Most organizations operating in fragile markets treat civil unrest as background noise. Protests happen. Strikes disrupt operations for a day or two. Things calm down. Business continues. Until one day, they don’t.
The transition from civil unrest to insurgency doesn’t announce itself. There’s no moment where protest movements officially declare they’re now an armed resistance. But there are early signals. Patterns of escalation, shifts in rhetoric, changes in organizational structure. These indicate when unrest is hardening into something far more dangerous.
If you’re operating in a market where protests are becoming frequent, where security incidents are increasing, or where political language is growing more militant, you need to know how to read the situation. Not all unrest leads to insurgency, but insurgencies don’t start from nowhere. They emerge from unrest that’s ignored, suppressed without resolution, or met with force that radicalizes rather than pacifies.
Here’s how to distinguish between temporary instability and the early stages of organized violent resistance, and what that means for your operations.
Volume and Frequency Aren’t the Main Indicators
The first mistake organizations make is treating protest frequency as the primary risk signal. They assume that if protests are happening weekly, the situation must be deteriorating. But frequency alone doesn’t predict insurgency. Some cities have sustained protest cultures that remain non-violent for years. Others see a handful of incidents that escalate rapidly into armed conflict.
What matters more than frequency is escalation pattern. Are protests growing in size over time, or are they stable? Are they spreading geographically, or confined to known hotspots? Are participation demographics shifting, particularly toward younger, more militant actors?
In Nicaragua in 2018, protests began as small demonstrations against social security reforms. Within weeks, they had spread across the country, expanded to include broader anti-government demands, and involved violent clashes with state forces. The frequency wasn’t the signal. The rapid geographic spread and demographic broadening were.
If you’re seeing protests expand beyond their original grievance, beyond their original location, and beyond their original participant base, that’s an escalation pattern worth monitoring closely.
Rhetoric Shifts Matter More Than Volume
Civil unrest that remains focused on specific policy demands (higher wages, better services, government accountability) tends to stay within negotiable bounds. Even when protests are large and disruptive, they’re oriented toward reform, not overthrow.
Insurgencies emerge when rhetoric shifts from reform to regime change, from policy demands to existential conflict, from “fix this” to “you have no right to govern.” This shift often happens gradually, but it’s identifiable if you’re listening.
Watch for language that delegitimizes the state itself rather than specific officials. Watch for calls to action that move from “pressure the government” to “defend yourselves” or “take back control.” Watch for framing that positions the conflict as zero-sum. Either the government falls or the people remain oppressed.
In several Latin American contexts I’ve observed, protests that began with calls for accountability shifted over months to narratives of betrayal, occupation, and righteous resistance. By the time that rhetorical shift is complete, the unrest has often already begun organizing along insurgent lines even if armed conflict hasn’t started yet.
Organization Structure Begins to Mirror Military Logic
Protests organized by civil society groups, student movements, or labor unions tend to have decentralized, fluid structures. Leadership rotates. Tactics vary by location. There’s internal debate about strategy. This is normal for civil movements.
When unrest starts transitioning toward insurgency, organizational structure changes. Leadership becomes more centralized and less visible. Decision-making becomes more opaque. Cells or regional chapters start operating with more autonomy but under coordinated strategy. Communication becomes more disciplined and security-conscious.
You’ll also see tactical sophistication increase. Blockades become more strategic. Targets shift from symbolic to operationally disruptive. Protesters start anticipating security force responses and adapting in real time. This suggests planning, training, and coordination that goes beyond spontaneous civil action.
If protest movements start looking less like social movements and more like command structures, that’s a signal that the actors involved are preparing for sustained confrontation, not temporary disruption.
Security Force Response Creates Escalation Feedback Loops
One of the most reliable predictors of insurgency isn’t the behavior of protesters. It’s the behavior of state forces. Heavy-handed suppression, indiscriminate violence, and human rights abuses don’t end unrest. They radicalize it.
When security forces respond to protests with disproportionate force, three things happen. First, public sympathy shifts toward protesters, even among people who were initially neutral or opposed. Second, moderate voices within the movement lose influence to more militant actors who argue that peaceful tactics don’t work. Third, the state’s own actions validate the narrative that it’s illegitimate and must be resisted.
I’ve watched this pattern play out in multiple contexts. A government cracks down. International media covers the violence. Sympathetic populations mobilize. The movement grows. The government escalates. And within months, what started as containable unrest has metastasized into sustained, organized resistance.
If you’re operating in a market where security forces are using live ammunition on protesters, arresting organizers en masse, or shutting down communications infrastructure during unrest, understand that these tactics often accelerate insurgency rather than prevent it.
External Support Begins to Materialize
Civil movements rarely transition to insurgency without external support: financial, logistical, or ideological. Watch for signs that protest movements are receiving resources beyond what local fundraising or grassroots organizing typically provides.
This can show up as improved equipment, professional-grade communications infrastructure, or sudden access to legal and media support that wasn’t there before. It can also appear as foreign rhetoric aligning with local movements, diaspora communities mobilizing resources, or regional actors amplifying the conflict for geopolitical advantage.
External support doesn’t guarantee insurgency, but it does lower the cost and increase the sustainability of sustained resistance. When movements that were struggling to feed participants suddenly have logistics and supply chains that look semi-permanent, someone is backing them.
What This Means for Your Operations
If you’re seeing multiple early warning signals simultaneously (escalation patterns, rhetorical shifts, organizational tightening, heavy-handed state response, and external support), you’re not watching civil unrest. You’re watching the early stages of insurgency, whether it’s been formally declared or not.
At that point, your operational calculus changes. You’re no longer managing disruption risk. You’re managing sustained conflict risk. That means:
- Reassessing staff safety protocols and evacuation plans
- Reviewing supply chain dependencies and identifying alternate routes
- Evaluating whether your visibility makes you a target for either state forces or insurgent actors
- Building contingency plans for extended operations suspension or market exit
- Communicating transparently with stakeholders about risk trajectory, not just current conditions
The organizations that get caught off guard are the ones that treat each incident in isolation and miss the pattern. The ones that survive are the ones who recognize the shift early and adjust before options narrow.
Final Thoughts
Civil unrest is manageable. Insurgency is not, at least not for most civilian operations. The difference between the two isn’t always obvious in the moment, but the signals are there if you know what to look for.
If you’re operating in a fragile environment and the unrest around you feels different than it did six months ago, don’t dismiss that instinct. Map the escalation pattern. Monitor the rhetoric. Watch the organizational shifts. And make your decisions based on trajectory, not current state.
Pholus works with organizations operating in volatile and conflict-adjacent markets to assess political risk, interpret weak signals, and build contingency plans before crises force rushed decisions. If your market is showing early warning signs and you’re not sure how to read them, let’s talk before your options narrow.
