Digitalization of critical sectors, such as oil and gas production plants in the petroleum industry, will improve the observability and controllability of their services. At the same time, the exposure to cyberattacks is therefore increased, which must be carefully addressed, both from a technical and a non-technical perspective, including the human operators in the control room. This paper investigates how control room operators detect and identify cyberattacks using Cyber-Situational Awareness (CSA). Observations of a simulated cyber range training session were conducted, combined with interviews of participants, the instructor, and an OT expert. Furthermore, documents from a Norwegian petroleum company were analyzed to compare with the company’s expectations against what we observed and learned from the interviews. The findings suggest that some degree of cybersecurity awareness is present. However, the operators struggle to understand the consequences of such attacks. This paper explores and compares the petroleum company’s expectations and the actual operators’ cyber-knowledge in the field and presents possible future directions.