The European Union Agency for Cybersecurity rated the space sector as highly critical for the first time in its third annual NIS360 report, published May 28, 2026, and placed it inside the report's "risk zone" alongside healthcare, railways, maritime transport, and four other sectors whose cybersecurity maturity trails what their importance now demands.
A criticality upgrade, a maturity freeze
NIS360 benchmarks the sectors covered by the EU's NIS2 Directive across two axes: how critical a sector is to society and the economy, and how mature its cybersecurity actually is, scored across legislation, company preparedness, regulatory capacity, and the sector's wider ecosystem. In the 2026 edition of the report, ENISA revised the space sector's criticality score upward for the first time, citing its expanding role across other industries, from navigation and timing to weather forecasting and financial transactions. Railways received the same upward revision.
Maturity did not move the same way. Analysis from Covington's Inside Privacy places space in ENISA's risk zone, the quadrant reserved for sectors where cybersecurity maturity sits below the level their criticality now warrants. The firm points to wide variation between individual operators, some with mature governance and incident-response programs, others with little formal structure at all, and to the absence of a dedicated EU-level forum where space operators can coordinate on cybersecurity the way energy or finance operators already do.
What risk zone means in practice
ENISA's risk zone is not a prediction of imminent attack. It is a structural warning: a sector where the gap between dependency and defense is widening rather than closing. Space joins healthcare, railways, maritime transport, ICT service management, public administration, and water services in that quadrant this year. For space specifically, analysts covering the report point to heavy reliance on commercial off-the-shelf components with limited security testing, and incident-response practices that remain reactive rather than rehearsed.
The 2022 attack on Viasat's KA-SAT network, which knocked out internet service for tens of thousands of customers across Europe hours before Russia's invasion of Ukraine, remains the sector's reference incident four years later. Viasat maintains the satellites themselves were never compromised; investigators traced the disruption to the ground-based management network and wiper malware pushed to modems, a distinction that still shapes how regulators think about where space-sector cyber risk actually concentrates.
The law meant to close the gap
The European Commission proposed the EU Space Act on June 25, 2025, as COM(2025) 335 final, with a cybersecurity chapter built for exactly this problem. The draft would require space operators to run an information security management system, enforce access controls, detect and report incidents, use cryptography, and maintain backup and business-continuity plans. Security-by-design would become a condition of market authorization rather than a recommendation. Operators would also have to undergo threat-led penetration testing before launch, or before the first batch of satellites for a constellation, and at least every three years afterward. The obligations would extend beyond EU companies to non-EU spacecraft, launch, and ground-station operators selling into the European market, with application proposed from January 1, 2030 after a two-year transition.
What stalled it
The Act has not reached the European Parliament for a floor vote. The Competitiveness Council concluded in May 2026 that the text was not ready for adoption and referred it back for further work, according to Space Intel Report, nearly eleven months and two revisions after the Commission's original text. Member states remain split over how much autonomy to keep over military space systems, how to classify dual-use assets, and how far obligations should reach into non-EU operators.
Cybersecurity sits at the center of a separate fight, this one over the Act's relationship to NIS2. The Commission's proposal would let the Space Act serve as the specialized law for space cybersecurity, replacing general NIS2 obligations for operators that qualify as essential or important entities, as described in analysis from the Journal of Space Commerce. The Council has pushed back, preferring to keep NIS2 as the primary framework for large operators already inside its scope while using the Space Act to extend harmonized rules to smaller companies and non-EU entities that NIS2 does not currently reach, a position detailed by Hogan Lovells. Parliament has yet to finalize its own negotiating position, meaning trilogue talks between the three institutions have not formally begun.
The timing leaves European regulators with a diagnosis but no prescription yet in force. ENISA's own assessment is that space's criticality has already outpaced the rules written to govern it, and the law built to close that gap is still waiting on member states to agree on what it should require of their own militaries.
This story draws on ENISA's NIS360 2026 report and reporting from Security Affairs, Covington's Inside Privacy, Space Intel Report, the Journal of Space Commerce, and Hogan Lovells.
