Europe's space sector has become critical infrastructure, central to defence, communications, navigation, crisis management and the economy. Yet this growing dependence is also creating new vulnerabilities. From satellites to ground stations, from data to suppliers, Europe must now make cybersecurity a fundamental condition of its sovereignty.
European space infrastructure has become a strategic asset underpinning sovereignty. It supports defence, communications, navigation, Earth observation, crisis management and an increasing share of economic activity. This dependence enhances the strategic value of orbital systems and their ground segments, but also expands their attack surface.
The response can no longer rely solely on the technical protection of satellites. It must combine industrial policy, data governance, supplier security, operational continuity and European cooperation.
Space resilience depends as much on the robustness of digital architectures as on organisations' ability to identify their assets, control access, establish contractual security requirements and assess the risks introduced by their partners.
Figures on the cybersecurity maturity of French companies confirm that the most dangerous vulnerabilities often arise from ordinary misconfigurations, obsolete technologies or exposed services. The challenge is therefore to transform cybersecurity into a management discipline, from major European programmes to the smallest companies in the value chain.
Defence-related space activities do not operate in isolation. They encompass satellites, ground stations, networks, data platforms, software, cloud services, control centres, industrial equipment and service providers. A weakness in an apparently secondary service can compromise a critical mission. Security must therefore cover physical infrastructure, information systems, data and the contractual relationships connecting all stakeholders.
Space as an Infrastructure of Sovereignty
The European Commission's Directorate-General for Defence Industry and Space distinguishes between two complementary dimensions.
The first is the use of space for defence. It covers the space capabilities required for intelligence gathering, the preparation and conduct of military operations, and the assessment of their effects.
The second is the defence of space itself. This involves threat detection, the protection of assets and services, responses to attacks and, where necessary, military operations in orbit.
This distinction highlights the full scope of space cybersecurity. Protecting a satellite against intrusion is not enough. It is also necessary to guarantee the availability and integrity of services using satellite data, maintain communications links and preserve decision-making capabilities in contested or degraded environments.
Other challenges include orbital congestion, collision risks, radio spectrum management, space situational awareness, operational compliance and interoperability between national and European capabilities.
Research on space traffic management therefore advocates a federated European approach. Such a model would combine national capabilities within a coherent, scalable and sovereign framework.
This approach draws in particular on work undertaken for the French National Centre for Space Studies (CNES), the European Space Surveillance and Tracking system (EU SST) and the French Space Command.
Federation addresses two complementary needs: sharing useful information while maintaining controlled governance over sensitive capabilities.
The Expansion of European Programmes
Established in 2020 from activities previously managed by the Directorate-General responsible for the internal market, the European Directorate-General dedicated to defence industry and space comprises five directorates, five working groups, sixteen units and approximately 400 staff members.
It also organises around twenty-five events annually across its ecosystem and beyond.
This structure reflects the rapid expansion of European responsibilities in defence, space and secure connectivity.
Defence industrial programmes include the European Defence Fund, EDIRPA, ASAP, SAFE, EDIP, the Ukraine Support Loan, AGILE, the ECF initiative still under negotiation, and a component dedicated to space capabilities.
The budget figures cited reveal a significant increase in scale.
Defence industrial programmes Budget
2014–2020 €0.59 billion
2021–2027 Approximately €8 billion
2028–2034 €131 billion proposed
In the field of space and secure connectivity alone, available figures indicate €15 billion for 2021–2027, followed by a projected range of €40–60 billion for 2028–2034.
These programmes cover navigation and timing, Earth observation, secure connectivity, space situational awareness, access to space, technological sovereignty and the space economy.
They also encompass governmental Earth observation services, orbital object tracking, space traffic management, frequency monitoring, artificial intelligence and quantum technologies.
European space programmes Budget
2021–2027 €15 billion
2028–2034 €40–60 billion envisaged
The European Space Shield: The Next Step
The European Union Space Strategy for Security and Defence, adopted in 2023, established four objectives.
It seeks to strengthen the resilience and protection of European space systems, organise responses to threats, develop the use of space for security and defence, and promote responsible behaviour in space.
The 2023 strategy recognised space as a contested domain.
The EU Preparedness Union Strategy, published in 2025, identified space services as critical enablers of civilian and military resilience and continuity, while explicitly calling for a European Space Shield.
