objective of security should eventually be to make such extraordinary arrangements unnecessary.

South Kashmir's old geography

There is also a geographical reason why the two incidents deserve attention.

Anantnag and Kulgam sit within a part of South Kashmir that has historically been important to militant organizations. The region contains a mixture of densely populated settlements, agricultural areas, transport routes and access towards forested and mountainous terrain. None of this means that South Kashmir is once again becoming a militant stronghold. It would be a mistake to make that leap.

But geography does not stop mattering simply because the nature of militancy changes. An area with a history of militant activity may retain old networks, social connections and knowledge of the terrain long after the larger organizations that once operated there have been weakened.

This is one reason security agencies tend to respond particularly quickly to signs of renewed activity in the south. The concern is not that one attack automatically leads to another. It is that an isolated attack may provide an opportunity for a dormant network to test itself. Can it obtain weapons? Can it move people without detection? Can it find local assistance? Can it identify another target? Can it carry out a second operation before the security forces understand the structure behind the first? The answers to those questions will tell us considerably more about the state of militancy than the casualty figures from any single incident.

From insurgency to disruption

The character of the threat has changed sufficiently that the word "insurgency" itself can sometimes be misleading. An insurgency suggests organization, recruitment, territorial influence and a sustained attempt to challenge the state. The more plausible danger in Kashmir today may be something smaller: a network that survives by remaining difficult to see and seeks to create disruption whenever an opportunity presents itself. That strategy does not require hundreds of armed men. It requires patience. A policeman killed in a market sends one message. A migrant worker attacked at a workplace sends another. An incident around a pilgrimage route affects the confidence of visitors. An attack involving tourists can have consequences far beyond the immediate location. The physical damage may therefore be limited while the psychological and economic effect is much greater. This is particularly relevant in Kashmir because the perception of safety has itself become economically valuable.

The Valley's tourism revival has been one of the clearest symbols of the return of normal life. Hotels, transport operators, guides, shopkeepers, houseboat owners and thousands of other people have a direct interest in maintaining that perception. An attack does not have to shut down tourism completely to cause damage. It only has to make people hesitate. So the terrorism has transitioned from “Insurgency” to “Disruption”.

The intelligence problem

Much of the discussion after an attack tends to focus on the security forces seen on the ground: checkpoints, cordons, searches and additional deployments. Those measures are necessary, but they are not where the most decisive part of the battle is fought. The crucial information is usually obtained before the gun is fired. Who has entered the area? Who has been in contact with whom? Who has suddenly changed his movements? Who has access to weapons? Who knows the routine of the intended target? Who is providing accommodation or transport? And perhaps most importantly, who is willing to speak to the authorities before something happens?

Technology has transformed surveillance in Kashmir, but technology cannot replace local knowledge. Cameras can record movement. Digital systems can identify patterns. Drones can watch difficult terrain. None of them can fully substitute for a resident who notices something unusual and trusts the system enough to report it.

This is why public confidence should be regarded as part of the security infrastructure, rather than as a separate political concern.

How far can the response go?

The difficult balance is visible in the aftermath of the recent attacks. There is an understandable demand for a strong response whenever a policeman or civilian is killed. The public expects the perpetrators to be found and the networks behind them dismantled. At the same time, security operations that are too broad or insufficiently discriminating can create a different problem.

After the Anantnag killing, the authorities intensified searches and reportedly demolished the homes of two suspected militants. Such measures are defended by the security establishment as part of deterrence and counter-terrorism. Critics see them as collective punishment. There is a wider issue beneath that argument.

The success of counter-insurgency cannot be measured solely by the number of suspects detained or properties destroyed. It must also be judged by whether the wider population remains willing to cooperate with the state. A resident who trusts the police may pass on information. A resident who fears the police may remain silent. That difference can determine whether the next attack is prevented.

What should we watch now?

It is tempting to ask whether another attack is likely. That is not a question anyone can answer responsibly. A more useful exercise is to watch for changes in the pattern. If attacks remain isolated and security agencies succeed in identifying the people and support structures involved, the recent incidents may prove to have been contained episodes. If attacks begin appearing at shorter intervals, the assessment would have to change.

Geographical spread would be another warning sign. A cluster of incidents in South Kashmir would be serious; simultaneous activity across several districts would suggest something more organized. The choice of targets would matter too. The more consequential question is what the attackers might try to do next if they have succeeded in demonstrating that they can still operate inside a heavily secured environment. One possibility, and one that security agencies would have to take seriously, is an attempt to move beyond relatively soft or isolated targets and strike something whose significance extends well beyond the immediate casualties.

That could take several forms. An attack on an important security installation would obviously carry a different message from the killing of an isolated policeman. An attempt to disrupt a major infrastructure project, a strategic road or transport link, a power installation or another high-visibility development project could have consequences that reach into the political and economic narrative surrounding Jammu and Kashmir. A successful attack on a prominent project would not merely cause physical damage; it could be intended to question the state's ability to secure the infrastructure on which its larger development and integration narrative rests.

The geography of such an attempt is also difficult to predict. It need not necessarily remain confined to South Kashmir. The attackers could look towards the north, central Kashmir or areas south of the Pir Panjal, depending on where they perceive an opportunity. Moving outside the traditional areas of concentration would itself serve a purpose: it would compel the security establishment to stretch its resources across a much wider geography and create the impression that there is no clearly defined safe zone.

