The satellite industry keeps discovering that its weakest link sits on the ground rather than in orbit, and a new opinion piece argues the fix may already exist in a certification regime operators have used for decades.
A sector that grew up trusting obscurity
Jon Fielding, who runs Apricorn’s EMEA business, writes that space has long lagged other critical infrastructure on cyber maturity.
He cites a February warning from the Bloomsbury Intelligence and Security Institute that a US ground station faces a credible ransomware risk and that a systemic failure is plausible by 2027 if regulators keep leaving a gap. A UK government study of cloud computing in the ground segment found European operators behind on basic hygiene, with smaller companies far more exposed than large incumbents.
Cloud access widens the blast radius
Ground Station as a Service is pulling previously air-gapped control systems into shared infrastructure, the piece argues, connecting facilities that were once isolated and putting both operator and spacecraft within reach of one compromise.
Fielding points to the 2022 KA-SAT breach as the reference case. The two-phase operation, blamed on Russian military intelligence, seized a VPN to reach management servers and then pushed wiper malware that knocked out tens of thousands of modems.
The paper trail as a security control
His answer is supplier assurance: vendor risk management, third-party audits and security clauses written into contracts, backed by end-to-end encryption from spacecraft to storage.
The concrete tool is AS9100, the aerospace quality management standard. It builds on ISO 9001 with more than a hundred additional requirements covering risk management, configuration control, counterfeit-part prevention and regular supplier review, giving buyers evidence that hardware was made to a repeatable process. Fielding concedes regulation is unfinished, with the EU Space Act not expected to bite until 2030.
