CIA operative John Clark forms a top-secret international counterterrorist organization known as Rainbow. Formed to combat the proliferation of formerly state-sponsored terrorist groups gone rogue after the Cold War, and based in Hereford, England, Rainbow consists of two operational squad-sized teams of elite special forces soldiers from NATO countries, supplemented by intelligence and technology experts from the FBI, MI6, and Mossad. Clark serves as Rainbow's commanding officer (callsign "Rainbow Six"), SAS officer Alistair Stanley serves as their second-in-command, and Clark's son-in-law Domingo Chavez leads Team-2.

In their first deployment, Team-2 rescues hostages during a bank robbery in Bern, Switzerland. Several weeks later, they are deployed to Austria, where German left-wing terrorists have taken over the schloss of a wealthy Austrian businessman to obtain (nonexistent) "special access codes" to the international trading markets. They are later deployed to the Worldpark amusement park in Spain, where Basque revolutionaries have taken a group of children hostage and demand that various prisoners, including Carlos the Jackal, be released.

Clark and his colleagues become suspicious about the sudden rise in terrorist attacks. Unbeknownst to them, the attacks are part of an intricate plan to wipe out nearly all of humanity, codenamed "the Project". Dr. John Brightling, a staunch radical environmentalist who heads a biotechnology firm called the Horizon Corporation, ordered the attacks through ex-KGB officer Dmitriy Popov to raise concerns of terrorism, allowing co-conspirator Bill Henriksen's security firm Global Security to land a key contract for the Olympic Games in Sydney, Australia. Henriksen would then ensure the release of "Shiva"—a manmade Ebola biological agent more deadly than the one that spread a year prior, developed by Horizon and tested on kidnapped human test subjects—through the fog-cooling system of Stadium Australia, infecting almost everyone present, who would then return to their home countries, spreading Shiva across the world. The resulting pandemic would kill countless people, during which Horizon would distribute a "vaccine"—actually a slow-acting version of Shiva—ensuring the deaths of the rest of the world's population. Brightling's "chosen few", having been provided with the real vaccine, would then inherit the emptied world, justifying their genocidal actions as "saving the world" from the environmentally-destructive nature of humanity.

Popov discovers the existence of Rainbow as he reviews the "police tactical teams" (actually Rainbow in disguise) that responded to his attacks, and brings it to Brightling's attention. Brightling and Henriksen order Popov to orchestrate an attack on Rainbow to prevent them from being deployed to the Sydney Olympics. Popov persuades a team of breakaway drug-dealing Provisional Irish Republican Army militants to attack a hospital near Rainbow's base and capture Clark and Chavez's wives, who work there as a nurse and a doctor respectively. When Rainbow arrives, a team of IRA militants ambush them, killing two Team-1 troopers and injuring several others, including Stanley. Despite sustaining their first-ever losses, Rainbow manages to repel the ambush, retake the hospital without further casualties, and capture some of the militants. Using trickery to interrogate the captured militants, Clark and Chavez learn of Popov's involvement, while Brightling evacuates Popov to Horizon's OLYMPUS facility in Kansas.

However, this turns out to be a fatal miscalculation: Popov was unaware of the genocidal plans of his employers, but the people at OLYMPUS talk openly about them. Learning the truth about the Project, Popov, appalled by what he had unknowingly assisted, escapes and reveals his knowledge to Clark and the FBI, who were already investigating the kidnappings of the Shiva test subjects. Popov's warning comes just in time for Chavez and Team-2, who were deployed to the Olympics to provide security, to thwart Shiva's release at the last minute.

Their plans in shambles, Brightling and the remaining Project members flee to a smaller Horizon base in the Amazon rainforest near Manaus, Brazil. Clark personally leads Rainbow to the base, where they kill the guards, demolish the buildings, disable communications, and round up the remaining Project members. Knowing there is insufficient evidence to convict them and that they would just restart their plans if freed, Clark instead has the survivors stripped naked and left to fend for themselves in the jungle, taunting them to "reconnect with nature".

Six months later, Chavez reads news articles about Popov (who was pardoned in exchange for his information) discovering a gold deposit on a Project member's former property, and Horizon's revolutionary medical breakthroughs under new management. Chavez asks if the Project members survived; Clark informs him that no human activity has been detected in the area since, and remarks that nature does not distinguish between friends and enemies. Wondering who humanity's natural enemy must be, Chavez determines it must be humanity itself.