The Rising Importance of Cybersecurity in Saudi Arabia’s Economic Landscape
A Personal Journey into OT Cybersecurity
My journey into OT/ICS cybersecurity began in Saudi Arabia, a country closely associated with critical infrastructure and industrial innovation. In 2012, after years in control systems and automation engineering, I moved into a regional control-system migration role. The work drew on asset-owner experience, engineering design and multi-system knowledge to support live modernization projects while developing local engineering capability.
Just weeks into this role, the Shamoon malware, also known as DistTrack, disrupted major energy companies in the region. This attack is considered one of the largest cyber assaults on the energy sector, impacting over 30,000 systems. Although it primarily affected IT networks, the implications were far-reaching. For me, the Shamoon attack underscored the urgent need for specialized OT cybersecurity practices. It played a critical role in shaping the OT cybersecurity landscape, even influencing OEMs to prioritize security in their solutions.
During this period, I saw firsthand the differences between IT and OT cybersecurity. Evaluating enterprise-focused remediation in a DCS context showed that controls not validated for industrial systems can introduce operational risk. The experience reinforced the need for an OT cybersecurity approach that reduces exposure without compromising control-system integrity.
During the next several years, I supported control-system modernization and emerging OT cybersecurity work across major industrial and utility environments in Saudi Arabia. Those experiences shaped my understanding of how cybersecurity must align with engineering, operations and the Kingdom's critical-infrastructure priorities.
In August 2024, the National Cybersecurity Authority (NCA) of Saudi Arabia released its Report on Key Economic Indicators in the Cybersecurity Sector for 2024. Here are my takeaways and thoughts about the report, along with some recommendations from my point of view: (Figures below are drawn from that NCA report and are quoted with attribution; consult the report for definitions and methodology.)
Cybersecurity Market Dynamics in Saudi Arabia
In recent years, Saudi Arabia has seen remarkable growth in its cybersecurity market, with total spending on cybersecurity products, solutions, and services reaching SAR 13.3 billion. This expenditure is split between government entities and the private sector, with the latter contributing nearly 69% of the total.
The Kingdom’s strategic objectives have driven this focus on cybersecurity, prioritizing the protection of critical national infrastructure. Government entities alone account for SAR 4.1 billion of the expenditure, reflecting the state’s commitment to securing its digital assets. Meanwhile, private sector entities, especially those owning, operating, or hosting critical infrastructure, have also increased their investment in cybersecurity, spending around SAR 2.8 billion.
Saudi Arabia hosts globally significant oil, gas and petrochemical operations. Earlier control-system modernization experience in the region reinforced how closely cybersecurity must be coordinated with engineering change, operational continuity and national resilience.
Geographical Concentration of Demand and Supply
Cybersecurity demand in Saudi Arabia is concentrated in three key regions: Riyadh, Makkah, and the Eastern Region. These regions account for 83% of total demand, reflecting their economic importance and the concentration of critical infrastructure.
On the supply side, Riyadh leads as the hub for cybersecurity providers, hosting 72% of registered entities. This centralization aligns with Riyadh’s role as the capital and economic heart of the Kingdom. The Makkah and Eastern regions follow, housing the remaining significant share of providers. Notably, many OT service providers and OEMs originally based in the Eastern Province have moved their headquarters and leadership to Riyadh, driven by national incentives.
Market Segmentation and Key Players
The Saudi cybersecurity market is divided into products, solutions, and services. Products and solutions make up 56% of the market, valued at SAR 7.5 billion. These include Managed Security Operations Centers, Cloud Security, Network Security, and Endpoint Security and Management. Services, which account for 44% of the market, are valued at SAR 5.8 billion and include activities such as cybersecurity system integration and managed services.
The sector is supported by a diverse range of providers, with small and micro-sized enterprises dominating the landscape. Of the 353 registered cybersecurity providers, 77% are small, and 9% are micro-enterprises. This distribution highlights the role of small and medium-sized enterprises in driving innovation and addressing niche cybersecurity needs within the Kingdom.
Economic Contribution of the Cybersecurity Sector
Beyond its role in national security, the cybersecurity sector is significantly contributing to Saudi Arabia’s economy. The sector contributes SAR 15.6 billion to the Kingdom’s GDP, representing 0.39% of the total GDP and 0.81% of the non-oil GDP. This economic contribution is split between direct contributions (SAR 8.6 billion) and indirect and induced contributions (SAR 7 billion).
The growth of the cybersecurity sector is vital for protecting Saudi Arabia’s digital infrastructure and for diversifying the economy under Vision 2030. Cybersecurity is becoming increasingly important in driving economic growth and creating high-value jobs.
Building a Cybersecurity Workforce
A key factor in the growth of the cybersecurity sector is the development of a skilled workforce. The report highlights that the sector employs 19.6 thousand specialists, with women making up 32% of the workforce. This participation reflects the Kingdom’s broader efforts to enhance female participation in the workforce, in line with Vision 2030 goals.
The focus on developing a robust cybersecurity workforce is further supported by initiatives aimed at enhancing education and training. These efforts are essential for ensuring that the Kingdom has the talent necessary to sustain its cybersecurity infrastructure and support the sector’s continued growth.
Strategic Insights and Future Directions
The findings of the report provide a strategic tool for decision-makers in the Kingdom. The detailed analysis of market trends, economic contributions, and workforce development offers a comprehensive understanding of the current state of the cybersecurity sector and its future direction.
As Saudi Arabia continues to prioritize cybersecurity, both public and private sector entities must align their strategies with national objectives. By doing so, they can protect their assets and contribute to the broader goals of national security and economic resilience.
Recommendations for NCA
The National Cybersecurity Authority of Saudi Arabia has made significant progress in OT cybersecurity with the Operational Technology Cybersecurity Controls (OTCC-1:2022). These controls, aligned with global standards like ISA/IEC 62443, are designed to secure critical infrastructure with comprehensive guidelines on governance, defense, resilience, and third-party cybersecurity.
However, the NCA should recognize that OT cybersecurity service providers face unique challenges compared to IT providers. Applying the same regulations regarding company size and local employee requirements may not be suitable for OT cybersecurity. Adjusting these rules to accommodate the operational realities of OT providers would support more effective security measures in critical infrastructure.
Furthermore, while the OTCC framework is robust, there is room for enhancement by incorporating emerging technologies like AI and ML and integrating real-world case studies from within Saudi Arabia. These additions would provide valuable insights and reinforce the Kingdom’s leadership in OT cybersecurity.
Call to Action
If you are an asset owner looking to design or execute your cybersecurity program to meet specific compliance requirements, or if you are an OT cybersecurity vendor or service provider seeking to expand beyond your traditional market, I am here to support your growth. Feel free to contact me for guidance and assistance in navigating new opportunities.