European Cyber Security Organisation (ECSO): EU CYBERSECURITY INDUSTRIAL POLICY FOR SPACE
Published: October 2026, version 1.
Keywords: industrial policy, space.
Read the original report (PDF): https://ecs-org.eu/wp-content/uploads/2026/10/20261012-EU-Cybersecurity-Industrial-Policy-for-Space.pdf
The report's central message is straightforward: Europe must stop treating space as a specialised sector and start recognising it as the invisible nervous system of its economy and security.
Navigation, financial system synchronisation, telecommunications, energy, climate monitoring, logistics, crisis management and defence now depend on space-based services. An attack on this ecosystem could therefore trigger cascading disruptions with very real consequences on Earth.
The document published by the European Cyber Security Organisation (ECSO) is not a European Commission report. Rather, it is an industrial policy proposal drawing on work by the European Commission, ENISA, the European Space Agency (ESA), the US National Institute of Standards and Technology (NIST), and several scientific and standardisation bodies.
The Defining Risk: Threats Evolve Faster Than Space Missions
A satellite can remain operational for fifteen to twenty years. During that time, attack methods evolve, computing capabilities advance, cryptographic protections age and industrial dependencies change.
A vulnerability introduced during the design phase may therefore remain exposed for a decade or more, sometimes with no possibility of physical repair.
Risk must consequently be assessed throughout the entire mission lifecycle: design, manufacturing, integration, launch, operations and decommissioning.
This approach closely reflects the findings of ENISA's Space Threat Landscape 2025 https://www.enisa.europa.eu/publications/enisa-space-threat-landscape-2025, which recommends structured threat analysis at each stage of a space mission.
The report highlights a particularly important paradox: satellites attract the most attention, yet the weakest point is often on the ground.
Control centres, remote access systems, operator accounts, administrative interfaces, cloud infrastructure and third-party providers represent some of the most likely entry points for attackers.
The February 2022 cyberattack against Viasat's KA-SAT network illustrates this vulnerability.
Compromised access to the management network enabled an attack that disabled thousands of modems and disrupted the monitoring of nearly 5,800 wind turbines across Europe.
The incident demonstrated how weaknesses in identity management or network segmentation can simultaneously affect communications, energy infrastructure and military operations.
A first-hand scientific analysis was published at the 2025 IEEE Aerospace Conference https://ieeexplore.ieee.org/abstract/document/11068784.
The Real Unit of Risk Management: The Mission, Not the Equipment
One of the report's most important recommendations is to shift from asset protection to mission resilience.
Securing a satellite, control centre or application individually is no longer sufficient.
Organisations must map the complete flow of data, commands and decisions, then identify the points at which a compromise could interrupt the mission.
This approach makes it possible to prioritise risks according to their actual operational consequences.
For METRICS, this leads to a very practical question:
If part of the system is compromised tomorrow, which essential functions must continue operating, which can be isolated, and how can control be safely restored?
Resilience therefore means more than preventing an attack.
It means detecting threats, containing incidents, operating under degraded conditions, making timely decisions and restoring mission capabilities.
Six Operational Priorities
1. Embed Security from the Design Stage
Threat modelling, critical asset traceability, attack scenarios and recovery mechanisms must be defined before launch.
The report also proposes developing European reference architectures to reduce fragmentation and accelerate certification.
2. Prioritise the Hardening of Ground Infrastructure
The most urgent measures include strong authentication, least-privilege access, network segmentation, zero-trust architectures, cryptographic protection of commands and telemetry, and continuous monitoring.
NIST IR 8401 https://csrc.nist.gov/pubs/ir/8401/final provides an established framework for applying risk management principles to satellite command and control systems.
3. Prepare Now for the Post-Quantum Transition
Satellites designed today may still be operational when some existing cryptographic protections become insufficient.
The immediate priority is therefore cryptographic agility: the ability to change algorithms, secure remote updates and temporarily combine conventional and post-quantum cryptography.
4. Test Operational Continuity, Not Just Vulnerabilities
Exercises must demonstrate that essential functions can survive a compromise.
Digital twins, cyber ranges, crisis simulations, penetration testing and governance exercises should bring together technical teams, senior executives, legal advisers, communications specialists, suppliers and public authorities.
5. Turn the Supply Chain into a Chain of Trust
Organisations must understand the origin of software and components, monitor vulnerabilities, qualify alternative suppliers and incorporate security requirements into contracts.
A dependency without a viable replacement becomes a strategic risk, even when the supplier continues to perform well technically.
6. Share Threat Intelligence Before a Crisis
No operator can anticipate every threat alone.
The report recommends stronger cooperation between the EU Space ISAC, ENISA, national computer security incident response teams, industry and European institutions.
Over time, this information-sharing process must become faster, increasingly automated and compatible with confidentiality requirements.
Europe's Response
The European Union is progressively developing a coherent framework connecting sovereignty, regulation and industrial policy.
The proposed EU Space Act is built around three pillars: the safety of space activities, digital resilience and sustainability.
Its resilience provisions envisage proportionate cybersecurity, risk management and incident reporting requirements for European operators and non-European operators serving the EU market.
The European Commission presents this initiative https://commission.europa.eu/news-and-media/news/eu-space-act-enhancing-market-access-and-space-safety-2025-06-25_en as a way to reduce regulatory fragmentation while safeguarding the continuity of space services.
However, the report delivers an essential warning:
Regulation does not automatically create capability.
Europe must still translate its rules into qualified technologies, specialist expertise, testing infrastructure, sovereign industrial solutions and genuinely operational cooperation mechanisms.
The Takeaway for METRICS
Space-related risks perfectly illustrate the new reality of risk management: highly complex systems, invisible dependencies, long operational lifecycles and crises that can unfold at extraordinary speed.
Meaningful anticipation is no longer about producing an annual list of risks.
It is about continuously building the capacity to detect emerging threats, test assumptions, contain cascading failures and maintain essential operations under attack.
This is precisely the approach promoted by METRICS: moving beyond risk identification towards measurable preparedness, operational resilience and effective crisis management.
METRICS SUMMIT 2027 — From Risk to Resilience
7–8 July 2027 | Paris, France
Anticipating threats. Protecting critical systems. Strengthening European resilience.
Discover METRICS https://www.metrics-summit.org/fr/themes