Israel's intelligence community — Mossad, Shin Bet, and Aman — has been engaged in a shadow war against Iran's nuclear and missile programs for over two decades. Long before the first ballistic missiles were exchanged in 2025, these agencies conducted assassinations, cyber attacks, sabotage operations, and intelligence penetrations that shaped the trajectory of the conflict. Understanding how these three organizations work — separately and together — is essential to understanding Israel's approach to the Iran threat.
The Three Pillars of Israeli Intelligence
Israel's intelligence community is structured as a triad, with each agency holding distinct responsibilities:
- Mossad (HaMossad leModiʿin uleTafkidim Meyuḥadim) — The Institute for Intelligence and Special Operations. Responsible for foreign intelligence collection, covert action, and counterterrorism abroad. Directly subordinate to the Prime Minister. Approximately 7,000 personnel.
- Shin Bet (Sherut haBitaḥon haKlali / Shabak) — The General Security Service. Handles domestic counterintelligence, counterterrorism within Israel and the Palestinian territories, and VIP protection. Also subordinate to the Prime Minister. Approximately 5,000 personnel.
- Aman (Agaf HaModi'in) — The Military Intelligence Directorate. Provides the IDF with tactical and strategic intelligence, operates Israel's signals intelligence capability through Unit 8200, maintains the National Intelligence Estimate, and runs field intelligence collection (Unit 504). Subordinate to the IDF Chief of Staff.
The division of labor is clear on paper but blurs in practice. Mossad operates abroad, Shin Bet operates domestically, and Aman supports military operations — but the Iran target has required all three to work in unprecedented coordination.
Mossad: The Long Arm
Mossad's campaign against Iran's nuclear program is one of the most sustained covert operations in intelligence history. Publicly attributed operations include:
- Nuclear scientist assassinations (2010-2020) — At least five Iranian nuclear scientists were killed in targeted operations, most using motorcycle-borne magnetic bombs attached to their vehicles in Tehran traffic. The most prominent was Mohsen Fakhrizadeh, killed in November 2020 by what Iran described as a remote-controlled machine gun.
- Nuclear archive theft (2018) — Mossad agents extracted approximately 55,000 pages of documents and 183 CDs from a warehouse in the Shorabad district of Tehran, containing Iran's nuclear weapons research files (Project Amad). The material was publicly presented by Prime Minister Netanyahu and provided to the IAEA.
- Sabotage operations — Multiple incidents at Iranian nuclear and military facilities have been attributed to Mossad, including explosions at Natanz enrichment facility, fires at missile production plants, and the mysterious destruction of centrifuge manufacturing equipment.
These operations served dual purposes: directly degrading Iranian capabilities and demonstrating that Israel could reach deep inside Iran's most secured facilities — a psychological deterrent that forced Iran to divert enormous resources to internal security.
Unit 8200: The Digital Battlefield
Aman's Unit 8200 is Israel's signals intelligence and cyber warfare arm, widely considered one of the most capable cyber organizations in the world. With an estimated 5,000-10,000 personnel, it dwarfs most national SIGINT agencies relative to Israel's size.
Unit 8200's most famous operation is Stuxnet — the computer worm jointly developed with the US NSA that destroyed approximately 1,000 Iranian centrifuges at Natanz between 2009 and 2010. Stuxnet was the first known cyber weapon to cause physical destruction of industrial equipment and remains the benchmark for offensive cyber operations.
Beyond Stuxnet, Unit 8200 conducts continuous signals intelligence collection against Iranian military communications, monitors missile test telemetry, and maintains persistent access to Iranian networks. During the 2025 conflict, this capability provided real-time intelligence on missile launch preparations, enabling defensive measures and pre-emptive strikes against launch sites.
The unit also operates in the defensive domain, protecting Israeli military networks and critical infrastructure from Iranian cyber attacks. Iran's cyber capabilities have grown substantially, with groups like APT33 (Elfin) and APT35 (Charming Kitten) regularly targeting Israeli systems. The cyber dimension of the conflict is a continuous, invisible war fought 24 hours a day.
Shin Bet: The Home Front
While Mossad and Unit 8200 operate against external threats, Shin Bet's role in the Iran conflict focuses on preventing Iranian intelligence operations within Israel and the Palestinian territories. Iran's Ministry of Intelligence and Security (VAJA) and the Quds Force have repeatedly attempted to recruit agents, establish cells, and conduct attacks inside Israel.
Shin Bet has publicly disclosed dozens of foiled Iranian plots, including attempts to assassinate Israeli officials, bomb attacks against Israeli diplomatic facilities abroad, and recruitment of Israeli-Arab and Palestinian agents. The agency's penetration of Palestinian militant organizations — which receive Iranian funding and weapons — provides early warning of Iran-directed attacks.
During the 2025 conflict, Shin Bet's domestic surveillance capability was critical for identifying and neutralizing potential Iranian sleeper cells activated in conjunction with the missile campaign. The agency also managed the security of Israel's critical infrastructure — nuclear facilities, power plants, water systems — against sabotage by Iranian-directed agents.
Coordination and Failures
The Israeli intelligence community coordinates through the National Security Council (Hamemuneh) and through direct channels between agency heads, all of whom report to the Prime Minister. Weekly intelligence assessments synthesize input from all three agencies into a unified threat picture.
However, the community has also experienced notable failures. The October 7, 2023 Hamas attack represented a catastrophic intelligence breakdown where all three agencies missed indicators of an imminent large-scale assault. The subsequent investigation revealed institutional biases — a "conceptzia" (preconception) that Hamas was deterred — that prevented warning indicators from reaching decision-makers.
This failure had direct implications for the Iran conflict. The intelligence community underwent rapid reform, with new emphasis on challenging assumptions, red-teaming threat assessments, and ensuring that tactical indicators were not filtered out by strategic preconceptions. Whether these reforms were sufficient was tested when Iran escalated to direct ballistic missile attacks in 2025.
The Intelligence War Continues
The shadow conflict between Israeli and Iranian intelligence extends far beyond the battlefield. Both sides conduct espionage in third countries, compete for influence in international organizations, and wage information warfare through media and social media channels. Mossad operates globally to disrupt Iranian weapons procurement networks, while Iran's intelligence services target Israeli diplomats and businesspeople worldwide.
This intelligence war has no ceasefire and no boundaries. It predated the missile exchanges of 2025 by decades and will continue regardless of how the overt military conflict resolves. For Israel, maintaining intelligence superiority over Iran is not a wartime measure but a permanent national security requirement — one that consumes a disproportionate share of a small nation's resources but is considered existentially necessary.