The European Cybersecurity Organisation (ECSO) has called for a dedicated European industrial policy for space cybersecurity, warning that regulatory measures alone will not deliver the capabilities needed to protect the continent’s increasingly critical space infrastructure. The agency proposed a long-term public-private partnership to coordinate investment, innovation, intelligence sharing, certification and incident response across Europe’s space sector.
In a publication titled ‘EU Cybersecurity Industrial Policy for Space,’ ECSO said Europe needs a coordinated strategy focused on trusted supply chains, sovereign technologies and skilled talent as satellites and interconnected ground systems become increasingly important to navigation, communications, finance and climate monitoring. The report identifies the long operational lives of satellites, limited opportunities to update systems after launch and growing reliance on commercial technologies as distinct cybersecurity challenges.
The publication identifies six priority areas, including security-by-design across the system lifecycle, post-quantum cryptography, stronger ground-segment defenses, continuous security testing, supply-chain assurance and improved threat intelligence sharing. It also calls for measures such as zero-trust architectures, stronger identity and access management, cryptographic protection of command and telemetry links, software bills of materials and mission-specific cybersecurity training. ECSO said coordinated investment in these areas would support cyber resilience, competitiveness, strategic autonomy, European leadership and credible deterrence and response.
Europe has built a coherent policy framework for space security, from the Strategic Compass and the EU Space Strategy for Security and Defence to the proposed EU Space Act of 25 June 2025. Its resilience pillar would replace some thirteen national regimes with a single set of cybersecurity, risk-management and incident-reporting rules for EU and non-EU space and ground-segment operators, supported by NIS2, the Cyber Resilience Act and related instruments.
Regulation alone does not create industrial capability, so the paper calls for an industrial policy built on an enduring public-private partnership modelled on the 2016 ECSO partnership. It would secure trusted supply chains, sovereign technologies and skilled people, and rely on enabling technologies such as post-quantum cryptography, crypto-agility and zero-trust architecture, which must themselves be designed and assured carefully to avoid widening the attack surface.
Building on this analysis, the paper identifies the priority areas in which coordinated European investment is most urgently required, providing a foundation for future industrial policy discussions and initiatives in support of a secure, resilient and competitive European space ecosystem.
The initial priority is security-by-design and lifecycle integration, which means embedding threat modelling and testable security from the earliest design phases. This work would be anchored by an open, EU-led reference implementation for secure space missions, harmonised with ECSS, CCSDS, ETSI and ENISA guidance to reduce fragmentation and accelerate certification. The second priority is the transition to post-quantum cryptography. It involves developing lightweight and hybrid schemes and secure over-the-air update mechanisms, and embedding post-quantum readiness in system engineering, so that long-lived assets remain protected against a maturing quantum threat.
The third priority is ground-segment hardening, which focuses on identity and access management, classification-aware segmentation, zero-trust architectures and cryptographic protection of command and telemetry links, since the ground segment remains the most common point of entry. The fourth priority is continuous testing and validation. Controls would be exercised through cyber ranges and digital twins, red- and purple-teaming, compliance-as-code and continuous monitoring, with incident response practised as a whole-of-organisation function rather than a purely technical one.
The fifth priority is governance, supply-chain assurance and human factors. This includes establishing board-level accountability, software bills of materials and continuous supplier assurance, introducing more agile and continuous accreditation, and providing role-based, mission-specific training. The sixth priority is intelligence sharing and sector engagement, which means evolving towards machine-actionable, classification-aware and near-real-time threat intelligence, anchored in the EU Space ISAC and reinforced by the Cyber Solidarity Act.
Pursued together, these priorities serve the five objectives at the heart of this framework: cyber resilience, competitiveness, strategic autonomy, leadership, and credible deterrence and response. Europe has the institutions, the industrial base and the knowledge capital to lead the world in secure, resilient and sovereign space capabilities. What remains is to align them – to move from fragmented progress to integrated capability, and to ensure that innovation never outpaces security. The decisions Europe takes in this decade will determine whether the space infrastructure on which its economy, society and security now depend remains firmly, and durably, under European control.
In conclusion, Europe’s space cybersecurity posture is advancing across all four dimensions. Strategic direction is increasingly clear, operational capability is improving, tactical execution is strengthening, and technical innovation is substantial. Yet the system remains uneven and partially fragmented. Success over the coming decade will depend on Europe’s ability to align four layers simultaneously, while ensuring coherence across the core technology domains.
The ECSO report highlighted that Cybersecurity has become an integral component of the resilience and competitiveness of the European space sector. The analysis in this document shows that cybersecurity must be addressed across the full mission lifecycle and across interconnected space, ground, digital and supply-chain layers. The EU policy and regulatory framework increasingly establishes common cybersecurity and resilience requirements for the sector. The industrial-policy challenge is to translate these requirements into deployable and qualified capabilities.
It also identifies priority areas including security-by-design and lifecycle integration, cryptographic agility and the transition to PQC, ground-segment security, continuous testing and validation, supply-chain assurance, strategic-dependency assessment, human factors and trusted threat-information sharing.
ECSO prescribed that investment should be directed to five technology areas. The first is cryptography and its applications, which covers the quantum-safe migration of space systems and communications, cryptographic agility, high-assurance key management, and space-qualified cryptographic primitives, libraries and hardware.
The second is advanced computing, which includes trusted and radiation-tolerant processors, hardware roots of trust and secure onboard computing, confidential computing, secure space-edge-ground-cloud orchestration, and European space-grade computing components. The third is future communication networks, which involves secure terrestrial-space and multi-orbit architectures, quantum-safe communications, anti-jamming and anti-spoofing capabilities, zero-trust access, and secure software-defined communications.
The fourth is virtualisation and simulation, which covers high-assurance virtualised mission infrastructure, trusted digital twins and space cyber ranges, together with secure software-defined systems and validation environments. The fifth is data and AI, which includes secure and sovereign data spaces, trustworthy AI, protected mission-data pipelines, privacy-preserving and federated processing, and resilient storage and recovery for mission-critical data.
Investment in these areas should not stop at technology development. Priority should also go to the capabilities needed to bring these technologies into operational use: reusable secure mission architectures, space-qualified cryptographic and computing products, space-specific ground-segment security tools, shared cyber ranges and digital-twin environments, automated assurance and accreditation, and trusted threat-intelligence infrastructure. This requires a combination of targeted R&D, product maturation and qualification, shared testing infrastructure, and procurement mechanisms that support deployment and reuse across missions.
It also observed that European investment should focus not only on developing new solutions but also on turning existing and emerging technologies into qualified, interoperable and scalable capabilities that can be adopted across the European space ecosystem.
