Oil and gas industrial cybersecurity has become a live operational concern with documented incidents and named adversaries. Ransomware attacks on the sector surged 935% between April 2024 and April 2025 according to Zscaler ThreatLabz, and the 2026 Dragos OT/ICS Cybersecurity Year in Review documented active, named threat groups including VOLTZITE and AZURITE operating directly against oil and gas operational technology networks. AZURITE in particular is targeting engineering workstations to exfiltrate alarm data, configuration files, process information, and operator credentials. For regional operators and the EPC contractors who build and maintain their facilities, this is the risk environment of 2026.
The regional dimension is concrete and recent. The March 2026 attack on the South Pars gas field affected 12% of Iran's total gas production, and the UAE formally condemned a separate retaliatory strike on its Habshan gas facility. Regional operators across the Gulf tightened their security posture in response, and the conversation at board level around cyber and physical convergence has moved from occasional review to continuous priority. The attack surface in question includes assets that regional EPC contractors have designed, built, and continue to maintain.
01Section 1Why Smart Infrastructure Expands The Attack Surface
The modernisation of offshore platforms and industrial facilities, which is delivering genuine operational and safety benefits, has also expanded the surface area that attackers can reach. Remote operations centres with persistent connectivity to offshore assets. Predictive maintenance systems pulling sensor data continuously from rotating equipment. Agentic control systems with authority to adjust process parameters. Edge computing deployed near field instrumentation. Every one of these capabilities represents a connection path that did not exist on an air-gapped legacy platform.
The Dragos 2026 review found that 29% of oil and gas incidents involved poor IT/OT segmentation, the highest proportion of any sector studied. The sector also leads all industries in OT visibility and detection gaps, with 37% of findings pointing to malware detection shortcomings. VOLTZITE has exploited exactly these gaps, moving through cellular gateways into engineering workstations without detection. The GCC regulatory environment has moved to match the threat level. Saudi Arabia's National Cybersecurity Authority applies the Essential Cybersecurity Controls (ECC-1:2018) as a baseline across critical sectors, and the Operational Technology Cybersecurity Controls (OTCC-1:2022) specifically for OT and ICS environments in oil and gas, power, and water. The UAE operates comparable frameworks under the Cybersecurity Council. Regulators across the region are also increasingly holding executive leadership directly accountable for operational continuity, extending accountability beyond the technical teams who have historically carried it.
Every one of these capabilities represents a connection path that did not exist on an air-gapped legacy platform.
02Section 2What EPC Delivery Must Account For
For contractors designing and building new facilities, or retrofitting existing ones with smart systems, cybersecurity needs to sit inside the engineering design basis from the start. That means defined network architecture with segmented IT and OT zones. Authenticated access to engineering workstations with role-based privileges and session auditing. ICS-aware monitoring tools that understand industrial protocols, since generic IT security tools adapted to the OT environment leave detection gaps that adversaries exploit. Documented incident response plans tested against realistic scenarios, including loss of the central control facility.
Remote access is the specific weak point that keeps surfacing in regional operator reviews. Contractors and vendors need to connect to unattended sites to keep operations running, and each session carried through shared credentials, standing VPN connections, or unmonitored third-party links is a potential entry path. Hardening remote access, including just-in-time access provisioning and comprehensive session logging, is where many operators are now investing.
Planning a project?
Talk to PMO Global about delivering it from bid to build.
