This article, written by Special Publications Editor Adam Wilson, contains highlights of paper OTC 28121, “Cybersecurity for Upstream Operations,” by Mohammed A. AlGhazal, SPE, and Mohammad J. AlJubran, SPE, Saudi Aramco. The paper was prepared, but not presented at the 2017 Offshore Technology Conference Brasil, Rio de Janeiro, 24–26 October. The paper has not been peer reviewed. Copyright 2017 Offshore Technology Conference. Reproduced by permission. During well drilling and completion, cybersecurity is critical for securing data to prevent hacking or the loss of software programs. Paying attention to data flow, with the goal of protecting the data as well as the facility, while developing capabilities to deal with intrusions is important. This is the essence of cybersecurity and operational leadership. This paper emphasizes the value gained by investing in cybersecurity for drilling, workover, and completion operations. Introduction Countless engineering and research projects have addressed cybersecurity for downstream operations. Other works have discussed remote upstream operation models along with data flow and information management that have been implemented to digitize the upstream industry, moving it to a new level of automation, efficiency, and improved overall performance. The benefits of the transforming digitization include assurance, cross-organizational collaboration, leveraging of knowledge, and safer operations with minimal human presence on the well site because of remote control. On the other hand, sensors, controls, and networks are added when intelligence is added. This digital expansion creates vulnerability and more entry points—back doors—to exploit defects and weaknesses. One of the reasons for this proliferation of weaknesses is that no logical system can describe a physical system perfectly because too many pieces are involved. The Pressing Threat Upstream oil and gas represents the world’s largest supply chain, involving numerous subcontractors who supply equipment, fluid, and other services to the operating company. The life of upstream assets and resources lasts for decades with multiple time scales for different facilities. Threats and security defenses continuously evolve and change, but much of a facility does not. This makes cybersecurity of long-lived assets very complex, especially because decisions taken will last a long time and be costly. Additionally, the extended reach of oil and gas infrastructures into remote operational areas creates vulnerability and security exposures alongside environmental risk. Accidents in such extended facilities result in liability increases, revenue losses, and the loss of safety standing with society and authorities. While substantial emphasis has been placed on physical security for decades, cybersecurity is still evolving and is building an experience curve as threats keep moving.