Agenda
Where Space Cybersecurity Gets Real
Now in its 9th year, CyberSat delivers its most technical, immersive program to date — designed for those who protect critical space systems and infrastructure. Here’s what you’ll experience:
- 🚨 Two powerful New Tracks: Discover Business, Policy, Partnerships (BPP) – where strategy, acquisition, and mission priorities align & Technology, Threats, Solutions (TTS)
- 🔐 Mission-Driven Keynotes: CISO-level perspectives from government, military, and commercial leaders
- 🔐 Deep-Dive Sessions: Tactics and frameworks to secure satellites, ground systems, and supply chains
- 🧠 Actionable Intelligence: Threat briefings, policy updates, and tools you can implement immediately
If you work in this specific niche area and can only attend one conference, CyberSat is definitely the one to choose.
– Matt Matthews, Principal Security Engineer, Booz Allen Hamilton
Monday, November 17
8:30 am - 9:00 am
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
As the DOD's Chief Information Officer, Ms. Arrington oversees the defense enterprise's most critical IT and space-based systems. In this keynote, she'll bring a senior-level perspective on the intersection of cybersecurity, satellite communications, and national defense priorities, offering insight into the technologies, threats, and decisions shaping our most mission-critical systems.
9:15 am - 9:45 am
Room: Regency Ballroom
Room: Regency Ballroom
A fully cyber resilient system is not only capable of prevention, detection, response, and recovery but also employs cyber resiliency engineering principles from NIST SP 800-160. However, space systems cybersecurity is significantly behind cybersecurity on the ground, lacking even on-board detection capabilities which are an essential prerequisite for cyber resilient space systems. To address this gap, this session will discuss work by the Department of Homeland Security (DHS) Science and Technology Directorate (S&T) to enable on-board detection and cyber threat intelligence sharing for the space industry: Detection indicators for space cyber threats: incorporated into Aerospace SPARTA framework v2.1 Prioritized indicators: to help inform investment decisions by manufacturers and integrators Implemented on-board detectors for NASA Core Flight System (cFS): To bake-in security and serve as reference code for implementing detectors on-board other platforms Operationalizing CTI Sharing Concepts These activities are part of broader efforts by DHS S&T to publish actionable resources for industry to lower the barriers to entry for space systems cybersecurity and aid in progress towards future cyber resilient space systems.
9:15 am - 9:45 am
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
10:00 am - 10:25 am
Room: Regency Ballroom
Room: Regency Ballroom
The TRACTOR program's goal - translating C to safe, idiomatic Rust code, at scale - has the potential to radically change the economics of modernizing legacy software, both eliminating many common classes of software vulnerabilities as well as yielding code that's better structured and more maintainable. As of the date of this talk, TRACTOR will have been running for five months. This talk will both give an overview of the program's goals and aspirations, as well as discuss its progress to date.
10:00 am - 10:50 am
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
The U.S. is ramping up its space ambitions by investing heavily in next-gen capabilities to secure strategic dominance. At the center is the Golden Dome project, which is reshaping the national space posture and accelerating defense innovation. However, in a contested domain, ambition isn't enough. This session explores how rising cyber threats, shifting alliances, and intensifying competition with China are reshaping U.S. space strategy. We'll examine the implications for private-sector partnerships, defense supply chains, and the broader industrial base under the new administration - inside a rapidly evolving space race.
10:25 am - 10:50 am
Room: Regency Ballroom
Room: Regency Ballroom
The focus of the presentation will be to describe a research project involving installing a software version of SNC's Binary Armor cybersecurity solution onto an on-orbit instance of Lockheed Martin's Pony Express 2 technology demonstration satellite platform. The purpose of this research was to determine methodologies for installing cybersecurity functionality onto already-extant satellites. The presentation will describe the decision-making process as to the implemented solution along with challenges encountered when trying to install software on a satellite already in orbit such as hardware and software resource limitations and working within the constraints of integrating remotely into a system that cannot be drastically modified to allow for new software or functionality. Next, the methodology and results of the demonstration will be described, such as what data was able to be observed by the cybersecurity solution and what insights were able to be derived. Finally, the presentation will talk about the next steps of this research effort and offer recommendations for technical and methods-based approaches for implementing cybersecurity on satellites, both those that are already on-orbit and those that are in the process of being designed and built with cybersecurity as part of the core functionality.
