Iran's Three Vectors of Attack: Water, People and Trade
Bottom line up front
With the latest escalation in attacks in the Middle East, we should all remember that Iran does not need to win a conventional war against the United States and the Gulf. It has three ways to impose damage far larger than the cost of inflicting it, all running on the same cheap, survivable, hard-to-defend mass: strikes on Gulf populations and industry, attacks on the water desalination plants the Gulf cannot live without, and closure of the Red Sea as well as the Strait of Hormuz through its Houthi proxy.
The point the market has missed is that the three vectors compound each other: the same drone swarm that empties a missile-defence battery also hits the desalination plants, and a tanker crippled in Hormuz is an oil slick that fouls the seawater intakes those plants depend on. The defender runs out of interceptors, water reserves and shipping routes before Iran runs out of cheap mass.
We assess the threat across all three is live and rising (high confidence): the Gulf cannot buy its way out with gold-plated interceptors, it needs cheap mass of its own, integration and hardening. Plan for a prolonged, multi-vector squeeze, not a short war.
The common thread: cheap mass beats expensive defence
Iran’s strategy is arithmetic, not manoeuvre. It fires cheap mass at defenders who must answer with scarce, expensive means, and the Gulf’s critical systems, oil and gas, water, trade, are fixed, concentrated and sit inside the shortest missile flight times on earth. The question is not whether Iran can destroy the Gulf, but whether it can make defending it unaffordable faster than the Gulf and its allies can reload. And the three fronts are not separate: the same weapon serves all three, and an attack on one becomes an attack on another.
Vector 1: the water
Gulf desalination is the region’s most catastrophic and least-defended vulnerability, and it is already being struck. More than 90 per cent of the Gulf’s desalinated water comes from just 56 plants (a widely-cited 2010 CIA assessment, repeated across current reporting but not independently confirmed), most states hold only single-digit days of reserve, and there is no alternative source: groundwater is depleted or held for emergencies, there are no rivers, rainfall is negligible, tanker imports cannot scale. These states grew 20-million-strong urban populations on the assumption that desalination is permanent.
Dependence on desalination for drinking water:
Qatar: near-total, about 99 per cent.
Bahrain: fully reliant since 2016.
Kuwait: about 90 per cent.
Oman: about 86 per cent.
Saudi Arabia: about 70 per cent, but the largest absolute exposure by far, the world’s biggest producer, with a single plant historically supplying over 90 per cent of Riyadh’s water.
UAE: about 42 per cent of national potable water, but above 95 per cent of Dubai’s municipal supply.
Why it is catastrophic: there is almost nothing behind the plants. Roughly three-quarters of Gulf desalination is co-located with power in Independent Water and Power Projects, so a single strike takes water and electricity at once. In a 50°C summer, losing water and air-conditioning together raises, in US intelligence and Fortune’s framing, the prospect of forced evacuations of Gulf cities.
The attack surface is unusually wide, and two of its three modes never require a warhead to land on the plant:
Physical strikes. At Abqaiq-Khurais in 2019, 18 drones and 7 cruise missiles took out over half of Saudi oil production and its air defences downed none, being built for high-altitude threats, not low, slow swarms. Plants are softer targets still, and in 2026 three have already been hit: Bahrain, Fujairah and a Kuwaiti power-and-water plant.
Cyber. Iran has demonstrated destructive-cyber intent against Saudi industry (the Shamoon wiper hit over 30,000 Aramco machines in 2012). Those struck IT networks, not plant control systems, so treat it as capability and intent, not a proven desalination attack.
Oil-slick contamination of seawater intakes, the under-discussed mode that links to the trade vector. Foul the intakes with oil and a plant shuts down to protect its membranes even if undamaged. Iraq’s 1991 Gulf crude release forced Saudi shutdowns, and a tanker crippled in Hormuz does the same, hard to attribute and leaving no rubble.
This is not a hypothetical risk. The US has started the ball rolling, and a norm has broken. Iran’s own Qeshm Island plant was hit on 7 March, cutting water to some 30 villages. President Trump threatened to destroy Iran’s water plants; Iran’s foreign minister replied that “the US set this precedent,” reserving the right to reciprocate against Gulf desalination, which UN specialists warn could be a war crime. For Iran this is the ideal asymmetric target: undefended, concentrated, catastrophic and fast, with deniable modes, hitting the US-aligned Gulf without hitting US forces. The framing is not “the Gulf runs dry next week,” but “the Gulf built 20-million-strong urban populations on infrastructure with days of buffer, no alternative, and demonstrated indefensibility, now under live attack for the first time.”
Vector 2: the people
Iran’s Shahed-class attack drones cost $20,000 to $50,000 each (the jet-powered Shahed-238 around $140,000). The interceptors that stop them cost millions: a Patriot PAC-3 (the US Army’s workhorse air-defence missile) around $4 to 5 million a shot, and a THAAD (the high-altitude interceptor) about $15 million. Firing a $15m THAAD at a $30,000 drone is a losing trade even when it hits, and defenders often fire two. The drone’s job is not to arrive, it is to force the launch. The exchange ratio is at least 100 to 1 against the defender, and that is the entire point.
