Roundtable Roundup: Technological Infrastructure Security in the Gulf

On 8 September 2026, the Observer Research Foundation Middle East convened a private roundtable with industry experts as part of its ‘Market to Policy’ series to examine the growing strategic importance of technological infrastructure in the Gulf. The session covered the physical and digital dependencies that make this infrastructure strategic and the measures needed to strengthen resilience against geopolitical, cyber, kinetic, and supply-chain disruption.

Digital infrastructure now underpins most civilian digital services, including banking applications, telecommunications, healthcare, and critical industries. Subsea cables carry about 99 percent of international data traffic, making them essential to global economic and government activity, while data centres provide the compute and storage on which cloud services and artificial intelligence (AI) depend. For the Gulf, heavy investments in cloud computing, AI infrastructure, data centres, and digital government promise greater compute capacity and economic diversification, but must be matched by resilience and security measures that protect the physical and digital foundations of these services.

Against this backdrop, the discussion examined how Gulf governments should define and protect strategic technological infrastructure, manage global supply chain dependencies, and coordinate resilience-building efforts between public and private actors.

Challenges and Considerations

Technological infrastructure has become strategic infrastructure, requiring resilience to be treated as a national-security objective

Participants argued that the distinction between commercial digital infrastructure and strategic infrastructure is increasingly difficult to sustain. Subsea cables, data centres, cloud platforms, and computing infrastructure support private businesses and consumer services, but also underpin online banking, communications, healthcare, transport, emergency services, and other essential public functions. Failures in this infrastructure can therefore affect entire cities and economies, not only individual companies.

The discussion highlighted two interconnected categories of risk: physical and cyber. Recent kinetic attacks on Gulf technological infrastructure amid geopolitical disruption, alongside the susceptibility of subsea cables to occasional accidental damage, show how single points of failure can cascade across interconnected systems and disrupt essential services far beyond the infrastructure initially affected. Participants also stressed that cyber exposure should not be overlooked amid heightened concern over physical threats, particularly given reports of cyberattack attempts rising from 200,000 to as many as 700,000 a day in the United Arab Emirates (UAE) after tensions erupted in February 2026. Yet, systemic disruption does not necessarily require a hostile attack. The human element remains a primary factor in cybersecurity incidents, with human involvement present in 62 percent of breaches in 2026. Faulty or outdated software is another prominent source of disruption, as the 2024 CrowdStrike incident showed when it interrupted aviation, healthcare, and financial services. Since both kinetic and cyber-induced interruptions can rapidly cascade across sectors and essential services, business continuity, recovery planning, and redundancy capacity are essential to contain failures and rapidly restore services.

For Gulf states undergoing massive digital infrastructure and AI/data centre build-outs, infrastructure planning should therefore focus not only on adding capacity, but also on sustaining service availability during severe disruption. Participants suggested that service continuity should become a strategic metric alongside infrastructure expansion, supported by redundancy, alternative routes, backup systems, and scenario planning for low-probability, high-impact events.

2. Digital sovereignty should focus on managing strategic dependencies rather than attempting complete technological self-sufficiency 

The discussion also examined the growing emphasis on “sovereign” technology stacks and domestic control over critical technologies. Participants agreed that geopolitical competition and supply-chain disruption make it increasingly important for governments to understand where strategic dependencies exist. However, they questioned whether complete technological sovereignty is realistic within globally distributed supply chains.

Semiconductors illustrate the challenge. Organisation for Economic Co-operation and Development (OECD) analysis shows that China, Chinese Taipei, Korea, Japan, and the United States (US) account for close to 90 percent of global semiconductor wafer-fabrication capacity. This concentration among a relatively small number of firms and geographies creates bottlenecks that can amplify disruption and limit access for downstream industries and importing economies during supply shocks. These concentrations are unlikely to be broken in the near term because building a competitive semiconductor manufacturing or research base requires very large upfront investment—around US$23 billion for a leading-edge fabrication plant—and a highly specialised engineering workforce, which few countries possess. Participants therefore suggested that resilience built around managing ‘strategic dependency’ may offer a more useful framework than seeking technological ‘sovereignty.’ Governments could identify where concentrated external dependencies pose unacceptable risks and determine where diversification, redundancy, domestic capabilities, or alternative partnerships are required, rather than attempting to reproduce every stage of the technology stack domestically.