10:50 am - 11:30 am
Room: Grand Ballroom Foyer
Room: Grand Ballroom Foyer
11:30 am - 12:20 pm
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
Artificial intelligence is accelerating both sides of the cyber arms race. For adversaries, AI enables faster reconnaissance, adaptive attack patterns, and precision targeting of space-based infrastructure. For defenders, it offers real-time anomaly detection, automated response, and predictive threat modeling. This session examines how AI is transforming the tactics, timing, and scale of space-related cyber conflict - and what's at stake if defense doesn't keep pace.
11:30 am - 11:55 am
Room: Regency Ballroom
Room: Regency Ballroom
Traditionally, space systems and mission operations infrastructure have relied on perimeter-based security models - focusing on defining and defending boundaries against external threats. This model is increasingly recognized as inadequate in the face of the modern threat environment, offering limited defense against lateral movement, insider and advanced persistent threats, or supply chain compromise. Zero Trust (ZT) is a cybersecurity paradigm that assumes no implicit trust for any user, device, or system - regardless of location relative to a perimeter boundary. While definitions of ZT vary, existing frameworks consistently emphasize principles such as strict resource-level authentication, continuous and dynamic access controls, least privilege, data-centric protection, and pervasive posture validation and monitoring.
Space systems are inherently complex, characterized by space, ground, user, link and launch segments, each with distinct threat models, communication profiles, and legacy and operational constraints. For example the space segment often operates with limited or intermittent connectivity, constrained processing resource, and has long development and operation lifecycles. Ground segment systems - though closer to enterprise IT - must support mission-critical functions, custom protocols, and deterministic monitor and control operations. Applying ZT paradigms without tailoring to such constraints may result in operational degradation, increased system fragility or even safety and mission risk.
This session examines how ZT principles and core controls may be tailored to space system contexts. Drawing on published frameworks and reference models from authoritative sources such as NIST, CISA, and the US DoD, the session proposes a decomposed, segment-aware approach. Space-specific use cases are explored to derive architectural and implementation considerations across segments. The session culminates in the presentation of a draft guidance publication for mission designers, cybersecurity architects, and acquisition planners seeking to leverage ZT principles to achieve resilient, adaptive, and mission-aligned cybersecurity postures in modern and future space systems.
11:55 am - 12:20 pm
Room: Regency Ballroom
Room: Regency Ballroom
Space Force Captain David M. Vermillion will present results and analysis from a two-year proof-of-concept project to predict thruster anomalies on an operational satellite constellation using an ensemble machine learning approach. This talk will cover the project purpose, a brief overview of relevant satellite bus components, data engineering and modeling processes, project results, and an analysis of recommended changes for future approaches to similar problem-sets.
12:20 pm - 1:30 pm
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
1:30 pm - 2:00 pm
Room: Grand Ballroom Foyer
Room: Grand Ballroom Foyer
2:00 pm - 2:30 pm
Room: Regency Ballroom
Room: Regency Ballroom
As space systems grow in complexity and become increasingly targeted by sophisticated cyber threats, the need for practical, testable, and mission-informed defense strategies has never been greater. This talk presents an approach to purple teaming in the space domain, bringing red and blue teams together in realistic environments using on-orbit spacecraft and FlatSats to simulate, detect, and respond to cyber threats. These exercises move beyond tabletop scenarios and closed-lab environments to embrace real-time, mission-relevant testing that uncovers architectural blind spots, validates detection mechanisms, and enhances operator readiness. The session also explores how end-of-life (EOL) spacecraft provide a unique opportunity for unconstrained cyber experimentation. By using aging assets as testbeds, mission teams can safely push the limits of space system defense, validate secure-by-design principles, and refine incident response tactics without risking operational satellites. This presentation highlights lessons learned from recent exercises, shares effective purple team methodologies tailored for space systems, and outlines how such activities contribute to a more resilient and threat-informed defense posture across the space enterprise.
