Critical infrastructure operators urged to close verification gap amid rapid digitisation

Critical infrastructure operators in Qatar are being urged to address a significant gap between installing cybersecurity tools and verifying their effectiveness in real-world scenarios. As the country accelerates the digitisation of sectors like energy, finance, healthcare, water, and transport, spending on defensive cybersecurity tools is reaching record levels.

However, founder and CEO of CyberX, David de Paula Santos Silva, warns that merely having these tools in place is not enough. Silva emphasizes that operational technology environments in critical sectors require special attention, as they combine rapid digitalisation with safety requirements, making it challenging to take systems offline for maintenance or testing.

He stresses that companies must actively validate their security stacks, as an expensive security suite could still fail to detect an attack, allow network segmentation to be bypassed, or reveal a broken incident response process during a simulation. Silva compares the situation to installing a fire alarm, stating that a green indicator light shows the device is turned on, but actual smoke proves the system functions during an emergency.

He stresses the need for independent risk-based penetration testing, periodic red-team exercises, third-party risk assessments, and mandatory retesting after significant vulnerabilities are fixed, as incident response exercises are equally critical.

Brief written by urgent.news from Gulf Times Business's own syndicated text. Machine-written — may contain errors; check the original before relying on it.