Billions of dollars spent by Saudi Arabia on cutting edge Western military hardware mainly designed to deter high altitude attacks has proved no match for low-cost drones and cruise missiles used in a strike that crippled its giant oil industry.
Saturday's assault on Saudi oil facilities that halved production has exposed how ill-prepared the Gulf state is to defend itself despite repeated attacks on vital assets during its four-and-a-half year foray into the war in neighboring Yemen.
Saudi Arabia and the United States have said they believe Iran, the kingdom's arch-enemy, was probably behind the strike. On Tuesday, a US official said Washington believed the attack originated in southwestern Iran. Three US officials said it involved both cruise missiles and drones.
Tehran has denied such accusations, saying that Yemenis opposing Saudi-led forces carried it out. Yemen's Iran-aligned Houthi movement is alone in claiming responsibility.
Iran maintains the largest ballistic and cruise missile capabilities in the Middle East that could overwhelm virtually any Saudi missile defense system, according to think-tank CSIS, given the geographic proximity of Tehran and its regional proxy forces.
But even more limited strikes have proved too much for Saudi Arabia, including recent ones by Houthis who claimed successful attacks on a civilian airport, oil pumping stations and the Shaybah oilfield.
"We are open. Any real facility has no real coverage," a Saudi security source said.
The Sept. 14 assault on two plants belonging to state oil giant Saudi Aramco was the worst on regional oil facilities since Saddam Hussein torched Kuwait's oil wells during the 1990-91 Gulf crisis.
The company said on Tuesday that production would be back to normal quicker than initially feared, but the attack nonetheless shocked oil markets.
Riyadh said preliminary results indicated the weapons used were Iranian but the launch location was still undetermined.
Authorities initially specified drones, but three US officials said the use of cruise missiles and drones indicated a higher degree of complexity and sophistication than initially thought.
"The attack is like Sept. 11th for Saudi Arabia, it is a game changer," said a Saudi security analyst who declined to be named.
"Where are the air defense systems and the US weaponry for which we spent billions of dollars to protect the kingdom and its oil facilities? If they did this with such precision, they can also hit the desalination plants and more targets."
The main Saudi air defense system, positioned mainly to defend major cities and installations, has long been the US-made long-range Patriot system.
It has successfully intercepted high-altitude ballistic missiles fired by the Houthis at Saudi cities, including the capital Riyadh, since a Saudi-led coalition intervened in Yemen against the group in March 2015.
But since drones and cruise missiles fly more slowly and at lower altitudes, they are difficult for Patriots to detect with adequate time to intercept.
"Drones are a huge challenge for Saudi Arabia because they often fly under the radar and given long borders with Yemen and Iraq, the kingdom is very vulnerable," said a senior Gulf official.
Spate Of Attacks
Washington and Riyadh have blamed Iran and its proxies for a series of explosive blasts on tankers in Gulf waters, including two Saudi vessels in May, and attacks on Saudi oil assets.
Two oil pumping stations were hit that month. A transformer station near a desalination plant in Shuqaiq in the south was struck in June.
Those caused limited damage, unlike Saturday's strikes on Abqaiq and Khurais that damaged the world's biggest petroleum processing facility and knocked out 5.7 million barrels per day of production.
A Gulf source familiar with Aramco operations said the security system in place at Abqaiq is imperfect against drones. Authorities are investigating whether radar picked up the drones which struck in pre-dawn darkness, the source added.
An executive at a Western defense firm dealing with Saudi Arabia said that as of a year ago there were Patriots protecting Abqaiq.
Asked why Saudi defenses did not intercept Saturday's attack, coalition spokesman Col. Turki al-Malki told reporters: "More than 230 ballistic missiles were intercepted by coalition forces...we have the operational capacity to counter all the threats and protect the national security of Saudi Arabia."
The government media office did not immediately respond to a request for comment.
It is unclear if US-built short-range Avengers and medium-range I-Hawks and Swiss short-range Orelikons which the kingdom owns are currently operational.
Small But Effective
The Saudi security source and two industry sources said Riyadh has been aware of the drone threat for several years and has been in discussions with consultants and vendors for possible solutions but has not installed anything new.
The security source said authorities moved a Patriot battery to the Shaybah oilfield after it was hit last month. There are Patriots at Aramco's Ras Tanura refinery.
"Most conventional air defense radar is designed for high- altitude threats like missiles," said Dave DesRoches at the National Defense University in Washington.
"Cruise missiles and drones operate close to the earth, so they aren't seen because of the earth's curvature. Drones are too small and don't have heat signature for most radar."
Intercepting drones possibly worth several hundred dollars with Patriots is also extremely expensive, with each missile costing around $3 million.
Jorg Lamprecht, CEO and co-founder of U.S. airspace security firm Dedrone, said there are more effective ways of dealing with drones, especially in swarms.
A combination of radio frequency detectors and radar detect them, high-powered cameras verify payloads and technologies like jamming demobilize them, he said.
But the latest technology presents its own challenges: frequency jamming could disrupt industrial activities and have negative health effects on people.
Armed drones are becoming more readily available, so the threat to vital infrastructure is rising disproportionately, according to US intelligence consultancy Soufan Group.
Saudi policymakers have long dreaded a strike against a desalination plant in Jubail which serves central and eastern Saudi Arabia. A successful attack would deprive millions of people of water and could take a long time to repair, the Saudi source said.
"It's a very target-rich environment," said an industry source with knowledge of Saudi Arabia. "They've kicked them right where it hurts and there's plenty more of them around."