For half a century, anxieties around the Strait of Hormuz, the world’s most important energy chokepoint, were about whether tankers could get through. Soon after the United States and Israel began their war against Iran on February 28, that fear was realized, and shipping collapsed within days. But Iran’s closure of the strait was expected and ultimately the least imaginative thing it would do.
In fact, the instructive damage happened away from the water: A GPS spoofing campaign threw more than 1,100 vessels off their positions in a single day. Drones hit Amazon Web Services data centers in the United Arab Emirates (UAE), the first confirmed military strike on a hyperscale cloud provider, and the outage ran into banking apps and payment platforms. A wiper attack reset more than 200,000 devices at the US medical-technology firm Stryker, delaying surgeries. Iranian projectiles struck power and desalination plants in Bahrain and Kuwait, which draw about 90 percent of their water from the sea. And across the UAE, the daily volume of cyberattacks tripled to 600,000.
As one Emirati official observed, too many people “look at this conflict only through the standpoint of aircraft, fighter jets, missiles, and drones.” Indeed, the war is a stress test of the Gulf’s operating model, which is premised upon stability and prosperity in an otherwise troubled region, and the model has been pressured in places oil export volumes or missile-and-interceptor numbers cannot show. The deepest vulnerability was not in any single outage but in the way the outages traveled: the blow to the data centers landed on the banks; the threat to the strait landed on insurance premiums; the attack on potable water landed on the legitimacy of the state that promised it.
SIGN UP FOR THIS WEEK IN THE MIDEAST NEWSLETTER
The threat to the Gulf functions as more of a “kill-web” than a line or chain; a blow in any one area impacts the others by design. Because global markets price the region continuously, through war-risk insurance premiums, sovereign credit spreads, oil futures, and the confidence of the foreign capital the Gulf depends on, a single strike can become a cascade, the loss in confidence it creates outrunning the service it interrupts. Gulf countries therefore must each build resilience as a single architecture across every layer that can be weaponized, and not as a set of separate hardening projects in isolation.
Striking the bargain
In many ways, the Gulf states pose an unusually hard problem for the task of building resilience, for reasons that interlock. The specific nature of the bargain that holds these states together means that consent of the people rests overwhelmingly on the distribution of resource wealth and the delivery of services. Because rentier monarchies fund the citizen through subsidized water, power, and jobs, what an adversary seeks most to interrupt is delivery, not capacity, targeting the material basis of the ruling settlement itself. Thus, while Iran inflicted pain on Gulf leaders in the hope that they would pressure the US to deescalate, there was an added dimension to its coercion. This extended beyond counter-force targeting, aimed at military sites, or counter-value targeting, directed at cities and civilians, towards counter-legitimacy targeting, aimed at hitting and destabilizing the bargain between ruler and citizen.
At the same time, the Gulf has staked its post-oil future on a particular narrative about the region, and the story is itself an asset that can be attacked. Saudi Arabia’s Vision 2030 and its regional analogues can be damaged without contact, by making a prestigious project look uninsurable, unfundable, or merely uncertain. In addition, the Gulf Cooperation Council (GCC) is a rare set of states whose primary instrument of power is capital rather than arms. The sovereign wealth funds of the six members hold on the order of $4 trillion–$6 trillion, generating outsized global influence, but also a surface on which an adversary can potentially operate, turning the Gulf’s overseas capital into a channel for inflicting stress at home.
Furthermore, national resilience means something different where native citizens are a demographic minority and the workforce is overwhelmingly foreign. In the UAE and Qatar, foreign nationals make up roughly seven in eight residents. This demographic inversion means that adversaries can force a labor shortage by applying pressure through remittance channels, narrative operations aimed at particular expatriate communities, and a climate of fear for skilled professionals on whom diversification depends, such that they will quietly decide the place no longer feels safe and leave.
Finally, the Gulf states hedge in different directions; disagree over each other’s adventurism abroad and over relations with Turkey, Iran, and Israel; and diverge on oil policy. The resulting fractures generate a set of seams an adversary can widen. Even at this moment, a shock on the Strait of Hormuz does not fall evenly on the GCC. Saudi Arabia and the UAE operate pipelines that can move crude around the strait, while Kuwait, Qatar, and Bahrain remain effectively captive to it—an asymmetry Iran could look to drive a wedge through.
A reflexive threat
Another feature of the Gulf’s vulnerability is that the realms an adversary might seek to attack—whether energy, data, water, finance, cyber, or narrative—often behave as one system. For example, sovereign compute, the bet the Gulf has placed on its future, sits inside a closed triangle: a gigawatt-scale campus is a vast electrical load whose servers must be cooled with water, in a desert, drawn from power-hungry desalination. The region has built buffers against this, from the GCC interconnected grid to backup generation and multi-day water reserves, but those buffers are finite, run through the same coupled system, and were sized for accidents rather than sustained coercion. Because a strike on the grid is a strike on water, and a strike on water is a strike on compute, an adversary who keeps pressure on any one leg long enough to exhaust the buffers can black out a national artificial intelligence (AI) campus without touching a server.
