Don’t panic: How Gulf energy sector is training for cyber crisis

Cybersecurity leaders have cautioned that oil and gas operators face an increased risk due to digitalization and the convergence of IoT and OT systems. A panel discussion held during GISEC Global 2026 emphasized the importance of focusing on consequence-driven resilience rather than mere compliance. Ali Abdulla Hasan Salman, Chief of Information Technology at Bahrain's Ministry of Oil and Environment, stressed the significance of this conversation, noting that oil and gas is the "engine room" of the economy, and its disruption could affect the entire ecosystem.

Khaled Al Teneiji, Cyber Security Head at ENOC, challenged the conventional "IT versus OT" framing of threats, advocating for a more integrated approach. He proposed that organizations map potential consequences of attacks into their business processes, regardless of whether the threat originates from IT or OT. This involves mapping threat vectors from IT to OT to create kinetic impact, ensuring that security and operations teams work together to avoid creating problems in one area due to fixes in another.

The panel highlighted full visibility as the most crucial solution for staying ahead of threats. Accurate asset inventory, which requires continuous maintenance, is essential. This visibility should include hardware, software, APIs, certificates, and the behavior of OT controllers. Early warning systems can detect threats and enable timely responses.

When an attack occurs, the panel stressed the importance of not panicking. Instead, they emphasized the need for well-tested company-wide continuity and response plans, including clear recovery targets. Mental preparedness is also critical, with Alasmi advocating for training security teams to handle pressure and crisis situations, as this is not a one-time task but requires regular practice.

The panel also underscored the importance of bridging the cultural gap between IT and process engineers. They should collaborate before and during incidents to ensure effective communication and decision-making. The race to stay cyber-ready is ongoing, with cybersecurity shifting from a focus on flaws to building resilience. The UAE's first line of cyber defense, according to Al Kuwaiti, lies within the community.