2:00 pm - 2:30 pm
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
Space systems are more accessible, digitized, and interconnected than ever, which makes them easier targets. This session focuses on how adversaries perceive commercial spacecraft and ground infrastructure and how their tactics are evolving. We will explore the risks introduced by the rapid rise of NewSpace and standardized platforms and what defenders need to consider as the barriers to entry decrease. If you do not view the situation through the attacker's lens, you are already behind.
2:45 pm - 3:10 pm
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
Ground systems are often seen as the soft underbelly of space networks - and attackers recognize this. This panel explores confirmed cyber incidents targeting satellite ground infrastructure, from teleport links to control centers. We will examine how attackers gained access, the methods used, and the measures being introduced to close the gaps. As threat actors shift from probing to exploiting, strengthening the ground segment is not just advisable; it now serves as the first line of defense in safeguarding space networks.
2:45 pm - 3:10 pm
Room: Regency Ballroom
Room: Regency Ballroom
3:10 pm - 3:35 pm
Room: Regency Ballroom
Room: Regency Ballroom
Satellites play a pivotal role in modern life, but their critical importance makes them prime targets for cyber threats. A single compromised satellite can disrupt entire networks and highlight vulnerabilities that reach beyond space infrastructure. For example, in July last year, an update failure involving cybersecurity platform CrowdStrike caused widespread chaos, including grounding flights and impacting IT systems across multiple industries. While satellite operators reported being unaffected, the incident underscored the profound risk that supply chain vulnerabilities, insufficient testing, and elevated privileges pose to critical systems like space infrastructure. Effective protection of satellites throughout their lifecycles demands robust architecture, precise specifications, and advanced technologies to mitigate the impact of cyber threats. For most organisations, the concept of trusted computing forms the cornerstone of their work, providing assurances that computers and connected technologies will only boot and operate in a predictable, reliable manner. Trusted computing leverages hardware Roots-of-Trust (RoT) to establish secure platforms for software to run on, fortifying the communication channels between it and the user. Establishing hardware-based trust mechanisms provides software exclusive access to designated areas of memory in order to safeguard sensitive data. At CyberSat 2025, the Trusted Computing Group (TCG) will explore how trusted computing, already implemented across various sectors and technologies, can elevate satellite security. Leveraging standards and technologies like TPM and CyRes, TCG will present strategies to address the increasing cyber threats confronting the satellite industry and secure its critical infrastructure.
3:10 pm - 3:35 pm
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
3:35 pm - 4:00 pm
Room: Grand Ballroom Foyer
Room: Grand Ballroom Foyer
4:00 pm - 4:45 pm
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
Operators are increasingly facing direct and destructive cyber campaigns. What kinds of attacks are being launched? What vulnerabilities are being exploited? This panel gathers space companies to share the incidents they've encountered, how they responded, and what lessons others need to know now. From command intrusion to signal disruption, the space sector is a live-fire zone. This provides a rare look at what's actually happening and how the threat environment is escalating rapidly.
5:00 pm - 5:30 pm
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
Tuesday, November 18
8:30 am - 9:00 am
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
As CISO for the Department of the Air Force, James "Aaron" Bishop plays a central role in shaping cybersecurity strategy across the Air Force and Space Force. With decades of experience spanning government, industry, and national security, Bishop brings a mission-first perspective to some of the most urgent cyber and defense challenges. In this keynote, he'll share senior insights on securing critical systems and navigating the evolving threat landscape across air, space, and cyber domains.
9:15 am - 9:45 am
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
9:15 am - 9:45 am
Room: Regency Ballroom
Room: Regency Ballroom
As geopolitical and commercial interests in space accelerate, so does the volume and complexity of data generated by defense, communications, and Earth observation, platforms. Traditional terrestrial infrastructure struggles to meet the demand for real-time data processing, latency reduction, and cybersecurity at the edge. On-Orbit Data Centers (ODCs) offer a transformational opportunity to push compute and storage into space, enhancing resilience, enabling new mission sets, and generating future markets for fused intelligence, edge AI, and multi-domain operations. The relationship between on-orbit data centers and cybersecurity is critical and complex, as these space-based infrastructures introduce unique security challenges compared to terrestrial data centers. This presentation will discuss this critical infrastructure on orbit in relation to cyber security challenges and needs, including its extended attack surface, its remote and autonomous operations, and its vulnerability to many cyber threat and risk. It will also discuss key mitigations in practice as we look to these data centers to be the backbone of evolving ecosystems in space.
