When the Backup Becomes the Target

Economic Security Intelligence | Emerging Risks Global

Introduction

Most of us were taught to think about resilience in terms of alternatives. If the main route fails, use the other one. If a supplier goes down, switch to the second source. If a site is lost, move to the backup.

It is a sound principle. But it rests on an assumption that rarely gets tested: that the alternative does not share the same threat.

This month, in the Gulf, that assumption was tested.

What Has Changed?

IMF PortWatch data recorded eight transits through the Strait of Hormuz on 13 September, against a pre-crisis baseline of around 85 a day. [1]

The main route around Hormuz is Saudi Arabia's East-West pipeline, which runs from the Abqaiq oilfield to the Red Sea port of Yanbu and normally moves 4–5 million barrels a day. In mid-September drone strikes hit it in the Riyadh and Medina areas and forced a temporary shutdown. No group has claimed the attack. Analysts quoted by Al Jazeera believe Iran-backed groups in Iraq were responsible, but neither Saudi Arabia nor Iraq has publicly named anyone. [2]

At the same time, the Houthis took the Greater and Lesser Hanish islands in the southern Red Sea, having already taken the port of Mokha and Mayun island. Houthi attacks injured 13 civilians in the Saudi cities of Khamis Mushait, Abha and Taif. [3]

So within a fortnight the chokepoint, the route around it and the waters beyond that route were all under pressure at once.

The International Energy Agency's September Oil Market Report states that more than 10 million barrels a day of Gulf output remained shut in and that global observed oil stocks had fallen by 507 million barrels since February. North Sea Dated crude reached $113.48 a barrel on 9 September. [4]

Why Does It Matter?

The obvious consequence is price. What interests me more is what happened in the same fortnight to the cost of money.

The US Federal Reserve raised its target range to 3.75–4.00% on 16 September. [5] The European Central Bank raised its deposit rate to 2.50%, with effect from 16 September. [6] The Bank of England held Bank Rate at 3.75%, but three of its nine policymakers voted to raise it. [7] The Bank of Japan raised its policy rate to around 1.25%. [8] On 23 September the US ten-year Treasury yield reached 5.12%, its highest level since 2007. [9]

Why does that matter to a security leader?

Because almost everything we do to become more resilient costs money to hold. Inventory ties up working capital. A second supplier usually costs more than the cheapest one. Spare capacity sits idle by design. When borrowing costs rise, all of that becomes more expensive, just as the physical environment makes it more valuable.

The risk is not that organisations decide resilience is unimportant. It is that the resilience line is quietly trimmed in a budget round because it is the easiest cost to cut.

The Wider Security Issue

A first-order effect is the supply disruption itself: less oil, higher prices, rerouted ships.

The second-order effect is that the alternatives prove vulnerable too. Continuity plans that list an alternative route or supplier may be planning around the same threat twice.

The third-order effect comes from several developments interacting. The energy shock feeds inflation. Inflation drives interest rates. Rates raise the cost of holding the buffers needed to absorb the energy shock.

Add the sanctions environment. A US law signed on 18 September, H.R. 5334, requires tariffs of up to 500% on Russian-origin goods and up to 100% on goods from the five largest importers of Russian crude oil and natural gas, to be imposed within 30 days of enactment unless the President certifies a national-interest waiver. [10][11] A company with no Russian exposure of its own could find its suppliers' costs rising because of what their country buys.

That is what correlated risk looks like. Many organisations still treat energy, finance, trade and security as separate risks, each with its own owner and its own register. This month they moved together.

There is a human dimension as well. As a crisis becomes familiar, people's sense of the risk tends to fall even when the risk itself has not. Seven months in, familiarity may be one of our larger vulnerabilities.

What Could Happen Next?

There are several plausible paths. I would not pretend to know which one we are on.

Baseline. Disruption continues at roughly current levels. US envoys Steve Witkoff and Jared Kushner met Iran's Foreign Minister Abbas Araghchi in New York on 22 September, with Qatar and Oman helping mediation. Iran linked progress to lifting the US naval blockade, releasing frozen assets and ending the war on other fronts. [12] Talks continue without a settlement; energy prices and rate pressure stay high.

Escalation. A second successful strike on a bypass route or export terminal. Supplies to European buyers tighten and winter fuel resilience becomes a national-security issue, not just a commercial one.

Stabilisation. A negotiated reopening. A senior Iranian official has said Iran could reopen Hormuz within seven days if the US eased military pressure and lifted its blockade of Iranian ports. [12] Prices would fall quickly, though shipping, insurance and stocks would take months to recover.