The Defence Readiness Roadmap 2030 subsequently presented this shield as an initiative designed to enable European and national space assets to continue operating in contested or degraded environments.
An action plan is expected to translate this political ambition into concrete measures. Its adoption is announced for December 2026.
The plan is intended to connect existing capabilities, close critical gaps and protect European space infrastructure, with industry acting as an indispensable partner.
This approach places cybersecurity at the heart of space policy, because an effective shield depends on trust in the software, networks, data and suppliers supporting every mission.
Data Spaces as Strategic Infrastructure
The concept of a European Space Data Space starts from a straightforward observation.
Data generated by satellites, space safety missions, navigation systems and communications services remain fragmented across numerous public and private platforms.
Their value increases when they can be discovered, combined and processed beyond their original environments.
However, such pooling can only succeed if data holders retain control over access and usage conditions.
A data space therefore brings together five components.
First, a governance mechanism establishes rights through legislation, administrative rules and contracts.
Second, a secure IT infrastructure protects confidentiality.
Third, data holders determine who may access their data, for what purpose and under which conditions.
Fourth, large volumes of resources become available, either free of charge or for payment, according to the holder's choice.
Finally, the system remains open to a potentially broad range of organisations and individuals, subject to membership and compliance requirements.
An Architecture Built on Trust and Federation
The proposed architecture clearly separates governance, federation services, participants and value-creating services.
The governance authority defines roles, the business model, legal agreements, responsibilities, membership criteria, access rights, security rules and audit procedures.
These rules apply to all participants and must incorporate both European requirements and the specific constraints of the space sector.
Component Function Main Deliverables
Governance Establish common rules Roles, business model, legal agreements, liability, membership, rights and audits
Identity and Trust Verify participants and their authorisations Organisations, individuals, credentials, authorisations and European digital identity wallets
Catalogues and Semantics Discover and understand resources Common models, vocabularies, registries and descriptions
Policies and Assurance Enforce rights and demonstrate compliance Access and usage rules, controls, audits and traceability
Participant Agents Connect providers and users Connectors, identity, policies, contracts, authorisations and access to processing
Value-Added Services Transform data into practical applications Collaboration, analytics, artificial intelligence, digital twins and data processing
Federation services provide identity management, trust, data discovery, semantic alignment, policy enforcement and traceability.
Providers and users each connect through an agent capable of managing identities, permissions and usage rules.
Contracts govern these relationships, while access may concern either the data itself or computing capabilities.
Marketplaces and payment mechanisms remain optional, depending on the chosen business model.
Interoperability must extend beyond the space sector.
Rules, semantic models, trust mechanisms and protocols must be capable of interacting with data spaces in mobility, tourism, agriculture, smart cities, healthcare, energy, finance and industry.
The architecture references several existing building blocks, including the Data Spaces Support Centre Blueprint, Gaia-X, IDSA, Eclipse, Prometheus-X, iSHARE, Simpl, FIWARE and the geospatial standards of the Open Geospatial Consortium.
Civilian and Governmental Use Cases
The Space Data Space is intended to federate information generated by Earth observation, navigation and communications satellites, as well as space safety missions.
It operates above the underlying infrastructure and can connect to the Copernicus Data Space, Destination Earth, Gaia-X federated services and a public open-data platform designed in particular for artificial intelligence applications.
The €20 million funding allocated to this platform illustrates the ambition to develop shared services.
Potential applications include healthcare, industry, agriculture, culture, mobility, the green transition, security, public administration, media and finance.
Two examples demonstrate the sensitivity of these services.
Space traffic management requires controlled information sharing concerning orbital objects, radio spectrum and collision risks.
The governmental Earth observation service must generate value-added geospatial intelligence restricted to authorised public users, supporting preparedness, decision-making, security and defence.
Its operation rests on three pillars: services and data, infrastructure, and governance.
Security Must Be Built In from the Start
The example of Skynopy illustrates the operational application of these principles in the ground segment.
The company states that it incorporated security from its inception and obtained ISO/IEC 27001 certification for its Ground Station as a Service activities.
For satellite operators, agencies and defence administrations, this certification provides an important signal of trust, but it does not replace risk assessment.
Two principles are essential.
First, security measures must be proportionate to the risk and the potential cost of the loss they are intended to prevent.
Second, fundamental security practices must take priority over fashionable technologies.
An attack may begin with a forgotten access permission, a weak password or an unpatched server.
