Three years after the attack of October 7, 2023, Israel made a series of changes to the work of its intelligence agencies, which included rearranging some priorities, and modifications in information collection and analysis, training, and coordination between the agencies. These measures came in the wake of internal investigations that addressed the shortcomings that preceded the attack, while assessing the size and effectiveness of these changes requires distinguishing between what was announced by Israeli institutions and what can be verified in practice.
The latest announced trends appeared on Sunday, the eve of the third anniversary of the attack, when the Israeli army presented to its senior officers what it described as “lessons learned from October 7th.” According to The Times of Israel, the directions included preparing for the possibility of a surprise attack on more than one front, taking the adversary’s capabilities into account as well as assessing his intentions, as well as updating threat scenarios every six months. On the intelligence side, the army reaffirmed the priority of warning within the tasks of the Military Intelligence Directorate “Aman”.
Where did Israeli intelligence fail?
These changes came after investigations over the past two years painted a more detailed picture of the reasons for the failure. According to a report published by “The Times of Israel” in 2025, based on AMAN’s investigations, the directorate identified three main aspects of the defect: a miscalculation of Hamas’ strategy, plans, and capabilities, and the failure to issue a warning of an imminent attack during the days preceding it, in addition to a deficiency in collecting information about the movement’s intentions and plans. These results indicate that the problem was not only related to the amount of information available, but also to the way it was read and converted into an estimate of the threat level.
A review conducted by a team of experts appointed by Chief of Staff Eyal Zamir reinforced this conclusion. After reviewing 25 investigations and interviewing about 80 officials, the team said that a variety of important information was available on the night of the attack, and if it had been analyzed differently, it could have led to raising the alert level. He also pointed to problems in the organizational culture and the way Hamas understood and dealt with a plan that Israeli intelligence codenamed “Jericho Wall.” It was a document obtained by Israel more than a year before the attack and included a vision for a large-scale attack across the Gaza border, many elements of which appeared later in the “October 7” attack.
Alarming is at the core of Aman’s work.
One of the most obvious changes announced concerns the status of warnings within Aman. In September 2025, Zamir said during a visit to Unit 9900 that the directorate was going through a process of change based on the lessons of “October 7,” placing warning at the heart of its mission. According to the army, the reorganization of priorities had already begun during the previous two years.
But the change that becomes more apparent in 2026 relates to how we think about surprise itself. The lessons presented by the army on October 4 call for preparing for a surprise attack even if deterrence and warning fail, and for looking at what the opponent can do and not just what intelligence believes he wants to do. This transformation targets one of the problems that appeared before October 7, when the belief that Hamas did not want a large-scale war contributed to the interpretation of field indicators within this perception.
Back to human and open sources
The review also included information collection tools. The Israeli Institute for National Security Studies (INSS), in its analysis of the failure, indicated a heavy reliance on intercepting communications and technical capabilities, in contrast to the relative weakness of some human and open sources, that is, publicly available information, such as the media, social networks, publications, and public statements.
In this context, interest has returned to the “Hatsav” unit of the Military Intelligence Directorate “Aman”, which specializes in collecting information from open sources, and whose work historically included following Arab media outlets, then expanded to include social media networks. The unit was closed in 2021, before Aman began the process of re-establishing it in a new format in March 2023, about seven months before the October 7 attack. When the attack occurred, the process of restructuring the unit was still underway, before its activity expanded during the war, according to a report by the Israeli newspaper “Jerusalem Post”.
In human intelligence, Unit 504 of AMAN expanded its activity related to Gaza. The Jerusalem Post quotes military sources as saying that the unit was less active in the Gaza Strip during the years preceding the attack, while the Israeli General Security Service (Shin Bet) was responsible for a large part of collecting human information there. After October 7, Unit 504 strengthened its deployment and resources allocated to this file.
Changes within the Shin Bet and coordination with Aman
In turn, the Shin Bet announced changes in the way the Gaza file was managed after its internal investigation. According to the Jerusalem Post, the agency divided information collection operations in the Strip into smaller geographical areas, closer to the model it uses in the West Bank. It also modified cooperation mechanisms with Unit 8200 of the Military Intelligence Directorate “Aman”, which specializes in intercepting communications and collecting information via electronic means and analyzing it, with the aim of increasing the exchange of information.
However, it is difficult to judge the impact of these changes so far. The newspaper indicates that the Shin Bet and Unit 8200 were exchanging information on a large scale before “October 7” as well. Therefore, increased coordination between them does not necessarily mean that the problem was in the volume of information exchanged, as investigations showed that part of the failure was also linked to how the information was read and its implications were estimated.
Reviewing working and thinking methods
Among the announced changes is also a review of some aspects of the organizational culture within intelligence. In December 2025, Chief of Staff Eyal Zamir said, during the annual conference of the AMAN Research Department, that the ongoing changes include intelligence culture, work approach, dialogue between the ranks, and training. He called for enhancing critical thinking and a diversity of opinions within the directorate, and for allowing intelligence officers the opportunity to challenge prevailing professional assumptions.
Intelligence changes under testing
The announced changes affect multiple aspects of Israeli intelligence work, but determining the impact of each of them remains difficult in light of the limited information available about the work of the agencies and the results of the actions they have taken.
A study published by the Counterterrorism Center at the US Military Academy, West Point, warns against reducing the failure of “October 7” to a single cause, and points to the intersection of strategic assumptions, cognitive biases, and problems of collecting and analyzing information. Also, some of the information related to the failure is still not publicly available, which limits any final assessment.
Three years after the October 7 attack, the reviews conducted by Israel show changes in several aspects of intelligence work. From early warning and information gathering, to coordination between devices, analysis methods, and training. These changes come within the framework of a review of the shortcomings revealed by investigations into the attack. But it is still early to judge its results, and its effectiveness will become clearer when facing new threats and crises, and testing the devices’ ability to monitor them, analyze information about them, and warn about them in a timely manner.
