(CNN) Saudi Arabia has spent billions on state-of-the-art air defense and early warning systems, but a mix of cruise missiles and drones was able to penetrate its airspace on Saturday, inflicting substantial damage on the world's largest oil processing plant at Abqaiq.
That suggests serious shortcomings in where Saudi systems are placed and what they're designed to do. But it also illustrates a bigger problem: the age of drone warfare is a massive challenge to governments around the world.
The cruise missiles used in the attacks were re-tooled versions of a Russian design from the 1970s -- and drones are still the poor man's missile even if they are getting more sophisticated. In other words, 5% of global oil supply was taken out by weapons worth not even millions -- let alone billions -- of dollars.
A US defense official told CNN that Saudi and US missile defense systems did not detect the launch nor engage the missiles. One reason was that much of the "missile defense architecture" is oriented toward Yemen from where Houthi forces have regularly fired missiles and drones over the past two years, the official said.
In the aftermath of the attacks, US President Donald Trump has ordered new sanctions on Iran. While Trump has not definitely stated that Iran was behind the strikes, others in his administration have pinned blame on Tehran. Iran has denied responsibility for Saturday's attack.
According to a source familiar with the Saudi/US investigation into the attacks, the cruise missiles flew at very low altitude to avoid detection and would have avoided traveling over the Persian Gulf where US and Saudi radar systems are strongest.
The Saudis have dealt effectively with the barrage of short-range ballistic missiles fired from Yemen in the past two years. Saudi Defense Ministry spokesman Lt. Col. Turki al Malki told a news conference on Wednesday the Kingdom had intercepted more than 230 such missiles.
But ballistic missiles, which leave and then re-enter the atmosphere, are not the current problem.
Saudi Arabia has six battalions of US-made Patriot batteries designed to take out incoming missiles. Jeremy Binnie, Middle East editor at Jane's Defence Weekly, says that according to satellite imagery "the Saudis have shifted Patriots back to defend the eastern province, with one facing towards Iran, the other towards Yemen."
Recently another was deployed just to the east of Abqaiq but again facing Yemen. But any cruise missile approaching from the north would have appeared only fleetingly -- if at all -- on its radar.
Compounding the problem, Binnie says, is "Iran's development of cruise missiles with ranges that can exploit gaps. Saudi defenses were already stretched by the threat from Yemen and now these new Iranian weapons are opening up even more attack options."
The Kingdom announced plans in October 2017 to buy the Russian-made S-400 anti-missile system, which has a longer range than the Patriot. The S-400 is mainly designed to deal with ballistic missiles but can be combined with a smaller Russian system known as the Pantsir S1, which is designed to combat short-range cruise missiles and can also tackle drones.
The Pantsir has both missiles and guns but Binnie says "there are suggestions -- contrary to what the Russians say -- that it has not performed that well in Syria."
Saudi Arabia actually has a system -- bought from Germany -- to deal with short-range attacks, called the Skyguard. It's basically radar vans attached to anti-aircraft guns -- but they have to be close to the target they are defending. According to Binnie, at least one Skyguard unit was deployed at Abqaiq.
Michael Duitsman, a research associate at the James Martin Center for Nonproliferation Studies in Monterey, California says the radar -- if operational -- would have been trying to distinguish the projectiles from all sorts of ground 'clutter.' "The warning times were minimal -- the drones would likely show up on the Skyguard radars two minutes or less before impact -- if they showed up at all."
The trouble is that the air defenses at Abqaiq were designed to stop an attack by manned aircraft, Duitsman says. "The range at which most radar systems can detect a small drone or cruise missile is substantially less than the range at which they can detect a full-sized aircraft."
According to Justin Bronk, research fellow at the Royal United Services Institute in London, the Skyguard has a "very limited range which restricts the area each battery can protect and can be swamped by multiple incoming threats at once, especially if approaching from different directions."
That's the nightmare scenario for the Saudis and others: a swarm of such projectiles converging from multiple directions -- some designed to confuse or jam radar and others to overwhelm air defenses. And it can be done cheaply.
Bronk told CNN that "the cost curve is very favorable to the attacker, meaning Saudi Arabia would have to spend far more than its enemies to protect against additional strike capabilities. As such, there is almost no way the Kingdom can completely defend against such attacks."
The result is that at least some of the infrastructure that is critical to the global oil supply is vulnerable.
The age of drone warfare has opened up a Pandora's Box of risk, with no obvious answers on the horizon. Drones are relatively cheap, can carry a modest explosive charge and their range and accuracy have increased.
Drones have become very popular among terrorist and rebel groups. ISIS flew dozens in an effort to take out Iraqi armor in the battle for Mosul in 2016. In January 2018, Moscow claimed that Syrian rebels sent 13 drones against the Russian airbases in the country -- each packed with about 10 bomblets that contained about half a kilogram of high explosives. The Russians claimed that electronic countermeasures and the Pantsir system blocked the attack.
The US military has increased the deployment of Stinger ground-to-air missiles with ground forces in part to counter the drone threat. In recent years it has also conducted an exercise called 'Black Dart' into combating hostile drones, using everything from lasers to guns and electronic counter-measures.
Binnie expects that the shock of the weekend attacks will send Saudi Arabia -- already the world's largest arms importer -- into the market again. "Having previously focused on ballistic missile defense, the Saudis and others now need to look at how to defend themselves against cruise missiles as well," he told CNN.
"The size of the kingdom, the way its critical infrastructure is spread out, and the ability of very long-range cruise missiles to take circuitous routes around defenses makes this a serious challenge."
It's a strange irony of modern warfare that "low, slow and small" can often pose a greater danger than more sophisticated systems. Saudi Arabia has just seen how devastating that can be at first hand.