With domestic extremist networks scrambling to regroup online, experts fear the next attack could come from a radicalized individual — much harder than coordinated mass events for law enforcement and platforms to detect or deter.

The big picture: Companies like Facebook and Twitter stepped up enforcement and their conversations with law enforcement ahead of Inauguration Day. But they'll be tested as the threat rises that impatient lone-wolf attackers will lash out.

Where it stands: "Without any apparent large scale event in the immediate future, there is always a risk that radicalized individuals may feel themselves compelled to act out," said Jared Holt, a visiting research fellow with the Atlantic Council.

What they're saying: Twitter says it's working closely with the FBI and Department of Homeland Security to minimize potential risks, including those specifically relating to planned future demonstrations from white nationalists and other extremist groups across the country.

• "These relationships are longstanding and go beyond any one event," a Twitter spokesperson told Axios.

Facebook and YouTube also said they continue to work with law enforcement.

The Biden administration on Friday announced a plan to combat domestic terrorism — one that will rely heavily on agencies like the Director of National Intelligence, the FBI, the Department of Homeland Security and the National Security Council.

The intrigue: There are patterns in online chatter that can predict when different extremist groups are most likely to translate talk into action. Platforms and law enforcement should pay close attention to online extremist groups when certain topics are in the news, say researchers.

• Militia groups grow more threatening when any kind of gun legislation is introduced, while white supremacists are animated by immigration topics, Holt said.

Right now, disillusioned QAnon followers are being recruited by more violent groups.

• "We are already hearing of white supremacist groups seeking to mobilize frustrated conspiracy theorists," said Naureen Chowdhury Fink, executive director of security consulting firm the Soufan Center.

One big worry: Even when tech platforms take action against users who encourage terrorism, those people don't face real-world consequences until it's too late.

• "If there are organizations that are currently promoting violence, it seems very strange that the only the only response we seem to have is to delete content online, rather than actually dealing with the individuals who are behind this," said Adam Hadley, executive director of Tech Against Terrorism, a United Nations initiative focused on the relationship between law enforcement and tech.

One bright spot for platforms and law enforcement: Even radicals need a public presence in order to recruit and keep their numbers up.

• That means plenty of violent rhetoric is still circulating in venues that are easy to infiltrate and monitor, such as forums on the open web and public Telegram channels.

The catch: Extremists who have found fellow travelers may still take to private, encrypted platforms to form clandestine online sleeper cells. As Axios has previously reported, there are signs this is already happening.

• “We will see one of these groups do something that was planned entirely on or majority via an encrypted app,” said Matt Mitchell, a technology fellow at the Ford Foundation.

What's next: Look for more debates over the delicate balance of civil liberties, free speech and keeping Americans safe from domestic terrorism. The battle over forcing tech firms to build encryption backdoors for law enforcement is also likely to come roaring back.