For the UAE and other Gulf countries, participants noted that strong international relationships, growing technological capacity, and substantial investment resources have secured comparatively broad access to global technology ecosystems. They argued that this position could also enable the UAE to become an important technology and infrastructure partner for middle powers and emerging markets with less predictable access to advanced computing infrastructure. South Korea and Japan were identified as particularly relevant partners because of their roles in semiconductor and other technology supply chains. Stronger ties with such ‘nodal’ economies could help Gulf states diversify dependencies while opening new corridors for investment, infrastructure, and knowledge exchange. 

3. Resilience requires coordinated governance, stronger business continuity planning and public-private cooperation

Responsibility for technological infrastructure resilience in most countries is spread across telecom regulators, cybersecurity authorities, critical infrastructure bodies, defence institutions, and private operators. Participants therefore argued that the central challenge is not necessarily assigning the issue to one institution but ensuring that the relevant agencies can coordinate effectively across overlapping risks.

The ownership structure of digital infrastructure further complicates resilience planning. Technology companies now play a leading role in financing new submarine cable infrastructure, while cloud providers, telecom operators, and data-centre companies control other strategically important assets. National resilience therefore depends partly on commercial decisions made by private companies. Participants argued that Gulf Cooperation Council (GCC) governments should continue to create clear incentives for operators to maintain redundancy and repair capability and business-continuity arrangements in the region, especially as new cable projects such as Meta’s Project Waterworth bypass the Strait of Hormuz. For submarine cables, this could include improving repair permissions, encouraging route diversity, and ensuring operators remain able and willing to support regional infrastructure during periods of heightened risk. Governments and companies should also be prepared to reroute connectivity, data, and physical technology supplies when infrastructure or supply chains are disrupted. 

Policy Recommendations

1. Recognise digital infrastructure as strategic and make service resilience a national metric 

Gulf governments should incorporate subsea and terrestrial connectivity, data centres, cloud systems, and critical AI infrastructure into national resilience planning. Performance should be assessed not only by capacity added or capital invested, but also by the ability to maintain essential services during physical, cyber, and geopolitical disruption.

2. Manage strategic dependencies through diversified international partnerships

Rather than pursuing complete technological self-sufficiency, Gulf states should map concentrations across critical technology supply chains and develop targeted strategies to mitigate the most consequential dependencies. This should include diversifying suppliers, deepening partnerships with technology-producing economies, and investing domestically where external dependencies create significant future supply-chain risks. 

3. Strengthen public–private resilience planning

Governments should establish clearer resilience and continuity expectations while creating incentives for private infrastructure owners to invest in the maintenance, repair, and redundancy of critical technological infrastructure. Regular contingency exercises involving governments, telecom operators, cloud providers, data-centre companies, and cable owners could help identify vulnerabilities before a crisis occurs 

Conclusion

The Gulf region’s emergence as a hub for digital connectivity, cloud computing, and AI infrastructure creates significant economic opportunities, but also increases dependence on the physical and technological systems that support its digital economies. As this dependence grows, failures affecting connectivity, compute, or data infrastructure in a single location can increasingly become economy-wide events.

Building resilience will require more than protecting individual assets. Gulf governments will need to address vulnerabilities across supply chains, physical infrastructure, and cybersecurity architecture to protect interconnected ecosystems. Complete technological self-sufficiency is unrealistic; managing strategic dependencies, building redundancy, and strengthening international cooperation with other nodes in the global technology supply chain offer a more practical path.

For the UAE and its neighbours, geography remains both a source of risk and a strategic advantage. Although recent tensions have exposed the vulnerability of infrastructure concentrated around regional choke points, demand for digital infrastructure investment and international technology partnerships remains strong. So, too, does the will of the public and private sectors to build out the region’s technology ecosystem. By diversifying infrastructure corridors, strengthening partnerships with technology-producing economies, and improving public–private contingency planning, the Gulf can strengthen its position not simply as a leading consumer of digital infrastructure, but as a resilient node connecting technology ecosystems across Europe, Asia, and Africa.

Elizabeth Heyes is Junior Fellow in Emerging Technologies, ORF Middle East. 

The author acknowledges the use of ChatGPT 5.6 to generate a draft outline for this paper.