RESTON, Va. — Space industry CISOs weighed in on the recent service disruption that left Ukrainian forces without connectivity to SpaceX’s Starlink and its military variant Starshield during combat operations with Russia, in a Monday discussion during CyberSat. Without knowing the details of the service agreement, some CISOs condemned the action and highlighted the impact it will have on governments’ continued pursuit of sovereign satellite services.
“It was a crappy thing for them to do,” said Victor Einfeldt, director of IT Security at Iridium. “You don’t play games with human lives in the middle of a war and take away service without communicating it to them first. That can’t become the standard from which we operate our satellite constellations and services.”
With more nations actively building or considering sovereign constellations for mission-critical operations, Einfeldt suggested that sovereignty may soon be defined by “who owns the kill switch.”
Vantor CISO Norm Laudermilch pointed to the severity of the outage. “We’re not talking about an outage here, we’re talking about a change to a critical operational service that a customer was relying on for their mission,” he said.
Laudermilch expects the Starlink disruption will drive competition as customers look for resilience and layered capabilities. “Instead of having one satellite internet provider maybe I need three,” he said. “And maybe I need to design into my end system the ability to route between those three or automatically fail over when one service [degradation] happens.”
There was general agreement that sovereignty does not require every nation to build its own constellation, but that commercial solutions need clear mission expectations between the customer and service provider.
“You can build these sovereign commercial partnerships — and we’re doing it with IRIS² — and give the entity what they need in order to operate,” said Vinit Duggal, SES CISO and vice president of Network Engineering.
Sovereign entities can maintain control and asset visibility, even in a managed service, Duggal added. “The control is still with the sovereign partner,” he said, noting the IRIS² service “kill switch” and payloads will be under the control of the EU partner. SES leads both the Medium-Earth Orbit (MEO) and user terminal component of IRIS², with initial operations planned to begin by 2030.
Agentic AI for Black Hats and Red Teams
In a wide-ranging discussion on cyber issues for the space industry, CISOs also explained why agentic artificial intelligence is better than a security patch, how to defend orbital data centers, and the growing importance of network sovereignty in commercial managed services.
Agentic AI is a double-edged sword that is accelerating threat actors’ capabilities on one side, but also giving organizations a tool to remediate vulnerabilities before they’re found in the wild.
“If you’re still defending things in the traditional way of scanning the network for vulnerabilities and working with system owners to patch, you’re not doing it right anymore,” said Laudermilch. “You’ve got to be defending at machine speed.”
Vantor, which operates a Low-Earth Orbit (LEO) imaging constellation and AI-driven spatial intelligence software, has adopted an “agentic defense factor” in its security operations center (SOC).
The CISOs acknowledged the need to accelerate response time in the aftermath of the PHP web scripting language vulnerability, discovered using AI, and announced by U.S. cybersecurity agencies in an Oct. 21 Common Vulnerabilities and Exposures (CVE) report.
“The community did a good job circling the wagons and getting an understanding of where and how it was vulnerable,” said Duggal. Some 70% of the internet runs on PHP and impacted companies were told to take sites offline for patching. SES, which operates a multi-orbit constellation of 120 satellites and over 100 teleports, had an idea of its exposure and responded without any material impact to the business, Vinit said.
Laudermilch added that agentic AI has “primed the pump” for attackers to act as soon as vulnerabilities come to light. “Within 48 hours of that CVE being announced, we were seeing four to five hundred thousand attacks a day looking for [exploits],” he said of Vantor.
Defending Orbital Data Centers
On orbit data centers have triggered waves of investment and engineering effort, but security is not yet where it needs to be to defend those assets, according to CISOs.
“We are not ready,” Duggal said when asked if the industry is prepared to secure future on-orbit data centers. He cited significant engineering and cybersecurity challenges before data centers in space become a reality. With the rise of on-orbit data processing, Duggal highlighted the growing risk of on-orbit “stalking,” which has been attributed to several Russian and Chinese spacecraft. When users rely on satellites to process intelligence, surveillance and reconnaissance (ISR) data in space, “it just becomes the juicy target for foreign operators, and then it becomes a resiliency issue,” Duggal said.
Intrusion detection, which is a baseline for terrestrial data center security, is another challenge on orbit. Operators will not have real-time access to intrusion detection and response data for a spacecraft, noted Laudermilch, which leads to the conclusion that the spacecraft will have to manage those functions itself.
“We are in the infancy when we’re looking at onboard, IP-layer detection and response,” said Laudermilch. “We have to evolve that technology.”
Vantor is developing its next generation imaging spacecraft, Vantage and Pulse, with automated onboard detection and response. The satellites are scheduled for launch between 2027 and 2029.
Einfeldt reiterated that orbital data centers should follow similar logical security controls as data centers on the ground and also focus on link security to prevent interception. Commercial or military-grade encryption are becoming more common in the satellite control plane but link-layer encryption has not historically been a commercial requirement. Einfeldt also raised questions about encryption for optical inter-satellite links (ISLs) in the future, though the narrow, directional beams are widely considered secure against existing interception methods.
The CISOs overarching message was to build security from the outset and manage risks across network layers and physical boundaries, especially with the rise of onboard compute. “We have to be very conscious about moving workloads into space,” said Laudermilch. “You also need to move all the security intelligence that we use to detect and respond to malicious behavior into space too.”