Similarly, when Iranian drones struck two Amazon Web Services data centers in the UAE, the effects cascaded into the mobile apps of major banks including Emirates NBD and First Abu Dhabi Bank, knocked payment platforms offline, and took down the ride-hailing and delivery services that residents use every day. Incidentally, those attacks revealed that the logic of data localization, pursued across the Gulf as a route to digital sovereignty, had concentrated rather than dispersed the risk, gathering a nation’s banking, government, and consumer services into a handful of physical buildings whose destruction could jeopardize them at once.
Furthermore, the strait carries data as well as oil, and AI campuses need connectivity. In April, the Islamic Revolutionary Guard Corps–linked Tasnim agency published a detailed map of the undersea cables and cloud infrastructure threading the Gulf, which was interpreted as a warning that the region’s digital backbone now sat within Iran’s reach. However, Iran need not go so far as to sever a cable when it can hold the repair fleet hostage. On March 12, Alcatel Submarine Networks, the French state-owned firm contracted to lay Meta’s 2Africa Pearls cable, declared force majeure and suspended operations in the Gulf, stating that it could no longer work there safely. The extension, intended to connect the Gulf states, Iraq, Pakistan, and India, had most of its cable laid but not yet connected to its onshore landing stations, and it is now stalled indefinitely.
“Sovereign resilience web”
The response to all this cannot be to fix each vulnerability individually, because a list of remedies rebuilds the silos an adversary exploits.
By contrast, we propose that each Gulf state develops is own Sovereign Resilience Web, one architecture involving a common standard for technical controls, a dedicated institution, financing with a domestic mission, and shared strategic reserves. This architecture needs provenance for every data flow and model, and strict identity governance, since the Stryker attack revealed how one set of credentials can cause chaos. The Sovereign Resilience Web also requires a fusion cell that recognizes a desalination strike, a cable fault, a bank outage, and a viral fake as moves in one campaign. Gulf countries also need to set up a resilience bond that channels both sovereign wealth and aligned private capital into multi-domain resilience and ties its returns to measurable reductions in systemic exposure. And Gulf countries should start working toward a coalition response, perhaps beginning where the gains are largest and the dilution of sovereignty is less of a concern, in areas such as shared water grids, cable repair fleets, compute fail-over, and pooled war-risk cover.
However, because the Gulf is watched constantly, publicizing a new redundancy also announces the location of the weakness giving fear. Thus, Gulf countries should be cautious about advertising their sovereign resilience strategies.
The war with Iran is best read not as an episode but as a preview. Every vector touched upon here will be available again, cheaper and faster, and several threats that the war only hinted at will mature into the central problems of the next decade. Absent a comprehensive accommodation between the Gulf states and the regime in Tehran, the Gulf is likely to inhabit a gray-zone equilibrium, a steady state of intermittent spoofing, periodic cyber operations, opportunistic cable and pipeline harassment, and quasi-formalized coercion exemplified by Iran’s bid to toll the strait. The choice ahead is not between vulnerability and invulnerability, which no state on contested ground can achieve, but between a costlier version of today’s exposure and a real architecture that defends the Gulf’s infrastructure and its story together.
Alia Brahimi is a nonresident senior fellow with the Scowcroft Middle East Security Initiative and the North Africa Initiative at the Atlantic Council’s Middle East programs, and the writer and host of the Guns for Hire podcast.
John James is a nonresident senior fellow with the Scowcroft Middle East Security Initiative and a technologist, deep-tech investor, and founding partner of BOKA Capital Ltd, which holds investments across defense and national security technology.
Further reading
Wed, Jul 15, 2026
Dire straits: No way out of Hormuz
EnergySource By David L. Goldwyn, Andrea Clabough
With no sign of a lasting breakthrough in the US-Iran war, officials must plan now for an extended energy crisis.
Thu, Jul 2, 2026
A misguided war, a flawed deal, and a dangerous future. Here’s what to do next on Iran.
The Big Story By William F. Wechsler
Trump should embrace a new negotiating approach, a new emphasis on regional security and deterrence, and a new commitment to preparing for the future.
Tue, May 19, 2026
After the Iran war, the Gulf’s next economic phase awaits
MENASource By Khalid Azim
The region is no longer defined by a single economic model based on energy extraction, but by a set of diverging strategies shaped by common constraints.
Image: Smoke billows from Jebel Ali port after an Iranian attack, following United States and Israel strikes on Iran, in Dubai, United Arab Emirates, March 1, 2026REUTERS/Raghed Waked