Abstract
For decades, space benefited from something few other industries enjoyed: inaccessibility. Satellites were expensive, scarce and operated by a relatively small community of specialists. While never a security control in itself, this acted as a powerful barrier that limited both the number and capability of potential adversaries.
Today, those barriers are disappearing. Space is becoming cheaper, more connected and more commercial, while cyber operations are increasingly being used as instruments of geopolitical competition. At the same time, Artificial Intelligence (AI) is accelerating the pace and scale of cyber activity, reducing the effort required to discover vulnerabilities, analyse complex systems and identify potential attack paths. The result is a faster, more accessible and increasingly contested threat environment.
Much like the automotive, aviation and maritime sectors, connectivity is transforming space into a cyber domain. The challenge is no longer simply preventing compromise, but ensuring missions can continue despite it. As the barriers that once protected space continue to erode, resilience must be intentionally designed, funded and sustained throughout the life of the mission and across the wider ecosystem upon which modern space operations depend.
Introduction
For decades, the space industry enjoyed a luxury that few other technology sectors possessed: inaccessibility.
A compromised server can be rebuilt. A vulnerable car can be recalled and remediated. A ship can be dry-docked and repaired. Even critical national infrastructure can usually be physically inspected, upgraded or isolated. A satellite orbiting hundreds of kilometres above Earth offers no such option.
For many years, this mattered less than one might think. Space systems were expensive, specialised and relatively scarce, developed by a small number of highly capable organisations using engineering practices inherited from aerospace and defence. Security was far from perfect, but many of the factors that protected satellites were structural rather than technical. Cost, complexity and scarcity acted as natural barriers to attackers.
That world is changing.
The same forces that transformed vehicle security over the past two decades are beginning to reshape the economics of space.
The pattern repeats
Cybersecurity has a habit of following connectivity.
Twenty years ago, most attention focused on traditional IT systems. Then vehicles became connected. Researchers demonstrated remote compromise of automotive infotainment and operational systems, showing how seemingly isolated vehicle functions could become reachable through unexpected paths.
Aviation followed a similar trajectory. Aircraft themselves remained highly resilient, but associated passenger systems and service infrastructures became attractive targets. Maritime, rail and logistics networks experienced the same evolution.
What begins as digitisation inevitably becomes connectivity, creating new interdependencies that can introduce additional attack surfaces and hidden fragilities ripe for exploit.
The examples are now familiar. GPS denial and spoofing affects aircraft, ships and drones. Railway systems have suffered disruption through exploitation of legacy communications mechanisms. Ports, airports and logistics providers have increasingly become targets of ransomware and cyber-enabled disruption. The 2022 Viasat incident demonstrated that even satellite communications infrastructure can become a strategic target during geopolitical conflict.
These incidents differ in technical execution but share a common lesson: Every connected platform eventually becomes a cyber platform
Space is no exception.
Space: A uniquely challenging domain
The challenge isn’t that space systems are less secure than terrestrial systems. In many respects the opposite is true.
Space engineers have spent decades solving problems that cybersecurity practitioners are only now beginning to grapple with at scale: resilience, recovery and operation under extreme constraints.
Power is limited. Bandwidth is scarce. Hardware replacement once launched is unfeasible. Radiation creates reliability challenges few sectors outside the nuclear industry contend with. Mission costs are significant, and even minor failures can be catastrophic.
As a result, spacecraft often rely on proven tried and tested solutions rather than the latest technologies, something known as ‘flight heritage’. Where enterprise IT celebrates rapid innovation, space systems traditionally reward predictability and survivability.
This approach, however, creates a paradox.
The technologies trusted to operate reliably for years within aerospace may appear antiquated by modern computing standards in contemporary IT environments. Satellites may remain operational long after the technologies around them have evolved, as orbital clusters of legacy embedded systems.
