Osama Al-Zoubi, Vice President, MEA, Phosphorus Cybersecurity, highlights how Saudi Arabia’s rapid digital modernization is expanding the xIoT attack surface across critical sectors, exposing OT environments to escalating threats, legacy vulnerabilities, and operational risks that require automated, scalable device‑level security.
Saudi Arabia’s Vision 2030 has accelerated digital transformation across energy, manufacturing, and smart infrastructure. How has this rapid modernization changed the threat landscape for OT and industrial environments in the Kingdom?
Vision 2030 is accelerating digital transformation across energy, manufacturing, AI data centers, healthcare, finance, transportation, and smart cities, rapidly expanding the xIoT attack surface. Every connected device, from PLCs and building systems to medical devices and PDUs, introduces firmware, credentials, and device configurations that must be secured.
Threat actors increasingly pivot from hardened IT systems to poorly secured IoT and OT devices, exploiting default passwords, outdated firmware, and exposed services.
Security hygiene must now extend beyond IT to every connected device. This requires high-fidelity discovery, automated password rotation, firmware management, configuration hardening, and continuous drift monitoring. At Vision 2030 scale, manual oversight is not viable. Automation and device-level security are essential to protect critical infrastructure and operational continuity.
We’re seeing a rise in targeted attacks on industrial and operational systems globally. From your vantage point, why are OT and ICS environments becoming such attractive targets for threat actors today?
OT and ICS environments are increasingly targeted for three key reasons: impact, connectivity, and security gaps. These systems run critical infrastructure such as energy, manufacturing, water, and transport. Disrupting them causes immediate operational and financial damage, creating strong leverage for extortion. At the same time, IT and OT convergence, remote access, and cloud integration have connected previously isolated systems to corporate networks and the internet, expanding the attack surface.
Many OT assets rely on legacy technology, default credentials, and insecure protocols. For threat actors, this combination offers high-impact results with comparatively weaker defenses than modern IT systems.
When cyber incidents hit industrial environments, the impact is often very different from traditional IT breaches. What do these attacks look like in real operational terms — and what kinds of disruptions are organizations in the region experiencing?
In industrial environments, the consequences of cyber incidents are often immediate and physical. Instead of stolen data, organizations face halted production lines, emergency shutdowns at oil and gas facilities, or disruptions to water treatment operations, services that millions of Saudi citizens and residents depend upon.
The region’s role as a global energy supplier amplifies these stakes considerably. Even a seemingly minor event – such as an expired digital certificate on a control device – can interrupt communications and trigger operational outages. In more targeted attacks, adversaries exploit an unmanaged device as a staging point before moving laterally toward higher-value systems, turning a quiet vulnerability into a significant operational crisis.
Many organizations still struggle with the divide between IT security and OT operations. How do these gaps create vulnerabilities, and what are the most common weaknesses you see across Middle Eastern critical infrastructure?
The IT-OT divide remains one of the most persistent security challenges. IT teams are focused on data protection and network integrity; OT teams prioritize uptime, safety, and process continuity, and these objectives often pull in opposite directions. Devices are frequently installed by facilities teams or third-party contractors without IT awareness. Asset inventories grow incomplete. Default credentials go unchanged. Firmware updates are deferred to protect operational continuity. The result is that organizations may satisfy the letter of NCA compliance requirements while significant blind spots remain. It is precisely within these gaps – invisible to both teams – that sophisticated threat actors find their most effective points of entry.
Saudi Arabia is investing heavily in smart cities, autonomous systems, and AI driven industrial automation. How prepared are OT environments to handle the security implications of this new level of connectivity?
Preparedness is currently uneven, and the pace of deployment is outrunning the pace of security readiness. Saudi Arabia’s giga-projects, the Red Sea Project, Qiddiya and SDAIA’s national AI agenda are introducing thousands of interconnected devices across multi-vendor, multi-agency environments. Traditional IT security tools were never designed for this kind of protocol-diverse, distributed ecosystem.
Many organizations still lack full visibility of all connected assets, which makes consistent protection extremely difficult to achieve. As CITC and the NCA continue to raise the compliance bar, readiness will depend not on frameworks alone, but on automated discovery and risk assessment, automated device hardening and remediation, continuous monitoring, and genuine coordination between IT and OT leadership across all project stakeholders.
Phosphorus focuses on securing IoT, IIoT, and OT devices at scale. What unique challenges do you encounter when securing these devices in high-density industrial environments such as oil & gas facilities or large manufacturing plants?
In these environments, as well as in data centers, financial services, and healthcare, scale and the diversity of devices define the security challenge. Thousands of devices may operate across vast or geographically dispersed sites, using proprietary industrial protocols that standard tools cannot interpret. Most cannot host security agents, and firmware updates frequently require physical access or carefully timed maintenance windows. Managing credential rotation, configuration hardening, and certificate lifecycle manually across such estates is operationally unsustainable, it leads inevitably to delayed remediation and prolonged exposure. Harsh operating environments and continuous production demands further compress the window for intervention.
The result is a compounding security debt that grows faster than traditional approaches can address, which is precisely the challenge Phosphorus was built to solve with safety, precision, and automation as the foundation of our technology.
Many OT assets were never designed with cybersecurity in mind. How can organizations modernize legacy systems without disrupting operations — especially in sectors where downtime is extremely costly or dangerous?
Many OT environments currently operating across Saudi Arabia’s energy, utilities, and manufacturing sectors were engineered long before connectivity became standard. Replacing them wholesale is rarely realistic, given both cost and operational risk. A more sustainable path begins with comprehensive asset visibility, knowing precisely what is connected, where, and in what configuration. From there, organizations can deploy protocol-aware discovery tools that operate passively, without disrupting live processes. Automating credential rotation, certificate renewal, and configuration updates removes dependence on manual intervention. Firmware updates can be scheduled around operational windows to minimize exposure where needed. The goal is gradual, layered modernization, strengthening the security posture of each asset without interrupting the critical functions the Kingdom depends upon.
Looking ahead, what strategic steps should Saudi and regional organizations take to build long-term resilience across their OT ecosystems, especially as threat actors become more sophisticated and AI-enabled?
Building long-term OT resilience in Saudi Arabia requires both technical maturity and organizational alignment. Organizations must prioritize continuously updated asset inventories and adopt automated remediation for credentials, firmware, and certificates, the manual approach cannot scale. Collaboration between IT and OT teams is essential; these functions must operate as partners, not silos. Security requirements should be embedded into procurement processes from the outset, ensuring devices are hardened before deployment rather than after. Developing dual-skilled professionals who span both cybersecurity and operational technology is equally critical given current workforce gaps in the Kingdom. With NCA frameworks maturing and threat actors growing more capable, proactive and automated protection is no longer optional, it is a national infrastructure imperative.