Radu Balanescu, the Associate Director for Cybersecurity at BCG, and Shoaib Yousuf, the Managing Director and Partner at BCG speak about cybersecurity for critical infrastructure, the threat landscape, trends in cyberattacks, and more

Why is cybersecurity highly relevant for critical infrastructure and its operators in the MEA region, and particularly now?
Critical National Infrastructure (CNI) operators in the MEA region face a dual responsibility: protecting shareholder interests while ensuring national security and stability. Their role extends beyond operational resilience to actively strengthening the country’s cyber defense through industry collaboration, intelligence sharing, R&D, and workforce development. Unlike conventional organizations, CNIs are prime targets for a broad spectrum of threat actors.

The consequences of cyberattacks go beyond economic and reputational damage, threatening national security by destabilizing critical sectors such as energy, financial markets, and healthcare. With rising geopolitical tensions amplifying both the frequency and sophistication of attacks, CNIs must take a leading stance in fortifying cybersecurity to mitigate disruptions that could have far-reaching implications.

Can you provide an overview of the current cybersecurity landscape for critical infrastructure in the MEA region?
The interconnected nature of critical infrastructure means that a weakness in one part of the supply chain can expose the entire ecosystem to cyber threats. The cybersecurity landscape for CNIs in the MEA region is shaped by sector-specific challenges across industries such as energy, telecommunications, healthcare, financial services, and public services. While each sector has unique vulnerabilities, common challenges persist, including workforce shortages, skills gaps, increasing regulatory pressures, rapid digitization, and heightened supply chain risks.

The global shortfall of 2.8 million cybersecurity professionals has left CNIs struggling to attract and retain talent, with critical positions such as cybersecurity leadership, architecture, and cloud security often remaining unfilled. Addressing this requires sustained investment in workforce development and alternative strategies to bridge expertise gaps.

National cybersecurity authorities are intensifying regulatory pressure by implementing sector-specific frameworks to strengthen cyber resilience. While foundational policies such as the ECC in KSA and Qatar’s Cyber Security Framework of 2022 provide a compliance baseline, additional regulations focusing on OT security, third-party risk management, and cloud governance are expected.

CNIs that operate internationally must also comply with overlapping regional and global requirements, adding complexity to their cybersecurity obligations. Meanwhile, rapid digitization is further expanding the attack surface. Financial institutions are focusing on digital customer touchpoints, while energy companies are integrating IT and OT environments—introducing new threats into previously isolated systems. IT/OT convergence makes cybersecurity not just a technological issue but also a health and safety risk with potentially severe consequences.

Supply chain vulnerabilities are becoming a growing concern, as cybercriminals increasingly exploit third-party vendors and cloud services to enter CNI networks. The interconnected nature of critical infrastructure means that a weakness in one part of the supply chain can expose the entire ecosystem to cyber threats. As attacks become more sophisticated, prioritization of proactive cybersecurity strategies , must be front and center , balancing compliance, workforce development, and digital resilience to safeguard national security and operational stability must be at the core.

What are the most notable trends in cyber attacks targeting these systems?
Several key trends are shaping the cyber threat landscape for CNI, including the commoditization of cyber-attacks, the rise of AI-supported threats, and the growing sophistication of well-funded, highly organized threat groups. The commoditization of cyber-attacks has made malicious activity more accessible and cost-effective than ever. Cybercriminals have become highly structured, operating like corporations, with hacking-as-a-service becoming a viable and increasingly prevalent business model. This has lowered the barrier to entry, enabling a wider range of actors to execute complex attacks.

AI has emerged as a double-edged sword—while it enhances cybersecurity defenses, it also provides attackers with powerful tools for automation, scripting, and deception. AI-assisted attacks allow individuals with limited expertise to carry out cyber intrusions that would have previously required specialized skills. Deepfake phishing, in particular, has surged, leveraging AI to create highly convincing fraudulent content across written, voice, and video formats, increasing the risk of social engineering attacks.

In addition, highly resourced and strategically motivated cyber groups are targeting CNIs to disrupt services, spread disinformation, or steal intellectual property. These adversaries often operate with long-term objectives and access to advanced capabilities, making them some of the most formidable threats to critical infrastructure. With cyber threats evolving in scale and sophistication, CNIs must continuously adapt their security posture to counter these emerging risks effectively.

