Sertan Selcuk, the Vice President of METAP and CIS Regions at OPSWAT says hackers are now targeting third-party vendors—companies that have access to critical infrastructure but often have less robust security measures

Can you provide an overview of the current cybersecurity landscape for critical infrastructure in the MEA region?
The cybersecurity landscape for critical infrastructure in the Middle East and Africa (MEA) region is one of both immense opportunity and significant risk. As digital transformation accelerates across industries like energy, healthcare, and transportation, the need to protect vital infrastructure is becoming even more urgent.

The region has always been strategically important, and now, with the growing complexity of the global geopolitical environment and the continued digitisation of everything from industrial control systems to cloud platforms, the attack surface is rapidly expanding. We’re seeing a combination of increasingly sophisticated, state-sponsored threats alongside an uptick in financially motivated attacks from cybercriminals. The regional challenges are unique, given the variety of government approaches to cybersecurity and varying levels of infrastructure maturity.

But at its core, the MEA region is dealing with the same overarching issue: the gap between the speed of technological innovation and the speed at which security measures can evolve to match these new threats.

What are the most notable trends in cyber attacks targeting these systems?
If there’s one thing we’ve seen in recent years, it’s that the diversity of attack methods has dramatically increased. Ransomware is still a significant threat—attackers are targeting critical sectors like healthcare and energy, knowing that they can disrupt essential services and demand large ransoms. But what’s more concerning is the rise in advanced persistent threats (APTs). Nation-state actors are not only after financial gain—they’re after strategic advantage, stealing intellectual property or trying to destabilise key regions. In some cases, these attacks are also focused on geopolitical leverage.

Another major trend we’re seeing is the exploitation of supply chains. Hackers are now targeting third-party vendors—companies that have access to critical infrastructure but often have less robust security measures. It’s a classic example of how an attack doesn’t always come directly through your organisation but via a trusted partner. Lastly, IoT vulnerabilities are becoming more apparent as we digitise our energy grids, healthcare systems, and transportation networks. These IoT devices are often not properly secured, making them a prime target for cybercriminals.

Which sectors in the MEA region are most vulnerable to cyber attacks, and why?
I believe the energy sector stands out as one of the most vulnerable in the MEA region. Countries that rely on oil and gas for economic stability, like Saudi Arabia and the UAE, face constant threats from state-sponsored cyber actors trying to disrupt operations or steal valuable data. It’s not just about cybercriminals; these attacks are highly sophisticated, driven by geopolitical motivations.

The healthcare sector is another area of concern. With digital health records, connected devices, and the overall shift toward telemedicine, the healthcare system in many parts of MEA has become increasingly digitised—and underprotected. Ransomware attacks targeting hospitals can be devastating, especially when attackers hold critical systems hostage, which is exactly what we saw in the past few years.

Then, we can’t ignore transportation. Whether it’s maritime shipping or air traffic, these sectors are essential for global trade, and a cyber-attack could have significant ripple effects across the world’s supply chain. Port infrastructure in the region, which is key for both regional and global trade, has become a frequent target for both financial and strategic motives.

What are the primary motivations behind cyber attacks on critical infrastructure in the MEA region?
When it comes to motivation, the drivers are multi-layered. Geopolitical tension is a major factor. A lot of the attacks we’re seeing aren’t just about stealing data or holding a company ransom—they are about sending a message or destabilising a government or economy. The energy sector, for example, is frequently targeted by actors seeking to disrupt the regional balance of power.

But financial gain is still a huge motivator, especially in sectors like healthcare and financial services. Ransomware operators know that shutting down vital services is a quick way to demand a ransom, and unfortunately, these industries often have no choice but to pay to get systems back online.

Then there’s the classic case of cyber sabotage, where an attack is purely designed to cause disruption. This could be in an effort to undermine trust in a government or to cause chaos during a period of political instability. These are often less about stealing data and more about sending a political message or leveraging cyberattacks to further a larger agenda.