There is, however, an important distinction between a plausible threat and a forecast. There is no basis at present to say that a particular project or location will be targeted. What can be assessed is the logic behind target selection. If a small militant network wants to compensate for its limited manpower, it will look for targets capable of producing an effect much larger than the attack itself. The target's symbolic value may therefore become as important as its tactical value.

An attack on migrant workers would generate fear among a vulnerable workforce. An attack on tourists or pilgrims could immediately affect perceptions of Kashmir's safety and carry an economic cost. An attack on security personnel would demonstrate that the security grid can still be penetrated. But an attack on a strategically important installation or a high-profile development project could potentially combine all three effects with something more: a political message.

That is where the security assessment becomes more serious. The question would no longer be simply whether militants can still kill. It would be whether they retain the organizational ability to select, plan and execute an operation designed to produce consequences beyond the immediate site of the attack.

If such an attack were to occur, its implications could extend beyond Jammu and Kashmir. Depending on the target and circumstances, it could influence the political debate in New Delhi, affect investor and public confidence, disrupt a major development Programme and, in certain circumstances, acquire a diplomatic dimension as well. An incident involving a strategically sensitive project or location could quickly become part of the larger India-Pakistan narrative, particularly if there were evidence pointing towards cross-border direction or support.

This is why the next phase deserves close attention. Isolated attacks can be the work of a small surviving network. A complex attack against a strategically valuable target requires something more: reconnaissance, logistics, intelligence about the target, coordination and the ability to move people and material without detection. If militants demonstrate that capability, the assessment of the security situation would have to change significantly.

For now, it would be premature to assume that such an operation is imminent. But it would also be unwise for the security establishment to measure the threat only by the scale of the attacks that have already taken place. A weakened network does not necessarily remain a predictable network. Sometimes the most revealing indication of its remaining capability is not how often it strikes, but the kind of target it chooses when it decides that the time is right. Recruitment would be perhaps the most important indicator of all. A militant network that can replace its losses is a different proposition from one surviving on a shrinking number of operatives. So is a network that can establish new local support. The coming months should therefore be judged less by the rhetoric surrounding individual incidents and more by whether militants are able to establish a pattern.

Security and politics cannot be separated

There is also a political context to all this. Kashmir is not dealing with security questions in isolation. Discussions over statehood, representative government, economic development and the relationship between Srinagar and New Delhi continue alongside them. Every fresh attack changes the political atmosphere, even if only temporarily.

Security once again becomes the dominant subject. The administration is pushed towards a harder response. Political parties are forced to take positions. Ordinary residents who had begun thinking about employment, tourism or education are reminded that the possibility of violence has not completely disappeared. That is one of the reasons small attacks can have an influence well beyond their immediate scale. Militant groups may no longer have the capacity to dictate the political agenda in Kashmir, but they can still interrupt it. Preventing that interruption is therefore not only a matter of policing. It is part of preserving the space in which political and economic normalization can continue.

The test of normalcy

There is perhaps too much emphasis on the word "normalcy" in discussions about Kashmir. Normalcy is often treated as though it were a condition that, once achieved, cannot be lost. In reality, it is more fragile. A reasonable expectation is that the risk is low and that the state can respond when something goes wrong. That expectation is what recent attacks have tested. The answer will not come from another press conference or another deployment alone. It will come from what happens afterwards.

If the networks responsible are dismantled, if no sustained series of attacks follows, if migrant workers continue to come and work, if pilgrims continue to travel and if tourists continue to regard Kashmir as a place they can visit without unusual fear, then the basic security environment will have held. If attacks begin to multiply, the calculation changes.

The calm, for now

There is no compelling evidence at present to suggest that Kashmir has returned to the insurgency of an earlier era. The scale, organization and reach of militancy today are fundamentally different. But the opposite conclusion would be equally complacent.

The Anantnag and Kulgam incidents show that even a weakened militant ecosystem can retain the ability to exploit moments of vulnerability. The challenge for the security establishment is to ensure that those moments do not become opportunities for rebuilding. That requires more than numbers. It requires intelligence good enough to find a network before it acts; policing capable of working with local communities; security arrangements that protect vulnerable workers and visitors without making ordinary life feel permanently militarized; and a response that is firm without becoming indiscriminate.

does Pakistan currently have the political, economic and strategic space to raise the level of its engagement in Kashmir?

There is, finally, a question that lies beyond the immediate security picture in the Valley: does Pakistan currently have the political, economic and strategic space to raise the level of its engagement in Kashmir? Pakistan's own economic difficulties, political uncertainties and security pressures have imposed constraints on the state in recent years. At the same time, the relationship between its civilian and military establishments, its internal political calculations and the wider regional environment remain important variables. Whether these circumstances limit Islamabad's ability to support or facilitate a renewed escalation across the Line of Control or whether, at some point, developments within Pakistan create an incentive to raise the temperature in Kashmir remains to be seen. For India, that uncertainty is itself a reason not to treat the present lull as a permanent settlement of the security problem.

For now, the evidence points towards a militant threat that is smaller, more fragmented and less capable than it was in the past, but still capable of producing disproportionate consequences. The immediate task is to prevent isolated successes from becoming a pattern. Whether the threat remains contained, or acquires a new degree of organization and external support, will depend not only on what happens inside Kashmir but also on how the wider India-Pakistan strategic environment evolves.