The most hardened free zone on earth has one problem it cannot engineer away.
In February 2026, roughly 500 ships sat anchored in open Gulf water rather than risk the transit. Brent broke USD 120. War-risk premiums spiked overnight. JAFZA's cranes never stopped moving. That gap — between a system running perfectly and a system in genuine danger — is the whole case.
- Annual trade (2025)
- USD 190B
- Jebel Ali throughput
- 19.3M TEU
- Khorfakkan bypass
- 5.0M TEU
- Share of Dubai GDP
- 36%
Ratings you can argue with, not a decimal you have to trust.
Each node is rated Low, Medium, High or Critical against four disclosed questions: how exposed is it, how much redundancy exists, does JAFZA actually govern it, and what does the recent incident history show. The rating and the reasoning are published together, so a reader can disagree with either without having to trust a black box. This companion read does not reproduce or extend the proprietary ASR Net Fragility Matrix.
Fragility doesn't spread evenly across JAFZA. It stacks at one end.
Governance & institutional authority
UAE federal sovereignty over JAFZA is constitutionally embedded and backed by four decades of precedent. DP World's board structure gives succession depth most private operators lack.
Tenant base & decision authority
More than 11,000 tenant companies from 157 countries, including over 100 Fortune Global 500 firms, form a commercial base that is hard to dislodge in aggregate — though senior decision authority carries the concentration risk typical of large state-linked operators.
Jebel Ali Power & Desalination Complex
A single co-located site serves the whole zone: cranes, SCADA, climate control and desalinated water all draw from one point of failure. Worth watching, not yet a crisis — and the fix (distributed backup generation) is a known, buildable one.
Port SCADA & digital command layer
The most sophisticated command infrastructure in the region, and that sophistication is the exposure. The Iran-linked group tracked as CyberAv3ngers compromised programmable logic controllers across multiple Gulf critical-infrastructure sites during the June 2025 conflict period — documented precedent, not hypothesis. Trends toward Critical in any Hormuz-adjacent crisis window, and is fixable through network segmentation, an independent secondary command capability, and recognised OT security certification.
Strait of Hormuz dependency
Roughly 33 km wide at its narrowest, with Iran controlling the northern shore outright and about a fifth of world oil consumption in transit. Khorfakkan offers ~5M TEU against Jebel Ali's 19.3M TEU and cannot be scaled on short notice. Unlike Malacca's three-state joint governance, this is a one-country chokehold. Not a close call.
The bypass exists. It just isn't big enough.
Khorfakkan covers barely a quarter of Jebel Ali's throughput — enough for a diversion, nowhere near enough for a sustained closure.
Harden what you govern. Hedge what you never will.
- Segment the OT command layer and stand up an independent secondary command capability that can run the terminal without the primary hub.
- Break the single-site power and desalination dependency with distributed backup generation sized to a 72-hour degraded window.
- Treat Hormuz as a hedging problem, not an engineering one: contracted alternate routing, pre-agreed war-risk cover, and inventory posture set against closure duration rather than probability.
The Strait doesn't care how good your automation is. Neither will the next one.