A group’s resilience is often linked to its network structure. While decentralized network properties have been associated with resilience at the group-level, little is known about the individual-level factors that lead groups to adopt these structures. Criminal groups, consistently faced with unexpected external disruptions, provide an opportunity to examine individual decisions to collaborate across periods of increased risk. Using data on 118 terrorist offenders across six attacks we test whether individual decisions to collaborate are influenced by variation in law enforcement activity. Results from exponential random graph models demonstrate that many of the processes that drive collaboration between offenders differ when faced with greater risk. Connectivity was maximized in periods of decreased enforcement activity, with offenders more likely to collaborate in dense, local triads. Following an increase in interdictions, triad closure had no impact on co-offending.