Fortinet and Aramco sign MoU on industrial cybersecurity in Saudi Arabia
Fortinet and Saudi Aramco have signed a memorandum of understanding outlining potential collaboration on operational technology (OT) cybersecurity in Saudi Arabia. The agreement covers four broad areas: cybersecurity research and development, the localisation of security solutions for industrial environments, possible deployment of Fortinet's cloud services within the Kingdom, and talent development through bootcamps, workshops, and access to Fortinet's training platforms.
The MoU is framed as an exploratory framework rather than a binding contract. Neither party disclosed financial terms, project timelines, or specific technical deliverables, and much of the language in the announcement is conditional, describing what the two organisations "intend to explore" rather than what they have committed to deliver.
Joe Sarno, Executive Vice President of International Sales at Fortinet, said: "Securing critical infrastructure requires more than technology. It also depends on strong local expertise, continuous innovation, and collaboration."
Abdul Aziz S. Al Shafi, Aramco's Vice President of Cybersecurity and Chief Information Security Officer, described the agreement as reflecting "Aramco's commitment to advancing industrial cybersecurity" while growing local expertise.
OT security: a high-stakes battleground
Industrial control systems and OT environments have become a priority target for state-sponsored threat actors and ransomware groups over the past several years, with energy infrastructure a particular focus. The 2017 TRITON/TRISIS attack, which targeted safety instrumented systems at a Saudi petrochemical facility, remains one of the most technically sophisticated ICS attacks on record and has shaped investment priorities across the Gulf's energy sector ever since.
Fortinet competes in the industrial cybersecurity space alongside Claroty, Dragos, Nozomi Networks, and Palo Alto Networks, all of which have been expanding their OT-specific portfolios. The convergence of IT and OT networks, driven partly by digitalisation programmes such as Saudi Vision 2030, has widened the attack surface at facilities like Aramco's and increased demand for vendors able to operate across both domains.
Saudi localisation and the Vision 2030 backdrop
The MoU's emphasis on localisation is consistent with Saudi Arabia's broader industrial policy. The Kingdom has made domestic technology capability a central pillar of Vision 2030, with regulators increasingly requiring that cloud services and critical data be hosted within Saudi borders. The potential deployment of Fortinet cloud services inside the country, mentioned in the announcement, would align with those requirements and with the National Cybersecurity Authority's localisation guidance for operators of critical infrastructure.
Talent development is a parallel priority. Saudi Arabia faces a well-documented shortage of qualified cybersecurity professionals, and programmes like the ones Fortinet describes, whether bootcamps or platform access for education, are consistent with NCA and CITC objectives to grow a domestic security workforce.
The agreement's breadth and its non-binding nature mean execution risk is real. Translating an MoU into deployed technology and measurable skills programmes will depend on regulatory approvals, procurement processes, and the pace of Aramco's own OT modernisation roadmap. Observers will watch for a follow-on announcement that names specific projects, delivery dates, or investment figures before treating this as a significant commercial win for either party.