The next cyber battlefield is in space

Star Trek fan or not, most people recognize the quote “"Space: the final frontier". The formulation has gained new relevance when space has once again become a strategic arena, not least after SpaceX's IPO on June 12. For companies and authorities, the problem is that space is no longer something distant, but is already part of the digital infrastructure that businesses, customers and critical societal functions depend on every day.

Satellites, ground stations, communication links and mission control systems are now interconnected with cloud services, corporate networks, industrial systems, logistics flows and financial transactions. As a result, space is no longer just a matter for the space industry, but also part of the corporate attack surface.

It’s a shift that many organizations have yet to embrace. Most companies don’t build satellites and don’t see themselves as part of the space sector. Yet they use services that rely on satellite infrastructure. Navigation, timing, communications, payments, transportation, and connectivity are just a few examples. The dependencies are often deeply integrated, but rarely clearly mapped. And as the attack surface changes, so do the risks. The digital environment is no longer limited to your own network, a supply chain, or a cloud platform. It is distributed, global, and three-dimensional, stretching from ground-based systems all the way up to low Earth orbit.

All of this makes space infrastructure an attractive target. When satellite-based services are used for connectivity and direct communication with devices, they also become attractive to state actors and other attackers who want to disrupt, destabilize or knock out critical functions. An attack on satellite communications or ground-based support systems can therefore quickly have consequences far beyond the space sector.

Disruptions in satellite-based timing signals can affect financial transactions and telecom networks in a matter of seconds. Satellite communication outages can impair visibility in logistics chains, disrupt transportation, and make coordination between systems on the ground more difficult. What starts as a technically isolated incident can quickly spread to multiple industries and hundreds of organizations.

At the same time, AI lowers the threshold for attackers. Large Language Models (LLMs) can be used to analyze satellite communications, interpret telemetry, and identify vulnerabilities in complex systems. This shortens the time from vulnerability discovery to exploitation and allows more actors to target environments that previously required highly specialized skills.

In other words: an orbital intrusion does not stay in orbit.

The big risk lies in dependencies that few see. For many organizations, satellite-based services are treated as external services, not as part of their own security environment. This creates a security blind spot. What business-critical processes are affected if satellite communications are disrupted? Which suppliers depend on space-based infrastructure? Which systems stop working if timing signals, positioning or connectivity are affected?

Without this overview, it becomes difficult to assess risk and prioritize the right actions. A state actor who wants to disrupt a logistics company does not necessarily need to attack the company's own network. It may be enough to target satellite communications or ground stations used for real-time monitoring. The attacker then affects the systems on which the company depends and can create a wider disruption than through a direct intrusion.

Companies therefore need to think broader. around cyber risk. It is not enough to inventory your own servers, devices and cloud services. Organizations need to understand how systems, vendors and external services are interconnected across IT, OT, cloud, communications infrastructure and space-based services.

It’s about mapping connections, identifying dependencies, and understanding where the boundaries of trust lie. In this environment, risk is defined not just by individual vulnerabilities, but by the relationships between systems. The most critical risks are often those that create pathways between different environments, especially when external infrastructure is connected to core operations.

The Starship Enterprise in Star Trek set out to explore the unknown. Today’s companies have a much more down-to-earth task: understanding the infrastructure they already depend on. In a three-dimensional attack surface, security is determined not just by what is protected, but by how well the organization understands the connections between systems.

Space is no longer the final frontier. It is part of today's cyber conflict. Resilience will be determined by how well companies understand their exposure before it is put to the test.

Michael Freeman
Head of Threat Intelligence at Armis, one ServiceNow-business.