An organisation that neglects these fundamentals will not become secure simply by adding more sophisticated mechanisms.
This approach directly reflects the maturity requirements established for the defence technological and industrial base.
Artificial intelligence, cybersecurity and post-quantum cryptography are also among the solutions being explored to strengthen the resilience of space services.
Solutions developed by Seclab, Alyon.ai and Aldoria illustrate the diversity of companies involved.
The available information does not, however, provide sufficient detail to assess their technical results here.
Their participation in this ecosystem primarily confirms that protecting space infrastructure increasingly requires network security, automated information processing and preparation for the cryptographic transition.
Cybersecurity Is Becoming an Economic and Contractual Issue
Figures drawn from the French National Cybersecurity Agency's (ANSSI) 2025 Cyber Threat Landscape report reveal a persistent threat.
In 2025, the agency handled 3,586 security events, representing an 18% decrease compared with 2024.
However, the number of recorded incidents in the series increased from 831 in 2022 to 1,112 in 2023, 1,361 in 2024 and 1,366 in 2025.
The report also mentions 128 ransomware compromises in 2025, 48% of which targeted microenterprises and small and medium-sized enterprises.
Cybersecurity directly affects data, business continuity, customer and partner trust, defence value chains and market access.
For a defence supplier, insufficient cybersecurity maturity may therefore result in operational disruption, information loss or exclusion from a contract.
Security is no longer merely a technical issue delegated to a specialist team.
It has become a condition of competitiveness and a responsibility of senior management.
The Fundamental Cyber Maturity Framework
The French Fundamental Cyber Maturity Framework (Référentiel de maturité cyber fondamental) responds to the increasing exposure of defence supply chains and the fragmentation of security requirements among major contractors.
Its development began in 2019 with a cybersecurity agreement between the French Ministry of the Armed Forces and eight major industrial contractors.
In 2022, government-industry working groups focused on the wartime economy reinforced this initiative.
Two fundamental frameworks covering physical security and cybersecurity emerged in 2023.
In July 2026, a guide explaining how to understand and apply the framework was published.
The working group is led by the French Directorate General of Armaments (DGA), alongside the eight industrial contractors involved in the cybersecurity agreement, with support from ANSSI.
Three objectives are identified: improving the cybersecurity level of defence companies, preserving their access to international markets and preventing economic damage.
The approach prioritises measures applicable to companies of all sizes, supported by practical improvement guides available through the French Ministry of the Armed Forces.
Twenty-One Requirements Across Four Areas
The framework contains twenty-one fundamental requirements.
Each requirement is scored from one to four, with compliance achieved at level three.
Any requirement deemed inapplicable must be justified.
The framework has two principal uses.
It may be imposed by a prime contractor on its suppliers through contractual provisions.
Alternatively, companies may use it for self-assessment to measure and demonstrate their maturity, with the possibility of future certification.
Area Requirements Main Management Question
Governance 6 Do we know what needs protection and who is accountable?
Protection 13 Are access rights, equipment and data adequately protected?
Defence 1 Can we respond to incidents and alert customers?
Resilience 1 Can we restore operations after disruption?
Governance requires management ownership of cyber risks, identification of sensitive information, appointment of responsible individuals and employee awareness.
Protection covers filtering, security patches, individual access accounts, strong passwords and separate administrator accounts.
Defence requires an incident management plan and notification procedures for customers and the national authority.
Resilience requires backups separated from the information system and regularly tested restoration procedures.
The framework can be summarised through five questions for senior executives.
Does the company know which information is genuinely sensitive and where it is stored?
Is someone clearly responsible for cybersecurity and accountable to management?
Are access rights, remote connections, administrator accounts and passwords properly controlled?
Could the organisation rapidly resume operations following a ransomware attack?
Finally, can its cybersecurity maturity be demonstrated through an attestation and verifiable evidence?
Management Attestation and Supporting Evidence
The requirement is being progressively incorporated into defence procurement contracts through the DGA's contractual clauses and is intended to be harmonised among major contractors.
Companies assess themselves using the official evaluation grid.
The chief executive signs an attestation valid for a maximum of three years and reviews it annually.
Supporting evidence must remain available in the event of an audit.
This combination makes the declaration a genuine governance commitment rather than a purely administrative formality.
Support mechanisms are also available.
The Cyber Défense diagnostic is announced as 50% subsidised.
The French Defence Intelligence and Security Directorate (DRSD) can provide free advice.