Some satellites launched today may still be delivering services well into the late 2030s and beyond. Security assumptions made during design and integration must hold for the entire mission duration, long after threat actors, attack tooling and commercial technology landscapes have progressed. Whilst many industrial and critical national infrastructure sectors have significant legacy IT and OT system estates, few other industries deploy critical assets expecting them to remain in service for decades while permanently beyond physical reach.
In addition, ‘air-gapping’ is often used to segment and isolate mission and safety critical systems. Within satellites, access to radio transceivers is usually shared across multiple, if not all, sub-systems – constraining options for segmentation and isolation.
This creates an unusual security problem. It is extremely difficult to develop a modern, complex system of systems – such as on a car, train or ship – without a significant number of undiscovered vulnerabilities. Whilst best practice is to patch and remediate these as soon as practical, this may not be possible for space systems if physical access is required. Even where over-the-air updates are possible, they remain constrained by communication limitations, onboard computational capabilities and the operational risks associated with updating systems that cannot be accessed logically or physically if something goes wrong.
Security therefore becomes less about detection and response and more about engineering systems that may carry many vulnerabilities throughout their operational life but can survive compromise and still complete their mission objectives.
Traditional assumptions are eroding
Historically, these challenges were offset by the difficulty of attacking space systems. That assumption deserves re-examination. Three converging trends are changing the threat landscape.
1. The weaponisation of cyberspace
Cyber operations are increasingly used alongside political, economic and military instruments of power. The conflict in Ukraine has highlighted the strategic role digital attacks can play against communications and infrastructure systems before and during conventional operations. Research into cyber attacks against the space sector related to the Ukraine conflict identified 161 attacks in the two years following Russia’s 2022 full-scale invasion.
2. The democratisation of cyber capability
Sophisticated capability is no longer confined to the most highly resourced organisations. Advanced offensive tools that once required nation-state resources are increasingly accessible to criminal groups, commercial operators and non-state actors.
Historically, discussions of satellite security have focused on the spacecraft itself. In practice, adversaries frequently pursue the softer parts of the ecosystem. Ground stations, mission-management platforms, software supply chains and third-party service providers are often more accessible and harder to assure consistently than the spacecraft they support. Of the 161 space sector cyber-attacks linked to the Ukraine invasion, none directly targeted orbital assets. Instead, they were split between ground systems, commercial operators and space agencies.
3. The advent of AI
The impact of AI on offensive cyber operations is often overstated. Its significance lies less in creating new attack methods or techniques, than in reducing the cost and time required to execute existing ones. Reconnaissance, vulnerability discovery, attack-path identification and exploitation are increasingly susceptible to automation and attack chaining. What once demanded large teams of specialists may increasingly be attempted by smaller groups operating with AI-augmented tooling.
Evidence of this trend is already emerging. The 2026 Hugging Face incident demonstrated how increasingly autonomous AI-driven activity can produce unintended offensive effects at scale. More significantly, April 2026 evaluations by the AI Security Institute (AISI) showed growing capability among frontier language models to autonomously chain multiple stages of cyber operations within controlled cyber-range environments – underlining the continued reduction in effort, expertise and coordination required to execute attacks.
Further reporting from Anthropic highlighted the use and abuse of Claude by threat actors, detailing significant use of AI to automate and accelerate cyber-attack kill chains targeting Ukrainian, European and US organisations involved in drone and military technology.
The overall result is an acceleration of capability diffusion. Attackers don’t necessarily become more sophisticated. They become quicker, more scalable and increasingly able to orchestrate activities that previously demanded larger teams and deeper specialist expertise.
Space enters its automotive moment
The space sector faces an additional challenge: It’s becoming dramatically cheaper.
Platform and launch costs have fallen. CubeSats have proliferated. Universities, research organisations, start-ups and new commercial entrants can now access capabilities once restricted to governments and major aerospace firms. ‘New-Space’ is here.