Structural change. Even with a deal, buyers and insurers price the Gulf as permanently contested, and the cost of rerouting energy trade becomes a fixed feature of the economy.

The US–China relationship adds another layer. On 23 September Treasury Secretary Scott Bessent said the US–China trade truce, due to expire on 10 November, would be extended to 10 January. [13] Chinese customs data show rare-earth magnet exports to the US fell 20% month on month in August, to 512 tonnes. [14] That removes a November cliff-edge, not the cliff.

What Should We Watch?

I would be watching four things over the coming weeks:

• Hormuz transit numbers. A sustained rise towards the pre-crisis level would be the clearest sign of stabilisation.

• The East-West pipeline. Whether it returns to full capacity, or is hit again.

• Tariff decisions under H.R. 5334 by 18 October, particularly any naming specific countries.

• European gas supply. The EU Gas Coordination Group said on 3 September that storage levels were lower than in previous years, though it saw no immediate risk to supply. [15]

The Resilience Question

Take your organisation's continuity plan and look at every alternative it relies upon: the second route, the backup supplier, the recovery site, the reserve stock.

Then ask a simple question of each one. Does it share a vulnerability with the thing it is meant to replace?

If the answer is "we don't know", that is useful information in its own right.

Conclusion

Redundancy is not the same as resilience. A backup that shares the same threat is not really a backup. It is a second exposure to the same risk.

The organisations that fare best this winter will not necessarily be the ones with the most alternatives. They will be the ones that have checked whether their alternatives are independent and have protected the budget that pays for them.

Related from ERG: Be Intelligence Led · Assess Your Risks · Increase Your Resilience · Crisis Management

Photo: Ismail SAIDI / Pexels — https://www.pexels.com/photo/oil-tanker-on-horizon-15945856/

Sources

1. IMF PortWatch data, reported by straits.live, 19 September 2026 — https://straits.live/briefs/2026-09-19

2. Al Jazeera, 12 September 2026 — https://www.aljazeera.com/news/2026/9/12/saudi-arabia-shuts-critical-oil-pipeline-after-drone-attack-what-happened

3. Times of Israel (AP), 14 September 2026 — https://www.timesofisrael.com/houthis-seize-more-key-islands-in-red-sea-launch-attacks-into-saudi-arabia/

4. International Energy Agency, Oil Market Report – September 2026, 11 September 2026 — https://www.iea.org/reports/oil-market-report-september-2026

5. US Federal Reserve, FOMC statement, 16 September 2026 — https://www.federalreserve.gov/newsevents/pressreleases/monetary20260916a.htm

6. European Central Bank, monetary policy decisions, 10 September 2026 — https://www.ecb.europa.eu//press/pr/date/2026/html/ecb.mp260910~314e508016.en.html

7. Bank of England, Monetary Policy Summary, September 2026 — https://www.bankofengland.co.uk/monetary-policy-summary-and-minutes/2026/september-2026

8. Bank of Japan, Statement on Monetary Policy, 18 September 2026 — https://www.boj.or.jp/en/mopo/mpmdeci/mpr_2026/k260918a.pdf

9. CNN Business (via ABC17), 23 September 2026 — https://abc17news.com/money/cnn-business-consumer/2026/09/23/10-year-treasury-yield-hits-5-1-for-first-time-in-19-years/

10. The White House, 18 September 2026 — https://www.whitehouse.gov/briefings-statements/2026/09/congressional-bill-h-r-5334-signed-into-law/

11. Baker McKenzie Sanctions News, September 2026 — https://sanctionsnews.bakermckenzie.com/us-president-signs-russia-and-iran-sanctions-bill-with-new-tariff-powers/

12. Al Jazeera, 23 September 2026 — https://www.aljazeera.com/news/2026/9/23/us-iran-hold-mediated-unga-talks-on-ending-war-opening-strait-of-hormuz

13. NBC News (via AOL), 23 September 2026 — https://www.aol.com/articles/u-china-agree-extend-trade-222011000.html

14. Invezz, 21 September 2026 — https://invezz.com/news/2026/09/21/chinas-rare-earth-exports-to-us-fall-20-ahead-of-trump-xi-summit/

15. European Commission, 3 September 2026 — https://energy.ec.europa.eu/news/gas-coordination-group-no-immediate-security-supply-risk-2026-09-03_en

Emerging Risks Global provides intelligence, security and resilience advisory services to organisations navigating an increasingly contested global environment.