A year ago, the quiet of the Baisaran meadows in Pahalgam—broken only by tourists and pony rides—was shattered by automatic gunfire. On April 22, 2025, three terrorists emerged from the tree line and killed 26 people, most of them visitors. For the security establishment in Jammu & Kashmir, the attack was not just a tragedy; it was a systemic shock. Never before had tourists been targeted at scale. It forced a rethink of both assumptions and deployment.Twelve months on, as tourist footfall begins to recover, the shift in the Valley’s security posture is visible. The emphasis has moved from reactive containment in urban centres to a more dispersed, intelligence-led grid—one that seeks to dominate high-altitude terrain, integrate local networks, and rely more heavily on surveillance and precision operations. Yet, even as the grid has adapted, gaps exposed by Pahalgam continue to shape the conversation within the security establishment.Recognising the gapsThe Pahalgam attack marked a rupture in the narrative of “normalcy” that had guided administrative policy in the preceding years. A sustained decline in urban violence and a surge in tourism had encouraged the opening up of remote, high-altitude destinations across the Pir Panjal range—Sinthan Top, Boota Pathri and dozens of other sites were among nearly 75 locations made accessible after the pandemic.“These locations, while breathtaking, were strategically precarious; they sat on or near historical infiltration corridors where militant presence, though intermittent, never fully disappeared,” said a security establishment officer.The working assumption within the security grid had been that militant groups would continue with familiar patterns—targeted attacks in towns or direct engagements with security forces. The possibility that tourists, in relatively unguarded meadows, could become primary targets had not been fully factored in.In effect, many of these destinations functioned as “soft frontiers”, opened up faster than they could be secured. The closure of over 50 such sites in the immediate aftermath of the attack was, as a former Director General of J&K Police put it, “an acknowledgement that the push for normalcy had outpaced the expansion of the security grid.”From holding roads to holding ridgesIf the attack exposed a vulnerability, it also triggered a structural shift in deployment. Over the past year, security forces have established 43 Temporary Operating Bases (TOBs) across the higher reaches of the Pir Panjal range, with personnel from the CRPF and Rashtriya Rifles now stationed at altitudes ranging from 3,000 to nearly 9,000 feet.Story continues below this adThe idea is to deny militant groups the advantage of terrain. By occupying ridgelines and forested heights, forces aim to disrupt the traditional infiltration-to-execution cycle, where small modules would enter through forest corridors, lie low, and strike when opportunities arose.As one J&K Police officer described it, the shift is from “holding the road” to “holding the ridge”—a move away from visible, road-centric security towards terrain dominance in areas that were previously thinly monitored.Technology and the “human firewall”Alongside redeployment, the security grid has leaned more heavily on technology and local integration. In the past year, over 50,000 individuals linked to the tourism economy—pony handlers, guides, photographers and vendors—have been brought onto an Aadhaar-linked database and issued QR-coded identification.The intent is two-fold: to enable instant verification in tourist zones and to reduce the risk of over-ground worker (OGW) networks embedding themselves within the service economy. Officials describe this as creating a “human firewall” around key tourist circuits.Story continues below this adSurveillance, too, has expanded. Facial Recognition Devices have been installed at transit points, while drone corridors now provide continuous aerial monitoring over vulnerable meadows and trekking routes. The emphasis is on maintaining a security presence without the overt militarisation that could deter visitors.This combination has allowed the administration to gradually reopen many of the sites that were shut after the attack. But it also raises questions around privacy and the long-term sustainability of such intensive monitoring—issues that remain largely unaddressed in official discourse.Perhaps the most significant shift has been towards intelligence-driven operations. In July 2025, under Operation Mahadev, security forces tracked and eliminated the three-member module behind the Pahalgam killings in the Harwan heights, using a combination of human intelligence and drone surveillance.Since then, officials point to a series of targeted operations as evidence of a more “intel-first” approach. This includes the dismantling of the so-called “Doctor Module” in November 2025, where a probe into incendiary posters originating in J&K led to the recovery of over 350 kg of explosives in Haryana and the disruption of a wider network. This, sources said, prevented what could have been a series of attacks across the country. It started and ended with the Red Fort car blast in Delhi.Story continues below this adMore recent operations—the neutralisation of the Saifullah group in the Kishtwar-Doda belt and the busting of a transnational Lashkar-e-Taiba recruitment module earlier this year—have followed a similar pattern: precise, intelligence-backed strikes with minimal collateral damage.The emphasis, officials say, is on depth—tracking networks across geographies rather than reacting to isolated incidents.The limits of adaptationDespite these changes, the security grid remains far from impermeable. Two constraints continue to dominate internal assessments: infiltration and intelligence gaps in difficult terrain.The delay in deploying dedicated all-weather surveillance capabilities—following setbacks in recent satellite missions—has limited the ability to maintain a continuous watch along the Line of Control, particularly in adverse weather. Ground sensors and drones, while effective, remain vulnerable to the Valley’s climatic extremes.Story continues below this adMore fundamentally, human intelligence in dense forest zones continues to lag. The thick canopy of the Pir Panjal still provides enough cover for small, mobile “hybrid” modules to evade detection, at least temporarily.“Once a terrorist enters, he is going to do something. As long as Pakistan keeps pushing, something or the other will keep happening. It is a good thing currently that it is busy on its western front due to its ongoing battle with the Taliban,” a central security establishment officer said.