The 135 Strikes:
How Small Dependencies Put Giant Systems at Risk

The industrial system can survive physically and fail operationally

Can the loss of a few components stop a system worth thousands of times more? Yes—when those components provide indispensable functions and no usable alternative is ready. But that is a statement about dependency, not a measurement of destroyed wealth.

Reuters reported on October 15, 2026 that Iran and allied forces had struck at least 84 Gulf infrastructure sites at least 135 times since February 28. Its investigation described damaged LNG cooling equipment in Qatar and oil-routing equipment in the UAE, with wider operational disruption. Without site visits, the journalists could not always establish the full damage or air-defense effectiveness.^[1]

The useful engineering question is how to preserve essential services when equipment, suppliers or transport routes become unavailable. That question applies to conflict, fires, floods, manufacturing defects and ordinary breakdowns.

My perspective combines engineering with postgraduate supply chain training through MIT’s Graduate Certificate in Logistics and Supply Chain Management, GCLOG, in 2015–2016. The framework here is my present synthesis, supported by the cited research; it does not reconstruct particular lectures or imply MIT endorsement.^[2]

The price of the part, the value of the plant, and the cost of the outage

Imagine an industrial system with a $10 billion replacement value. A necessary component costs $5 million. If losing it stops the relevant production process, the system-to-component value ratio is 2,000 to one. The system may be unavailable while most of its capital remains physically intact.

Now assume customer supply cannot be maintained for 150 days and each uncovered day costs $2 million in contribution—the sales value left after avoidable variable costs. The modeled interruption exposure is $300 million, plus separately assessed repair and restart costs. It is neither the $5 million purchase price nor the $10 billion system value.

This arithmetic answers the central question conditionally. It does not establish a 2,000-fold destruction ratio for any reported attack. Actual losses depend on affected capacity, duration, inventories, substitution, contracts and whether delayed sales can later be recovered.

Three dots on a map may still be one operating system

A company can distribute production across several sites yet leave them dependent on the same upstream manufacturer, specialist repair team or support service. A second location protects against some local disruptions. It does not automatically create a second way to keep operating.

There are two different questions. Can the plant run? That depends on its operating services and equipment. Can the plant recover? That depends on replacement manufacturing, transport, compatible parts, documentation, skilled labor and commissioning. A firm may diversify the first network while concentrating the second.

Consider two approved vendors. If both obtain their essential subassembly from the same factory, there are two commercial relationships but one underlying supply dependency. Likewise, several spare units held in one exposed warehouse may provide inventory depth without geographic resilience.

Stop using spend as a proxy for importance

Procurement teams naturally spend time on large contracts. But a small purchase can be operationally decisive if it is mandatory, specialized and difficult to substitute. MIT’s work with Ford found that relatively low-cost components could create substantial disruption exposure; annual supplier spending was an unreliable guide to the resulting profit impact.^[4]

The 2015 research by David Simchi-Levi and colleagues offers a useful discipline: assess what a disruption would do before relying on difficult estimates of its probability. That helps direct limited mitigation resources toward consequential dependencies.^[3]

For an owner’s continuity review, ask what service would be lost, how much usable capacity would remain and what is required to restore it. Include second-tier suppliers and the repair chain. Keep the detailed dependency register within the organization; public discussion needs the design principles, not sensitive facility layouts.

A practical procurement specification should therefore cover interchangeability, alternate capacity, documentation, support life and demonstrated replacement time, alongside price and normal delivery performance. A low bid is incomplete if the purchase creates a long, exclusive recovery path.

Redundancy works only against the failures it actually separates

A backup needs enough capacity to carry the required service, a working transfer mechanism and support systems that remain available. Two devices can share power, cooling, software defects, maintenance errors or a physical hazard. The Nuclear Regulatory Commission’s common-cause framework explicitly recognizes multiple component failures arising from one shared cause and coupling mechanism.^[7]

The simple model shows why multiplying two failure probabilities can overstate protection. Its 5.95% result is not a prediction; it demonstrates how a shared event can dominate otherwise independent local failures.

These mechanisms can coexist. Safe design has to consider both the initiating loss and the dependencies that spread its consequences. A backup demonstrated during a quiet maintenance window may behave differently when utilities, staff and transport are simultaneously constrained.

The scarce resource may be time

For specialized equipment, placing an order does not immediately produce an interchangeable replacement. Engineering approval, production slots, materials, transport and installation can each constrain recovery.