This democratisation brings enormous benefits – accelerating innovation, broadening participation and reducing barriers to entry. However, it also changes incentives, notably around how systems are built and how resilience is governed.
Historically, the economics of space naturally encouraged resilience. Satellites were expensive, launch opportunities were limited, and failure carried significant financial and operational consequences, giving organisations strong incentives to invest in assurance, reliability and engineering rigour.
In contrast, lower-cost platforms and increasingly competitive markets encourage optimisation around affordability, capability and deployment speed. Various consumer technology markets have shown that this can lead to security being treated as a constraint rather than a design principle.
For example, the automotive industry built its reputation on reliability and quality. But the pursuit of connected, automated and feature-rich vehicles has fundamentally changed the landscape. Today's vehicles depend on vast networks of third-party technologies, creating complex systems whose vulnerabilities can undermine the very trust and dependability on which the industry was built.
The space sector is beginning to encounter similar tensions. Greater use of commercial off-the-shelf (COTS) components, shorter development cycles and increasingly complex supply chains create conditions that cyber security professionals have observed across many other industries. The result isn’t inevitable insecurity, but the gradual erosion of assumptions that previously supported resilience.
More importantly, resilience itself may become increasingly uneven.
Established operators may retain the resources, expertise and commercial incentives required to invest in long-term security engineering and through-life resilience, along with rigorously testing and remediating procured components. Newer entrants, operating under pressure to maximise capability, secure funding, accelerate deployment and remain commercially viable, may find those investments harder to justify. Especially when significant portions of their budgets go towards achieving orbit.
This is where the space cyber poverty gap begins to emerge. As participation in the space economy expands, resilience can no longer be assumed to arise naturally from the sector’s economics. Instead, a growing disparity may emerge between those able to engineer and sustain resilience over time, and those for whom resilience increasingly becomes a secondary consideration to affordability, functionality and speed-to-orbit.
As the sector democratises and expands, new operators, suppliers and service providers come with their own commercial constraints, approaches and capacity for security and resilience. Navigating this growing divergence may become one of the defining challenges of an increasingly busy and interconnected space ecosystem.
The cost of accessibility
The emergence of a space cyber poverty gap introduces a challenge that extends beyond technology.
As previously mentioned, the economics of space naturally favoured assurance, reliability and long-term operational performance. Regulation played an important role, but limited launch opportunities and substantial costs created powerful self-regulating incentives.
The continued commercialisation and democratisation of space is changing that equation – with market success increasingly determined by functionality, time-to-market and cost rather than long-term resilience.
The challenge is that resilience increasingly becomes a collective property of the ecosystem. It’s no longer sufficient for individual organisations to secure only their own systems. Equally, outside tightly controlled environments such as some military or intelligence ecosystems, few organisations possess the authority or visibility required to assure the security of the entire ecosystem upon which their missions depend.
A modern space mission may involve satellite manufacturers, subsystem suppliers, software developers, communications providers, ground-segment operators, cloud-service providers and a growing network of commercial partners. Each operates under different commercial drivers, support horizons and risk tolerances, so the security of the mission is shaped not only by the resilience of the spacecraft, but also by the resilience of the broader ecosystem.
Aligning resilience priorities
As complexity increases, responsibility for security can become fragmented. Historically, the economics of high-cost programmes aligned the interests of system integrators, operators and suppliers around reliability and mission assurance. Today, those incentives are becoming more varied. An organisation expecting a platform to remain operational for fifteen years may make very different security decisions from one designing a low-cost platform with an expected operational life of two or three years.
Regulation and licensing requirements should act as important safeguards for security, resilience and reliability. However, regulation alone cannot solve the problem. Technology evolves faster than regulatory frameworks, and cyber threats evolve faster still. AI will exacerbate this. Compliance can establish a baseline, but it can’t guarantee resilience against threats that emerge years after a system has launched.
