Twenty-five years after 9/11, governments still risk strategic surprise when they fail to imagine how familiar threats combine in new, disruptive ways.