The magazine-depth problem is concrete. A fully loaded Patriot battery holds on the order of 96 ready rounds; a THAAD battery holds 48; and reloading takes about an hour. Iran fires a wave big enough to empty the ready rounds, then sends the next while the battery reloads and is defenceless. Salvos of 30 to 50 drones, up to 100-plus, are sized to do exactly this.
The interceptor shortage is real and structural. The US has taken delivery of just 534 THAAD interceptors across the whole programme, none since July 2023, and a single June 2025 exchange is assessed to have burned 20 to 50 per cent of them. Even the announced production surges are assessed not to restore pre-war depth until roughly 2028-29, because interceptor production runs in hundreds a year, constrained by seeker chips and rocket motors, while drone production runs in hundreds a month on commercial parts. The attacker replaces his mass in weeks, the defender in years.
The whole Gulf is inside the ring, with almost no warning. Iranian missiles reach from the 300km Fateh-110, covering the near Gulf states, to the Shahab-3 and Emad, which reach everything in theatre. The nearest Iranian coast is 140 to 160km from Dubai, a few minutes of flight. The strikes are real: the UAE alone reported hundreds of ballistic missiles and roughly 2,000 drones in the first months of the war, with its largest aluminium smelter damaged and Qatar’s Ras Laffan gas output cut about 17 per cent, and a fresh barrage on 12-13 July hit five Gulf states within hours of a US strike on Iran. The gleaming financial and cultural hubs of Dubai, Abu Dhabi, Doha and Riyadh, and even restful Oman, look a good deal less untouchable all of a sudden.
Vector 3: the trade
Iran and its Houthi proxy (the Yemen-based, Iran-backed movement) now hold two trade arteries hostage at once, and the escape routes feed each other. For containers, “go around” means the Cape of Good Hope: 10-14 extra days, manageable, already the default. For Gulf crude and gas, “go around” does not exist. Oil loaded in the Gulf must pass through Hormuz to reach open ocean at all, including to sail round Africa. A closed Hormuz is not a longer voyage for that crude, it is no voyage.
Only pipelines physically bypass Hormuz, moving barely a fifth to a quarter of the flow. Around 20 million barrels a day of oil transits Hormuz; the pipelines that can carry crude around it have realistic spare capacity of only about 3.5 to 5.5 million barrels a day. The largest, Saudi Arabia’s Petroline, runs near its record maximum and empties onto the Red Sea at Yanbu, straight into the Houthi threat. The most concrete new bypass, the US-backed Kirkuk-Baniyas line signed on 17 July, avoids both waterways but has been offline since the 2003 invasion, faces a projected 36-month, $4.5bn Chevron-led rebuild, and carries only Iraqi barrels. There is no engineering exit in 2026.
The Houthi threat is the same cheap-mass logic moved to sea. Their arsenal has grown from Soviet-era relics in 2014 to at least ten missile types: ballistic systems reaching roughly 2,000km, land-attack cruise missiles, anti-ship missiles, naval mines and long-range one-way drones. Its size is the wrong question, because it is a continuously replenished flow, not a fixed stock: Iran resupplies it (a single July 2025 interdiction seized over 750 tonnes of munitions, with components made within the previous two years) and, increasingly, the Houthis build it themselves, which is why two years of Western air strikes have failed to suppress the launch rate. Layered on top are mine-laying, cyber against port and vessel systems, and information warfare in which target ambiguity is itself the weapon. The 17 June Islamabad Memorandum briefly reopened Hormuz on a 60-day free-transit window, but President Trump declared the ceasefire over on 8 July, the fighting has since escalated into open war with the first US combat deaths, and on 20 July the Houthis declared a maritime blockade on Saudi Arabia. A fresh ceasefire proposal has surfaced, but oil closed at a one-month high the same day, so the market is not pricing de-escalation, and with Hormuz traffic running at roughly two-thirds of normal, neither do we.
The cost of holding both routes at once is not additive, it compounds. The renewed fighting has put Brent back above $89 and to a one-month high, war-risk premiums on a Gulf tanker at $1.5 to 4.5 million a transit, and container rates up about 61 per cent on the year. The Red Sea diversion has already absorbed 5 to 7 per cent of the world’s container fleet, so there is no spare shipping to soak up a second shock, the same underwriters reprice both war zones together, and an energy shock and a goods shock now hit inflation in the same quarter (US headline inflation is back up at 3.8 per cent). Modelled global GDP losses run into tens of billions of dollars a day, and Egypt is losing roughly $800 million a month at the canal. What has run out is redundancy, not price. The major carriers, profitable on Cape routing, have little incentive to hurry back, so treat Suez reopening as upside, not base case, through at least 2028.
How the three vectors compound
The reason this is one story, not three, is that the vectors are multiplicative:
The same drone swarm serves all three. The mass that empties a missile-defence magazine (the people) is the tool that hits a desalination plant (the water) and a tanker (the trade). Defending one stretches the interceptors defending the others.