10:00 am - 10:50 am
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
Winning space contracts today requires more than technical capability. It demands a strong compliance posture. From CMMC 2.0 and IA-PRE to tightening European regulations, space companies must navigate a complex and evolving landscape to work with defense and government customers. This session breaks down what's required, where most companies fall short, and why compliance is now a critical part of space security. With government and defense customers tightening requirements, compliance isn't paperwork - it's a security posture.
10:00 am - 10:25 am
Room: Regency Ballroom
Room: Regency Ballroom
Future deep space mission systems will require cyber defense architectures that are largely self-contained and cannot solely rely on updated logic from ground stations due to light speed and bandwidth limitations. This technical presentation will pull from prior experience building cyber defense programs protecting critical infrastructure at SpaceX and self-contained weapons systems at Anduril Industries to propose reference architectures for self-contained, continuously self-evolving cyber defense architectures powered by new generations of agentic and swarm-based artificial intelligence. Session will address threats and key challenges associated with deep space missions to include foreign cyberwarfare entities and associated tactics, and balancing cybersecurity with mission-critical computation. Audience will be introduced to a proposed next-generation deep space cyber defense architecture involving capture and pruning of security-relevant onboard telemetry using tools like Tetragon, data storage using graph databases like Neo4J, GPU computation subsystems to support onboard-AI reasoning, and a self-evolution architecture driven by a continuous process of onboard adversarial reinforcement learning on the spacecraft utilizing Retrieval Augmented Generation (RAG) and similar Generative AI instrumentation. The end result is a resilient, continuously adaptive subsystem capable of advanced reasoning about threats to the vehicle in real time without constant support from flight controllers or ground-based operators.
10:25 am - 10:50 am
Room: Regency Ballroom
Room: Regency Ballroom
As satellite networks become more interconnected, securing real-time data exchange between satellites remains a critical challenge. Traditional satellite architectures rely on ground stations for data relay, creating latency and bottlenecks in mission-critical applications. This session will explore how Satlyt is pioneering a software-defined, AI-driven Intersatellite Network (ISN) to provide secure, low-latency edge computing in space. The presentation will cover: 1. AI-Enhanced Cybersecurity in Satellite Networks How machine learning models deployed at the edge can detect and mitigate anomalies in real-time. 2. Inter-Satellite Link (ISL) Security Framework Implementing encrypted, decentralized, software-defined networking (SDN) to enhance data integrity across constellations. 3. Delay-Tolerant Networking (DTN) for Secure Data Transfer How Satlyt's architecture leverages advanced DTN routing protocols, combining Contact Graph Routing (CGR) and AI-driven traffic management. 4. Real-World Use Cases & Implementation Progress Lessons from Satlyt's early-stage software deployments and prototype testing on virtualized satellite environments. Attendees will gain actionable insights on deploying secure, decentralized compute infrastructure for satellite networks while addressing cybersecurity threats in real-time edge computing.
10:50 am - 11:15 am
Room: Grand Ballroom Foyer
Room: Grand Ballroom Foyer
11:15 am - 11:40 am
Room: Regency Ballroom
Room: Regency Ballroom
As space becomes increasingly vital to global security and commerce, it is also more congested, contested, and vulnerable to adversarial disruption. The Proliferated Warfighter Space Architecture (PWSA) and other emerging LEO-based constellations depend on rapid, secure, and resilient communications. But traditional encryption methods are not future-proof, especially in the face of looming quantum computing capabilities. This session, led by Forward Edge-AI, Inc., presents a practical blueprint for deploying quantum-secure communication protocols in next-generation space architectures. We will explore a new paradigm for securing space communications and how quantum-resistant algorithms can be integrated into small satellite networks, enabling real-time, tamper-proof authentication and data integrity across proliferated systems. Key challenges addressed include: Ensuring secure key exchange across dynamic orbital topologies Overcoming hardware and bandwidth constraints in low-power spacecraft. Navigating policy and interoperability barriers for international operations Drawing from government-funded R&D, coalition exercises, and commercial pilot programs, this session offers actionable implementation strategies for mission planners, satellite integrators, and cybersecurity architects. Attendees will leave with a clear understanding of current quantum-encryption maturity levels, deployment pathways for spaceborne nodes, and how these technologies support broader deterrence and resilience strategies in an evolving orbital battlespace.
