As the jihadist group lost ground, he said, there were signs it was shifting to attacks abroad.
"The possibility of a lone actor or a small cell that kills people is real," he said, adding that networks in the US could be activated.
Mr Obama was giving an update to reporters after a Pentagon meeting.
Separately, he strongly denied that a $400m (£305m) cash payment to Iran was a ransom for the release of American prisoners in January.