The trade vector is a delivery system for the water vector. A tanker crippled in Hormuz becomes the intake-fouling oil slick: the chokepoint attack and the water attack are the same event, with no shot fired at the plant.
They share one defence problem: fixed, concentrated, undefended nodes (air-defence batteries, 56 desalination plants, a handful of pipeline terminals), no strategic depth, no regional integration, and a defender’s magazine that runs out first.
An adversary who can force all three at once need not win any one decisively. He needs only to keep the Gulf paying more to defend than he pays to attack, indefinitely.
Where the market is wrong
The one to act on: fade single-chokepoint relief rallies in oil. For Gulf crude a Hormuz closure is a volume-loss event, not a freight-cost event, and the two chokepoints give two separate all-clear signals: a Hormuz-reopening headline does not fix the Red Sea, and vice versa. Physical flow does not recover until both seas clear and the mines are swept, so a price bounce on a partial de-escalation is one to sell into. Instrument: long oil or oil volatility going into a single-chokepoint “all clear.” Kill-switch: a simultaneous both-seas ceasefire with clearance underway. Conviction: High (70-80%). This is the trade.
The structural spend: counter-drone and integrated air-defence command, not more interceptors. The re-rating sits in cheap effectors, electronic warfare and command-and-control integration, not the prime interceptor makers alone. Procurement cycles are long, so treat entry multiples with care; nothing reprices on interceptor depth before roughly 2028-29. This is a hold-and-accumulate, not a momentum trade. Conviction: Medium (55-65%).
Two lower-conviction reads. Marine war-risk insurance is priced as episodic when the perils are now correlated across both war zones (Conviction 55-65%). And Gulf sovereign and project risk is an under-priced tail from a prolonged campaign on water, power and export infrastructure, though it can stay unpriced for years, so a tail, not a near-term trade (Conviction 35-50%).
What to do about it
First, know which reader you are. A company with physical Gulf operations and people faces a genuine business-continuity case: simultaneous loss of power, water and cooling in a 50°C summer, up to and including site evacuation. A company exposed only through the oil price and supply chain does not lose water; it loses supply continuity and pays more. Most readers are the second kind, and for them this arrives as a Brent move, not a drone.
The financial transmission, for the majority. Around 20 million barrels a day passes through Hormuz. A sustained closure is widely modelled to drive Brent sharply higher from around $89 (an illustrative scenario, not a forecast), feeding energy bills, freight surcharges and, through inflation, interest rates. The first corporate lever is therefore not sandbags, it is treasury: review the fuel and energy hedge book, hedge ratio and tenor, and FX exposure on affected currencies, before a spike, not after. This is the single most actionable response, and the one the military detail can obscure.
Then the operational layer. Marine war-risk cover can be repriced or pulled at roughly 48 hours’ notice on a Joint War Committee listing, so review it now, along with your cyber and war-risk exclusions. Map your single-source Gulf suppliers and Gulf-sited facilities honestly and size the exposure: for a diversified group it may be a line item, and some readers (energy majors, Cape-routing shipping) are net beneficiaries, so ask first whether your company gains or loses. Then wire the indicators below to a pre-agreed action ladder with an owner each, so the risk committee pre-authorises responses rather than reconvening each time.
For PE and investors: the durable theses are cheap effectors and air-defence command integration (not the prime interceptor makers), maritime and critical-infrastructure cybersecurity, and resilience infrastructure. Nothing reprices before roughly 2028-29, so accumulate, do not chase.
For the individual reader: this is the machinery behind the oil price, and through it your fuel bill and, via inflation, your mortgage rate. The one idea to keep: Iran’s advantage is arithmetic, not firepower, and the investable answer is not a bigger shield but cheaper defence, joined up.
Indicators to watch
Interceptor expenditure and resupply tempo; any admission of magazine depletion, or progress toward a unified Gulf air-defence command.
Any deliberate strike on a desalination or power-and-water plant, or a large Gulf oil release near intakes.
Houthi and IRGC statements on Red Sea and Hormuz targeting; any revival of the 17 June memorandum.
Fresh multi-state barrages timed to US strikes, the signature of the compounding strategy.
The close
Iran cannot beat the Gulf in a straight fight, and it is not trying to. It has turned the Gulf’s own strengths, its concentrated wealth in oil, water and trade, into fixed, undefended targets, bound by one arithmetic: cheap mass against expensive defence, until the defender’s magazine, reserve or route runs out. The Gulf will not buy its way out with a bigger shield. It will do it, if at all, with cheaper defence, joined-up command, and infrastructure built to take a hit, and it must start before the next barrage, not after.
Drawn from CSIS, IEA, EIA, Al Jazeera, Reuters, Fortune, the Atlantic Council and live July 2026 reporting. Active-war strike tallies are as-reported by targeted states and directional.
Read more at The Interlock: theinterlock.org. This assessment does not constitute investment advice.