11:15 am - 12:05 pm
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
Hybrid constellations represent the future, but they bring layered complexity. As operators transition toward hybrid constellations that encompass LEO, MEO, and GEO, complexity and risk increase. This session examines how multi-orbit architectures impact cybersecurity, from vulnerable cross-link connections to unpredictable mesh behaviors. We'll analyze the trade-offs between LEO-only and blended networks, emphasize where vulnerabilities arise, and investigate how government investment is accelerating the demand for secure, scalable design across orbits.
12:05 pm - 1:15 pm
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
1:15 pm - 1:45 pm
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
1:45 pm - 2:35 pm
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
Direct-to-device (D2D) is exploding, connecting satellites to smartphones and sensors worldwide. But it's also creating a massive, fragmented attack surface. This session explores how D2D shifts the threat model from opening space networks to spoofing, endpoint compromise, and data manipulation at scale. As adoption grows, so does the attack surface. What will it take to secure a world where any device can become an entry point?
1:45 pm - 2:10 pm
Room: Regency Ballroom
Room: Regency Ballroom
Cyber attacks are increasing in frequency and sophistication. But what if we could detect and stop these attacks at the physical layer (Radio Frequency) before it reaches any software? What do these attacks look like? Where & how can we implement these algorithms to best deal with strict SWaP (Size, Weight and Power) requirements? What algorithms work best for this problem set? This session explores how Radio Frequency Signal Anomaly Detection (RFAD) can serve as an early-warning system in space cybersecurity, identifying malicious behavior before any harmful payloads are processed. We will do this by first looking at how different industries (IoT, GNSS) solve similar problems. Then we'll examine a case study through MIT's Anomaly Detection Challenge & propose best practices for integrating RFAD into your system's architecture. After this session, attendees will: - Understand the state of the art in RFAD techniques - Know how to effectively implement RFAD in their own systems with SWaP constraints - Learn industry best practices for RFAD implementation and integration - Gain insights into the evolving landscape of RF-based cyber attacks and defensive countermeasures.
2:10 pm - 2:35 pm
Room: Regency Ballroom
Room: Regency Ballroom
Aligning Primary Intelligence Requirements, Detection Engineering, and Telemetry Instrumentation for Converged Space Platforms" I have developed a course, BETA versions have been delivered to the US Space ISAC and elements in US Space Command, which includes a module on our Space Collective Defense concept. This presentation would be the public release of how we approach "Collective Response" using a three tier approach. The first tier is proper establishment of Primary Intelligence Requirements (PIR) in order to maintain a focused program, the second tier detection engineering where we adopted an open source collective defense language, roota.io, and the third tier is instrumentation of telemetry where we cover how to visualize the complex aspects of space platform exposure. I have worked directly in the field for space related incident response as well as served as the co-chair for the US Space-ISAC Information Sharing Working Group (ISWG).
2:45 pm - 3:15 pm
Room: Grand Ballroom A-D
Room: Grand Ballroom A-D
We wrap with a final keynote that looks ahead--highlighting the critical decisions and innovations shaping the next phase of cybersecurity and space resilience.
Wednesday, November 19
8:00 am - 8:30 am
8:30 am - 9:00 am
9:00 am - 9:30 am
9:45 am - 10:15 am
10:15 am - 10:30 am
10:30 am - 11:00 am
11:00 am - 11:30 am
11:00 am - 12:00 pm
12:00 pm - 1:00 pm
1:00 pm - 2:00 pm
2:00 pm - 2:30 pm
3:30 pm - 4:00 pm
3:30 pm - 4:00 pm
4:00 pm - 4:45 pm
4:45 pm - 6:15 pm
Thursday, November 20
8:00 am - 8:30 am
8:30 am - 9:00 am
9:00 am - 9:30 am
9:30 am - 10:00 am
10:00 am - 10:30 am
10:30 am - 11:30 am
11:30 am - 12:00 pm
12:00 pm - 12:30 pm