This creates a difficult economic question. Operators of high-value constellations and critical infrastructure remain strongly incentivised to invest in security obsolescence planning, through-life assurance and long-term resilience engineering. This extends to access to technology such as AI to help plan, design, test and secure these assets. For financially constrained operators of low-cost, short-lifecycle platforms, the calculation may be very different. Investing in resilience against threats that may emerge years into the future can be difficult to justify when commercial success depends on affordability, speed-to-orbit and rapid innovation.
In such circumstances, accepting a degree of future compromise and replacing assets periodically may appear economically rational for individual organisations. Yet what is rational for one operator is not necessarily beneficial for the wider ecosystem.
This is a defining challenge of the space cyber-poverty gap.
As society becomes increasingly dependent upon space-enabled communications, navigation, timing, logistics, defence and financial services, resilience can no longer be assumed to emerge naturally from market economics alone. The question is no longer whether more organisations can access low orbital space, but whether the sector can ensure that expanding access is matched by an equivalent commitment to security and resilience.
Because in an increasingly interconnected orbital ecosystem, the consequences of inadequate resilience rarely remain confined to a single operator.
The resilience imperative
Much discussion around satellite security focuses on preventing compromise. A more useful question may be: What happens when prevention fails?
For most cyber-physical platforms, compromise is survivable. Components can be replaced, systems rebuilt and software reinstalled. Satellites operate under different rules. Once deployed, they must often continue operating for years, or even decades, despite evolving threats, changing technologies and limited opportunities for intervention.
Securing spacecraft is only part of the problem. Equal attention must be given to the ecosystems that enable them to operate, including ground infrastructure, software supply chains, communications providers, cloud services and mission-management platforms. As these ecosystems become more connected, commercialised and accessible, the assumptions that historically protected space systems grow progressively weaker.
For decades, the industry's security model benefited from powerful structural advantages. High costs, specialist expertise, limited launch opportunities and physical inaccessibility reduced both the number and capability of potential adversaries. While these barriers were never security controls in themselves, they helped create an environment in which resilience emerged naturally from the sector’s economics.
That environment is changing.
Cyber conflict has demonstrated the strategic value of disrupting space-enabled services. AI is reducing the cost, speed and scale of offensive cyber operations. The democratisation and commoditisation of space are lowering barriers not only for innovators, but also for adversaries. At the same time, the growing diversity of operators, suppliers and commercial stakeholders is creating increasing variation in how resilience is funded, prioritised and maintained.
The consequence is not simply a larger attack surface. It is the emergence of uneven resilience across an increasingly interconnected ecosystem, which can be exploited. This divergence will be one of the defining challenges of an increasingly interconnected space ecosystem.
Access to orbit is becoming cheaper, but resilience is not. As society becomes increasingly dependent upon space-enabled communications, navigation, timing, logistics, finance and defence, resilience can no longer be assumed to emerge naturally from market economics alone. The strategic challenge is no longer how to expand access to space. It is how to ensure that expanding access is matched by a corresponding commitment to resilience.
Building on traditional thinking
There is a final irony.
Long before cyber security adopted the language of resilience, spacecraft engineers were already practising it. Redundancy, graceful degradation, fault tolerance and operation under uncertainty have been foundational principles of space engineering for decades. The challenge facing the sector is extending those principles beyond the spacecraft and across the increasingly digital ecosystems that support modern space operations.
The future of space security may therefore depend less on importing cyber security principles into space and more on applying the sector's own resilience-first engineering philosophy to a rapidly evolving threat landscape.
Because one lesson is becoming increasingly difficult to ignore: Distance was never a security control. It was simply a barrier that technology had not yet removed.
In a world where every connected platform ultimately becomes a cyber platform, those most likely to succeed will not be those that assume compromise can always be prevented. They will be those that engineer resilience into every layer of the mission and are prepared to succeed anyway.
Stay tuned for the next article in our space and cyber security series, where we’ll provide some practical guidance around preparing for compromise and engineering through-life resilience into space systems.