As energy, water, transport, telecommunications, healthcare, finance and government services migrate to cloud platforms, industrial internet connectivity, remote operations and data-driven automation, Saudi Arabia’s critical national infrastructure is becoming more digitally integrated. The integration enhances operational capability, but also provides routes for ransomware and advanced persistent threats (APTs) to move from information technology to operational technology, disrupt essential services, manipulate trusted identities and exploit supplier relationships. This review integrates recent peer-reviewed evidence on cyber resilience against these threats and interprets it for the Saudi critical-infrastructure context. The choice of a structured integrative review is due to the evidence being across the fields of cyber resilience, ransomware, APT behaviour, industrial control systems, zero trust, situational awareness, risk governance and recovery engineering. The synthesis suggests that prevention alone cannot deliver resilient infrastructure. It calls for service-centric governance, separation of business and operational environments, identity-based access control, threat-informed monitoring, secure and tested recovery, supplier assurance, and continuous adaptation after exercises or incidents. Ransomware and APTs differ in speed and goals, but both take advantage of weak identity, lack of asset visibility, trusted administrative pathways, and poor recovery design. The paper therefore proposes a Critical Infrastructure Cyber-Resilience Loop that incorporates govern, anticipate, withstand, detect, contain, recover and adapt functions around minimum viable service delivery. The review provides a practical framework for Saudi operators and policymakers, and also highlights research gaps in OT-specific resilience measurement, cross-sector dependency modelling, recovery assurance, and empirical evaluation of national cybersecurity controls.