The DGA also operates a cybersecurity support unit for small and medium-sized enterprises.
Three issues deserve particular attention.
There is no single mandatory deadline for applying security patches, but delays and exceptions must be identified, documented and mitigated.
The scope includes machine tools and industrial IT systems.
Finally, outsourcing to a cloud provider or another service provider does not transfer responsibility, and remote hosting does not in itself constitute a backup.
Alignment with Other Cybersecurity Frameworks
The Fundamental Cyber Maturity Framework does not replace existing standards.
It provides a common baseline adapted to French defence suppliers.
Equivalences have been validated or are under consideration to avoid duplicating compliance efforts.
The guide specifies, in particular, that the Bronze level of Aircyber provides an equivalence.
A company already working towards ISO/IEC 27001 certification or NIS2 compliance will therefore have completed part of the necessary work, although it must still demonstrate the specific requirements applicable to defence contracts.
Framework Target Organisations Approach
Fundamental Cyber Maturity Framework Defence industrial and technological suppliers 21 baseline measures, management attestation and evidence
Aircyber Aerospace suppliers 45 questions and three maturity levels
ReCyF Entities covered by NIS2 20 regulatory security objectives
CMMC 2.0 US Department of Defense suppliers Three levels of defence information protection
Cyber Essentials UK organisations Five fundamental technical controls
ISO/IEC 27001 All organisations Information security management system
The Fundamental Cyber Maturity Framework relies on executive attestation, audit evidence and progressively introduced contractual clauses.
Aircyber offers optional certification, although major contractors may expect suppliers to comply.
ReCyF provides for oversight by the national authority following transposition.
CMMC 2.0 requires third-party assessment from level two and is linked to DFARS contractual provisions.
Cyber Essentials involves verified self-assessment or technical auditing, with annual renewal.
ISO/IEC 27001 certification is performed by an accredited body on a three-year cycle.
From Assessment to Commercial Advantage
The proposed process begins with a requirement-by-requirement self-assessment.
The company then identifies gaps, prioritises them by area and determines whether it can act independently or requires external assistance.
This initial assessment is neither an audit nor a certification.
Its purpose is to establish an objective baseline and support management decisions.
Progress follows three stages.
Understand: conduct the diagnostic, interview management and operational teams, and map gaps and critical risks.
Decide: prioritise actions according to risk, estimate costs, allocate resources and align the framework with NIS2.
Transform: oversee implementation, prepare the executive attestation and demonstrate improvements to customers.
Cybersecurity can then become a verifiable commercial advantage, provided that supporting evidence reflects measures genuinely implemented.
Measuring Third-Party Risk at Scale
Board of Cyber's experience broadens the discussion to the management of third-party risk.
The company offers automated, non-intrusive assessments of externally visible attack surfaces, either periodically or continuously.
Its objective is to assess, monitor and manage an organisation's cybersecurity maturity alongside that of its wider ecosystem.
This approach addresses a fundamental reality of the space sector: the security of an interconnected chain depends on its most exposed participant.
The 2026 NIS2 Panorama covers more than 21,700 French entities, 7.4 million observables and 2.8 million assets across eighteen sectors.
The analysis assigns scores ranging from zero to 1,000 based on the externally visible attack surface.
Six recurring anomalies are highlighted: an LDAP port accessible from the internet, end-of-life technologies, missing SPF records, a DMARC policy left in monitoring-only mode, invalid or expired TLS certificates, and a wildcard CNAME record on the primary domain.
Five of these six anomalies can be corrected through configuration changes within a few weeks.
Managing obsolete technologies, however, requires an ongoing process.
The Space Sector Occupies a Middle Position
The sectoral comparison measures the proportion of entities classified as having advanced cybersecurity maturity.
Banking leads with 60.2%, followed by financial markets at 57.9%.
The space sector stands at 36.9%, between drinking water at 38.3% and transport at 36%.
This places the sector well below the highest-performing industries, despite the critical functions supported by its services.
Sector Advanced Cybersecurity Maturity
Banking 60.2%
Financial markets 57.9%
Healthcare 46.3%
Energy 43.5%
Food industry 40.0%
Chemicals 39.4%
Manufacturing 38.9%
Drinking water 38.3%
Space 36.9%
Transport 36.0%
Research 33.6%
Postal services 32.9%
Waste management 30.4%
Wastewater 29.0%
Assessment of 170 Space Companies
The observatory covering 170 companies in the space sector in Brittany reports an average score of 705 out of 1,000.