The U.S. Department of Energy reported that order lead times, particularly for distribution transformers, increased from 3–6 months in 2019 to 12–30 months in 2023. These historical U.S. figures illustrate supply constraints; they cannot be assigned to a particular Gulf installation.^[5]

DOE also identified excessive variation in specifications as a barrier to faster production and supported greater interchangeability.^[5] The general design opportunity is to retain necessary performance requirements while questioning custom features that add little operating value but restrict replacement options.

A warehouse spare shortens recovery only if it fits, remains serviceable, can reach the site and can be commissioned. An untested substitute can merely move the delay from manufacturing to integration. Recovery planning should therefore finish with an acceptance test and a credible restoration schedule.

How long can supply continue—and how long does recovery take?

MIT’s supply chain risk framework distinguishes time to recover (TTR), the time needed to restore a disrupted node, from time to survive (TTS), how long the network can still match supply to demand after the disruption.^[6] For a non-specialist, think of the first as the repair clock and the second as the customer-coverage clock.

A plant may already be stopped while customers continue receiving goods from finished inventory. Conversely, a plant can restart while export logistics still prevent deliveries. Always specify which service the clock measures.

With 180 days to recover and 30 days of complete demand coverage, the uncovered interval is 150 days. A proven replacement path that restores service within 30 days could close that modeled gap. Additional stock can also help, but finite storage is an expensive answer to an indefinitely long recovery.

Use such a comparison to expose trade-offs, not to manufacture a precise forecast. Maintaining a tested spare, a second qualified supplier or reserved production capacity costs money. The decision is whether that ongoing cost is justified by the interruption it can prevent across credible scenarios.

Six ways to avoid a component becoming irreplaceable

Standardize interfaces; examine shared failure mechanisms. Interchangeable connections and clear specifications make substitution easier. But giving every facility the same uncorrected design defect or exclusive software dependency can concentrate risk. Standardization and diversity solve different problems and need to be applied deliberately.

A reported example of recovery preparation

In a separate Reuters interview published October 15, Aramco CEO Amin Nasser described specialized response teams, repair stockpiles and rapid damage assessment. He said about 90% of repair materials were produced locally or warehoused nearby.^[9] These are company-reported claims, not an independent audit. The strategic point is that recovery capability can be organized before an incident.

Local availability can reduce delivery time. It should still be tested against correlated regional disruption. The useful combination may be nearby ready stock, a more distant replenishment source and explicit access to both.

Make the recovery curve the scorecard

Counting damaged structures answers a physical question. Measuring reliable output over time answers an operational one. NIST’s resilience guidance connects infrastructure performance and dependencies to the recovery of the social and economic functions that communities need.^[8]

In the two teaching scenarios, the improvement comes from both retaining partial capacity and restoring full production earlier. In practice, track several milestones: safe condition, minimum service, sustained partial output, full operating capability and restored deliveries. They need not occur on the same date.

For energy and other essential services, output lost upstream can also constrain customers who have suffered no direct physical damage. Buffers and alternative sources determine how far that interruption travels. Market prices and wider economic losses depend on demand and substitution as well as the initial outage; they cannot be inferred from photographs alone.

Interception success does not by itself establish service continuity

A statement about intercepted threats and a statement about functioning infrastructure measure different outcomes. Both may be accurate at the same time. A high interception rate can coexist with a consequential residual event; precautionary shutdown, debris damage or an unavailable external service can also interrupt operations.

To establish protection of infrastructure, interception reporting must be accompanied by service data. To establish the cause of a particular outage, investigators need a compatible timeline and evidence about equipment condition, operations and dependencies.

Likewise, consequential damage is consistent with deliberate selection of important equipment, but does not by itself prove exactly what an attacker intended or knew. Physical damage, operational effect and intent are separate claims requiring separate evidence.

Buy continuity with engineering, procurement and operations together

The owner’s objective is to reduce uncovered service and recovery uncertainty within a realistic budget. Buying more of everything is unlikely to be efficient. Protecting only the most expensive equipment can overlook the dependencies that determine whether any of it can run.

The financial comparison should include holding cost, obsolescence, support, maintenance and testing, alongside the contribution preserved under each disruption scenario. Insurance may help fund a covered loss; it does not manufacture a replacement or supply missing service. Essential safety and community needs also require explicit protection rather than being reduced to a revenue calculation.

Resilience improves when the answer is supported by an independent alternative, a workable schedule and a demonstrated recovery—not merely an additional asset on an inventory list.