In addition to deciding whether that firepower should be turned on Iran in retaliation, the Saudis and their American allies must now figure out how to prevent a repeat of last weekend's attack -- or worse, such as an assault on the Saudis' export facilities in the Persian Gulf or any of the desalination plants that supply drinking water.

Secretary of State Mike Pompeo was asked Wednesday on his way to Saudi Arabia how it was possible that the kingdom could have dropped its guard, failing to stop any of the low-flying cruise missiles or armed drones that struck the Abqaiq oil processing center -- the largest of its kind in the world -- and the Khurais oil field.

Even the best air defenses sometimes fail, he replied.

"We want to make sure that infrastructure and resources are put in place such that attacks like this would be less successful than this one appears to have been."

Easier said than done.

"This is an attack of a scale we've just not seen before," Pompeo said. He called the strike "an act of war" but not say what military response might follow.

President Donald Trump, in California on a political fundraising trip, said, "We know very much what happened." But he, too, was noncommittal on whether he would order U.S. military retaliation.

Saudi Arabia has multiple batteries of advanced U.S. Patriot air defense missiles, which are meant to shoot down hostile aircraft or shorter-range ballistic missiles. Patriots provide "point defense" -- not protection of wide swaths of territory -- and it's unclear whether any were positioned close to the oil sites.

The U.S. provides intelligence and surveillance support to the Saudi military, but that, too, has its limitations.

"We don't have an unblinking eye over the entire Middle East at all times," said Marine Gen. Joseph Dunford, chairman of the Joint Chiefs of Staff.

The U.S. military this summer returned American forces to Saudi Arabia, at Prince Sultan air base south of Riyadh, after an absence of more than a decade. Those forces include a Patriot missile battery. Prince Sultan became a hub of American air power in the Middle East in the 1990s but was abandoned by Washington after Iraqi strongman Saddam Hussein was toppled in 2003.

The Saudis clearly were not prepared for this assault, which was unusual in its execution and unprecedented in its targeting. They have largely focused their air defenses on threats from the south, in the direction of Houthi rebels who frequently launch shorter-range missile and drone attacks on Saudi territory. Saudi officials said Wednesday the low-flying cruise missiles and armed drones struck from the north, suggesting they came from Iran .

The strike interrupted the equivalent of about 5% of the world's daily oil supply. Saudi Arabia's energy minister said Tuesday that more than half of the country's daily crude oil production that was knocked out by the attack had been recovered and production capacity at the targeted plants would be fully restored by the end of the month.

Seth Jones, a counterterrorism expert at the Center for Strategic and International Studies, said "almost no state" could have fully thwarted such an unconventional attack. Saudi Arabia, given the scope of its oil infrastructure, is especially at risk to Iran's multi-dimensional threat.

"The vulnerability of Saudi Arabia's ... critical infrastructure is probably impossible to entirely defend," Jones said, though the Saudis are "fairly well prepared" to defend against conventional threats such as warplanes.

Though the Saudis' energy minister talked of a rapid bounce-back, the attack seemed to herald a new era of energy vulnerability.

"Never in the history of global energy markets has a malevolent act targeted at energy infrastructure been felt globally," Pierre Noel, an analyst with the International Institute for Strategic Studies, wrote on Tuesday. He called it the "archetypal event that oil security specialists talk about all the time but never happens."

Iran denies it was to blame. But its alleged fingerprints on the destruction in the desert point to a trend toward a shadowy form of warfare that can sneak past traditional defenses.

Anthony Cordesman, a Middle East expert at the Center for Strategic and International Studies, wrote this week that the use of cruise missiles and armed drones - whether by Iran or its Houthi proxies in Yemen - reflects a move toward unconventional military capabilities, including cyberattack, that defies traditional thinking about defense and security.

"Analysts have been warning about these shifts in the nature of war for years, but the recent strikes on Saudi Arabia have made it clear that they are now at least a limited reality," Cordesman wrote.

Saudi officials on Wednesday said the attack was "unquestionably sponsored by Iran," naming but not directly accusing its Gulf rival of launching the assault.

By stopping short of saying the missiles were launched from Iran, the kingdom potentially avoids making a response that could lead to war among the heavyweight countries of the region and the United States. However, not retaliating also carries the risk of leaving Saudi Arabia exposed to further attacks.

For decades, particularly in the wake of Iraq's invasion of neighboring Kuwait in 1990, the Saudis have spent tens of billions of dollars on foreign military equipment and training -- most of it from the United States.

Between 2014 and 2018, the Saudis ranked as the world's No. 1 arms importer. In that period, they accounted for 22 percent of the United States' global arms sales, according to the Stockholm International Peace Research Institute. In recent years they have acquired some of America's top-shelf weapons, including F-15 fighter aircraft, Apache attack helicopters and the Patriot air defense systems.

None of that made a difference last weekend in the face of an attack that exposed Saudi weaknesses that might seem obvious in retrospect.

Just last month, Jones of the Center for Strategic and International Studies gave a presentation that pinpointed Saudi vulnerabilities to Iranian attack, although he focused mainly on the threat of Iranian cyberattacks and ballistic missiles.

"Saudi Arabia is so vulnerable that defensive measures, while they are important, will not ever solve the problem," Jones said in his video presentation. The best approach, he said, is deterrence -- making Iran believe it would pay an enormous cost for targeting Saudi oil infrastructure.

John Hultquist, director of intelligence analysis at FireEye, Inc., a security firm, told The Associated Press he believes that Iran had collected intelligence using cyber intrusions during acts of sabotage against oil tankers in the Gulf region earlier this year.

"Frogmen, drones, third-party proxies and cyberattack are all capabilities Iran can use to turn up the heat," Hultquist said. "All of them are on the table right now, and companies operating in the Gulf should take notice and prepare."