Nine companies are classified at the basic level, 98 at the intermediate level and 63 at the advanced level.
Performance varies significantly across the areas assessed.
Security controls perform relatively well, while attack surface management, email security and vulnerabilities reveal more substantial gaps.
The main finding remains concerning.
Nine out of ten companies have at least one high-severity or critical issue requiring remediation.
Exposed ports represent a critical issue for 8.2% of companies.
Email configuration presents a significant issue for 54%.
Web and TLS-related weaknesses affect 44%.
Security controls involving DNSSEC and DNS records affect 11%.
Technologies requiring updates are found in 59% of companies and must be addressed through planned remediation.
Vulnerability Category Companies Affected Priority
Exposed ports 8.2% Critical and urgent
Email configuration 54% Significant
Web and TLS 44% Significant
DNSSEC and DNS records 11% Remediation required
Outdated technologies 59% Planned remediation
A Phased Action Plan Based on Urgency
The proposed action plan divides remediation into four time horizons.
Within 72 hours, organisations must close critical exposures, particularly publicly accessible ports and anonymous LDAP services.
These services can be filtered or placed behind a firewall.
If exposure has persisted for a prolonged period, credentials should be rotated and logs examined.
Fourteen companies are directly affected by this priority.
Within 30 days, efforts should focus on email security, certificates and HTTP.
Organisations should configure DMARC and SPF, remove unnecessary email records, renew defective certificates and eliminate insecure web connections.
Within 90 days, priority shifts to updating web servers, programming languages and content management systems.
Web servers account for 82% of critical vulnerabilities, and the study identifies 10,601 potentially critical vulnerabilities on these servers.
The fourth stage is continuous.
Companies must regularly measure their external cybersecurity maturity, verify that remediation remains effective and monitor the progress of their partners.
This monitoring complements the maturity framework.
One provides a visible measurement of external exposure, while the other structures governance, processes and internal evidence.
Together, they offer a more realistic understanding of risk.
What Business Leaders Need to Understand
Protecting Europe's space infrastructure depends on a coherent chain of decisions.
Institutions must finance capabilities, establish common rules and coordinate responses to threats.
Operators must secure satellites, ground stations, networks and data.
Prime contractors must harmonise requirements and verify supporting evidence.
Suppliers must identify sensitive assets, control access, test backups and correct visible exposures.
None of these levels can sustainably compensate for weaknesses in the others.
Data governance is becoming as important as data protection itself.
A Space Data Space creates value only when usage rights, identities, contracts, semantic models and audit mechanisms are shared.
European federation enables services to be pooled while allowing data holders to retain control.
It provides a framework suited to sensitive information, cross-sector exchanges and sovereign applications.
Finally, resilience is not simply a matter of acquiring technology.
The weaknesses observed frequently arise from open ports, expired certificates, incomplete email security rules, obsolete components and poorly managed access rights.
These problems are well known and can be corrected.
Their persistence demonstrates that the first priority must be disciplined execution, supported by clear governance, explicit responsibilities, risk-based deadlines and regular measurement of progress.
Europe now has strategies, programmes and funding mechanisms capable of strengthening its strategic autonomy.
Success will depend on translating these ambitions into contracts, architectures and everyday practices across the entire ecosystem.
In a sector where civilian, military and commercial missions increasingly share the same infrastructure, cybersecurity is the operational foundation of space sovereignty.
Discover the Full METRICS Programme
Explore the complete congress programme, its strategic themes and the opportunities to contribute as a speaker, become a sponsor or participate in the discussions.
METRICS SUMMIT 2027 — From Risk to Resilience
7–8 July 2027 | Paris, France
Explore METRICS themes and programme https://www.metrics-summit.org/fr/themes
Sources
French Directorate General of Armaments (DGA), Fundamental Cyber Maturity Framework: Understanding and Applying the Framework, 15 July 2026.
SDI SecNum 2217 Guide, Edition 03.
French National Cybersecurity Agency (ANSSI), 2025 Cyber Threat Landscape, 11 March 2026.
Board of Cyber, NIS2 Panorama 2026 and observatory covering 170 companies in the space sector.
European Commission, Directorate-General for Defence Industry and Space (DG DEFIS), policies and programmes relating to space and defence.