How important is employee training and awareness in preventing cyber-attacks on critical infrastructure?
Employee training and awareness are fundamental to strengthening cybersecurity defenses for CNI. BCG research on major data breaches indicates that more than two-thirds result from organizational, process, or human failures—not technology—underscoring that people are the true first line of defense against cyber threats. Both structured training and ongoing awareness initiatives are essential to building a resilient security culture within CNIs.

Training equips employees with the necessary skills to identify and respond to cyber threats effectively. Foundational cybersecurity training should be mandatory for all employees, covering basic concepts and common risks. Leadership teams require additional insights into targeted threats such as fraud and impersonation, ensuring they can make informed decisions in high-risk scenarios. For technical personnel, continuous upskilling is critical, as staying ahead of emerging attack vectors can mean the difference between mitigating and succumbing to a breach.

Beyond training, awareness programs play a vital role in reinforcing cybersecurity best practices and fostering vigilance. CNIs implement initiatives such as phishing simulations to sensitize employees to real-world threats and drive behavioral change. At the executive level, cyberattack simulations help leaders assess their crisis response capabilities, ensuring that cybersecurity accountability is embedded at the highest levels of the organization, including the boardroom. Given the evolving threat landscape, investing in both training and awareness is not optional—it is a strategic necessity for safeguarding critical infrastructure.

What role does proactive information sharing play in securing critical infrastructure systems?
Proactive information sharing is a critical enabler of cybersecurity resilience for CNIs, significantly enhancing their ability to detect, prevent, and respond to threats. The sheer scale of incidents that security teams handle—sometimes exceeding a million per week in large CNIs—makes identifying real threats akin to searching for a needle in a haystack. On average, it takes nearly 300 days globally to detect a breach, and even mature organizations still require about 30 days to do so—far too long for a malicious actor to operate undetected within a network. Information sharing transforms one organization’s detection into another’s prevention (as noted by James Scott, co-founder of the Institute for CNI Technology.)

Beyond improving detection, effective information-sharing frameworks drive business value by preventing costly cybersecurity incidents. They help CNIs mitigate financial losses from system downtime, customer attrition, and reputational damage. Furthermore, sharing intelligence strengthens the entire ecosystem, advancing cybersecurity maturity across industries. Critical information exchanged within these networks includes indicators of compromise, best practices for mitigation, and standardized frameworks for secure data-sharing protocols.

Regulators play an essential role in fostering collaboration among CNIs, expanding cyber threat intelligence, and strengthening collective resilience. Their initiatives support defensive capabilities, improve incident response, and encourage secure collaboration while safeguarding data privacy. As cyber threats grow in complexity, CNIs must embrace a cooperative approach—leveraging shared insights to bolster defenses and minimize risk exposure across the sector.

What role do MEA governments play in regulating and enforcing cybersecurity standards for critical infrastructure?
MEA governments are implementing comprehensive cybersecurity regulation and enforcement frameworks for critical infrastructure, responding decisively to an increasingly complex threat landscape. Through empowered national cybersecurity authorities with cross-sector mandates, they are establishing rigorous governance structures that address the interconnected nature of modern cyber risks.

This strategic approach is evidenced by Qatar’s detailed National Cyber Security Strategy 2024-2030 and the UAE’s decisive 2023 Critical Information Infrastructure Protection Policy, which integrates critical infrastructure protection with national security imperatives while ensuring the continuity of essential services vital to economic stability. The MEA region has developed a sophisticated model of regional cybersecurity collaboration, establishing robust mechanisms for threat intelligence sharing and coordinated defense capabilities. Saudi Arabia demonstrates this through its stringent mandatory compliance framework for CNIs, implementing Essential Cybersecurity Controls (ECC) alongside sector-specific regulations that address emerging technical and operational risks.

This systematic approach extends to building critical security capabilities, as shown by initiatives like Saudi Arabia’s Women Empowerment in Cyberspace (WEC) program, which strengthens the region’s cybersecurity talent base while addressing crucial skill gaps in critical infrastructure protection. These coordinated efforts reflect the MEA governments’ clear understanding that effective critical infrastructure protection requires both strong national frameworks and deep regional cooperation to address evolving cyber threats.