The pipelines and terminals the Gulf built to bypass Hormuz are now under attack, and the standard for calling them redundant has changed. “Previously, it was often: how much oil can we move if Hormuz becomes unavailable? It now has to be: how much can we continue delivering if shipping, export terminals, and supporting infrastructure are disrupted together and repairs must take place under continuing threat?” Kristian Alexander, a geopolitical analyst and non-resident senior fellow at the Middle East Institute Switzerland, tells EnterpriseAM.

Attacks have hit both of the Gulf’s main bypass routes: An attack on a pumping station on Saudi Arabia’s East-West pipeline cut throughput by 700k bbl / d in April. Five months later, an aerial attack damaged three pumping stations, destroying one and forcing a major interruption. Drone attacks and interception debris also damaged storage tanks and repeatedly interrupted loading at Fujairah, the UAE’s principal outlet outside Hormuz.

Buried pipelines are relatively hard to hit, and damaged sections can generally be isolated. The vulnerable parts are the nodes that supply pressure, power, control, and access: the pumping stations that push crude through the line, the substations that power them, and the control rooms that regulate flows. At a terminal, one loading arm, berth, or electrical connection can limit exports even when barrels remain safely stored nearby.

IN CONTEXT- The East-West pipeline stretches across a corridor of about 1.2k km, so its pumping and support infrastructure is geographically dispersed. Fujairah concentrates critical oil-export functions in a compact terminal complex. The pipeline has many points to protect, and the terminal has valuable infrastructure in a small area.

Why they’re targets

Bypasses reduce vulnerability and move some of the remaining risk elsewhere, Alexander tells us. “They meaningfully reduce vulnerability, while redistributing some of the remaining risk. Both things can be true,” he notes. Without them, a disruption at Hormuz would leave Saudi Arabia and the UAE with fewer ways to preserve revenues and maintain deliveries.

“The important objective for Tehran is to change the strategic cost calculation of the other side,” Zeinab Nikookar, an affiliate researcher at London Dialogue and a PhD student in contemporary Iranian studies at the University of Tehran, tells us. Nikookar describes the strategy as “coercive bargaining through calibrated disruption.” The message, she says, is that military and economic pressure on Iran will not stay geographically contained, and that Iran can pass some of the costs of the confrontation to the global economy.

Layers of defense

A Patriot battery can’t sit beside every pump, so defense goes around the nodes whose loss would stop the flow. A military base can concentrate its defense around a perimeter, while an export network stretches across hundreds of kilometers of pumping stations, processing facilities, storage tanks, marine terminals, and offshore approaches. Patriot batteries also don’t create a uniform 360-degree shield, so defenses have to be placed around the most consequential vulnerabilities, in the direction the threat comes from.

Air defenses work in layers to save costly missiles:Long-range radars warn of incoming drones and missiles, local surveillance picks up low-flying drones that are hard to separate from background activity, electronic jamming can misdirect some, and guns and lower-cost interceptors cover the rest. The cost gap shows why: a Shahed-type attack drone is commonly estimated at USD 35k, against about USD 4 mn for a PAC-3 MSE interceptor for the Patriot. The two aren’t equivalent weapons, since the Patriot is built for much more capable threats, but an attacker can still force the defender to use scarce missiles, expose radar positions, or accept that some drones will get through.

Mixed salvos make that harder: Recent Houthi strikes have combined small drones, low-flying cruise missiles, and ballistic missiles, each approaching at different speeds, altitudes, and trajectories. The defender must detect and classify each target quickly enough to assign the appropriate response. A mixed salvo can overload sensors, split defensive attention, and force the launch of several types of interceptors at once.

The bill multiplies with every node: The US Congressional Budget Office estimates that equipping one representative military installation with layered defense against small drones would require around USD 74 mn upfront and USD 5 mn annually to operate. Protecting 100 independent locations using the same model would cost around USD 7.4 bn, plus USD 500 mn every year. The model is based on a military installation, but illustrates the cost of extending protection across an entire infrastructure network.

The Gulf is looking for a cheaper first shot: Saudi Arabia and the UAE have explored a Ukrainian-designed interceptor drone costing some USD 2.5k, with local production in the region discussed. This shift is commercially important, since missile stocks depend on overseas manufacturers, long procurement cycles, and the political willingness of a supplier state to release more during a conflict, while cheaper interceptors produced regionally would turn air defense into something closer to an industrial supply chain.

Cheaper interceptors don’t end the contest, because attackers adapt, Vincent Carchidi, defense industry analyst, tells us. “This is somewhat overstated in my view,” he says of commentary that treats low-cost technology as a universal solution.“The adversary will always find a weakness,” he adds, and Gulf states must prepare for a “shifting dynamic that even scalable, low-cost platforms in isolation can’t challenge alone.”

Interception is only the first layer, Alexander says. “No responsible infrastructure strategy should depend on perfect interception.” Even sophisticated defenses can be overwhelmed, so the next question is how to keep one successful strike from taking down a whole export route.

Limiting the damage

Pumping stations can be built to keep working with part of them damaged. Dividing a station into protected compartments keeps one impact from disabling all of it. Backup generators and duplicated controls keep essential operations running if the control room is lost, sectional isolation valves limit leakage and fire, and parallel pumps preserve some throughput if one unit is damaged.

