"Neither Statoil nor the joint venture could have prevented the attack, but there is reason to question the extent of their reliance on Algerian military protection," concluded experts who investigated the tragedy at the In Amenas natural gas facility at the request of Statoil.
Islamist militants attacked the site, located in a military zone close to a gendarmerie camp and the Libyan border, on January 16 taking its employees hostage for several days.
An Algerian army raid to free the hostages left up to 40 of them dead, including five Norwegians. Twenty-nine militants were killed and three others captured alive.
"Security measures at the site were not constructed to withstand or delay an attack of this scale, and relied on military protection working effectively," the experts said in a 78-page report.
But chief investigator Torgeir Hagen added that "no military or other force can guarantee total protection against determined terrorists in an area the size of Luxembourg close to the porous border between Algeria and Libya".
After the attack Statoil, which manages the site in a joint venture with Algeria's state-run energy giant Sonatrach and Britain's BP, pulled out all its expatriate staff and no decision has been made about their return.
BP's personnel is expected to return to Algeria soon, Britain's ambassador Martyn Roper said in Algiers on Sunday.
In March, Algeria ordered state security agents to protect facilities run by foreign companies in spite of their misgivings.