How important is employee training and awareness in preventing cyber attacks on critical infrastructure?
One of the most important lessons I’ve learned over my career is that people are the weakest link in cybersecurity. No matter how advanced your technical systems are, if your employees aren’t properly trained to recognise threats—like phishing emails or suspicious links—you’ll always have vulnerabilities. Employee training and awareness are critical.

It’s not just about sending out a checklist of best practices, either. It’s about creating a culture of cybersecurity across your organisation, where everyone—from the top down—understands the risks and the role they play in preventing them. We need to empower individuals to spot threats early and respond appropriately. I can’t overstate how essential it is for leadership to take this seriously and lead by example.

What role does proactive threat intelligence play in securing critical infrastructure systems?
Proactive threat intelligence is more critical than ever in the current cybersecurity environment. Threat actors today are faster, smarter, and more persistent, so waiting until an attack occurs to react, simply isn’t enough. By tapping into threat intelligence, organisations can stay ahead of emerging risks, whether it’s a new attack vector or a shift in attack tactics from a known adversary. Real-time intelligence, for example, can help identify vulnerabilities before they’re exploited, so that organisations can adjust their defenses ahead of time. Sharing intelligence between governments, private organisations, and even across borders, allows for a more collective approach to mitigating risk.

Are there any technologies being deployed to safeguard critical infrastructure in the region?
There’s no silver bullet when it comes to securing critical infrastructure, but AI and machine learning are becoming game changers. These technologies can identify abnormal patterns and suspicious activities faster than a human ever could. They’re excellent for proactive defense, helping to detect zero-day attacks or even malware that hasn’t been seen before.

Another critical trend is the adoption of zero-trust architecture. In a region where critical infrastructure spans multiple sectors and often connects with external networks, zero-trust principles—where verification is required for every user, device, and network interaction—are helping to minimise the risk of unauthorised access. Encryption is also key, particularly for protecting sensitive data as it moves between systems or is stored in cloud environments. Secure data transmission and storage should be non-negotiable, especially in industries like healthcare and energy, where the stakes are incredibly high.

What are the biggest challenges companies face in securing critical infrastructure in the MEA region?
I think one of the biggest challenges we face in the MEA region is the lack of resources—specifically, skilled professionals and budget for adequate cybersecurity investments. A shortage of cybersecurity talent continues to be an issue, especially as threats evolve. There’s a constant battle to hire and retain the best talent, and many organisations are underprepared.

Legacy systems also remain a huge hurdle. Critical infrastructure often depends on old, outdated systems that weren’t designed with modern cybersecurity in mind. Modernising these systems without disrupting services is a major challenge, but it’s one that organisations must tackle.

Finally, inconsistent regulation across countries can be a major stumbling block. While some governments have made great strides in regulating cybersecurity, others are still lagging behind. Without consistent, region-wide standards, it’s hard for businesses to implement a comprehensive cybersecurity strategy that meets the necessary compliance requirements.

What role do MEA governments play in regulating and enforcing cybersecurity standards for critical infrastructure?
Governments in the region are starting to realise that cybersecurity is no longer a luxury, but a necessity. Countries like the UAE and Saudi Arabia have been proactive in establishing national cybersecurity strategies, and these efforts are a step in the right direction. However, the enforcement of these regulations is still a work in progress. For many organisations in the region, navigating the patchwork of national regulations can be a challenge. What we need is a more harmonised approach across MEA that allows companies to meet consistent standards, reducing the complexity of compliance and making it easier for businesses to implement effective security measures.

How can companies ensure business continuity while recovering from a cyber attack on their critical systems?
When it comes to ensuring business continuity after a cyber attack, the key is preparedness. Organisations need to have detailed incident response plans in place, backed up by strong recovery protocols. A good plan not only helps you respond quickly, but it also ensures that you’re communicating effectively with stakeholders throughout the process. I’m a firm believer that businesses should be practicing their response to cyber incidents as if they’re real—because when an attack happens, it’s no time to learn on the fly.

One of the most important things to have in place is a reliable data backup strategy. Regular backups are essential for minimising downtime. And once the systems are back online, it’s essential to conduct a thorough post-incident review. This review isn’t just about identifying what went wrong but also about adapting and strengthening defenses to ensure that you’re better prepared next time.