A terminal fails differently from a pipeline, because everything it needs sits in one small area visible from space. Its tanks, pumps, power supplies, and loading equipment are inside a small fixed footprint shown in commercial satellite imagery, so resilience means limiting what one strike can reach. Separation and firebreaks reduce the risk of flames spreading between tanks, and alternative pumps and loading positions can keep a route from storage to at least one working berth. Once terminal storage fills, the operator has to reduce or stop incoming flows, which pushes the disruption back up the pipeline to production.

A second terminal is a real backup only if it has its own logistics system. Two terminals fed by the same pumping station, power supply, or control network don’t give two independent options, and a second port offers little protection if both routes share an anchorage, a maritime corridor, or an air-defense sector. The backup needs its own storage, electricity, control, loading arrangements, repair capacity, and maritime access.

Cyber defense is part of the same problem: Remote monitoring lets operators detect leaks, shut valves, and assess damage without sending crews into the area, and each additional piece of connected equipment adds another way in for cyberattacks. Adnoc’s publicly available process-control specifications (pdf) require industrial networks to be divided into security zones, with firewalls separating safety and control systems and a demilitarized zone between operational and corporate networks.

Spare no expense

When defense and containment both fail, the speed of repair is what remains. A pipeline or terminal that returns to service quickly is a different target from one that stays disabled for weeks, and the measure that counts is how long a disruption lasts and how much throughput comes back.

Aramco started a bypass around the destroyed pumping station within a day of the September strike. Satellite imagery showed bulldozers at work, and crude was moving again within days. Aramco says it has built “zero-hour” response teams, expanded emergency repair inventories, and deployed inspection drones that begin assessing damage while an incident is still unfolding, and about 90% of its repair materials are made locally or held in nearby warehouses, CEO Amin Nasser says. Large pumps, transformers, and control components can take months to manufacture and may be hard to import during shipping disruptions, so spares kept at several locations can keep a limited strike from becoming a prolonged shutdown.

Getting a terminal back in service takes more than fixing a tank or berth, Alexander says. “Protective design, fire containment, spare equipment, trained repair teams and emergency stocks outside the immediate threat area can limit disruption and speed recovery.” A restored tank or berth is no use while upstream pipelines are offline or ships can’t return to anchorage.

The bill

Four groups pay for protecting the Gulf’s export routes, and the split between them isn’t settled. Ministries fund radars and missiles, oil companies pay for duplicate equipment and repair capacity, ports fund security, and insurers price the remaining risk. “The state should be accountable for protection against military threats. The operator should be accountable for preparing the business to withstand disruption and recover safely. The boundary between them needs to be agreed before an emergency,” Alexander says.

Bloomberg Economics estimated Saudi Arabia allocated USD 64-96 bn to defense this year, while industry estimates put the UAE’s defense budget at around USD 27.2 bn. The Saudi figure is potentially more than twice Israel’s spending. “I suspect there will not be a general rule for economic feasibility,” Carchidi says. “What is more likely is that states will fall somewhere on a spectrum of infrastructure buildouts and air defense.”

An alternative route’s cost now includes a permanent security perimeter, spare capacity, and higher shipping and ins. charges. Construction cost and the transport tariff no longer measure it, and part of the cost will eventually reach the barrel. The state and its allies provide the air defense umbrella over Aramco’s and Adnoc’s routes. The companies can harden equipment and stockpile spares. Decades of reliance on western military power gave Gulf states access to advanced weapons and external protection, and also reduced the incentive to build every layer of combat capacity at home.

Cover story

Crude can’t leave a working terminal without ships willing to approach it, load, and depart safely. Pipelines can be pumping, and storage tanks remain intact, but exports still stop if no ship comes. Raising risk can disrupt exports without destroying anything, Nikookar says. She distinguishes between “physical disruption by an attack and functional disruption through secondary effects.” In her assessment, those secondary effects, such as raising war-risk premiums, discouraging crews and shipowners, delaying cargo, and making insurers unwilling to cover vessels approaching a port, may matter more strategically than the visible damage. “Risk becomes an instrument of coercion,” she says.

Offshore ship-to-ship transfers still depend on safe waters, available vessels, and working maritime services. They can provide flexibility when conventional loading routes are limited, and moving offshore may reduce reliance on a particular terminal without removing exposure to security threats. The chokepoint can reappear at any stage of the journey. It may be a disabled pumping station, a burning storage tank, an unusable berth, or a sea lane shipowners no longer use.

THE BOTTOM LINE- “Gulf resilience should be measured in sustained deliveries and recovery time, rather than kilometers of pipeline or the number of export terminals,” Alexander says. Another port or pipeline adds options and also another set of assets to protect for decades, so redundancy becomes a recurring defense commitment and no longer a one-off capital project. Dispersed infrastructure, layered defenses, and rapid repairs can make coercion less effective, but they can’t make Gulf energy assets untargetable while Iran and the Gulf states remain in a wider regional confrontation. Resilience limits the damage from each strike, and deterrence and de-escalation determine how many strikes there are.