RESTON, Va. — The U.S. Space Force sees space not just as a physical domain, with thermodynamic laws and orbital mechanics, but as a digital domain, too. Indeed, victory in space depends as much, maybe more, on victory in digital combat as it does on prevailing at the physical level, the service’s head of Data and Cyber told CyberSat Monday.
“There’s a foundational truth that we must embrace: We cannot achieve or sustain space superiority without digital superiority,” Charleen Laughlin, Space Force deputy chief of space operations (DSCO) for Cyber and Data said in a keynote address at CyberSat.
Most Americans think of the Space Force as being “about rockets, launch complexes, and satellites on orbit,” she added.
“But space operations don’t begin at launch, and they don’t end at a satellite,” she said. “They depend on an interconnected digital ecosystem, stretching from terrestrial infrastructure and cloud environments to ground systems, a communication lens, and orbital capability. Every connection creates an opportunity to deliver capability, and every connection creates a potential vulnerability.
U.S. adversaries recognize that modern military operations depend on networks, on software, on data, and above all on space-enabled services. Adversaries don’t necessarily look at those dependencies through the same organizational boundaries that the Space Force does, she noted.
“We distinguish between space operations, cyber operations, electronic warfare, and information operations, while our adversaries merely look for vulnerabilities which they can exploit to achieve operational effects,” Laughlin said.
It doesn’t matter whether those vulnerabilities are in space systems, in ground systems or in business systems, she said. When it comes to space — “the enterprise is the battleground,” she added.
Sometimes, she acknowledged, the most effective way to disrupt a space mission is to attack the ground station, data, or the network.
Laughlin cited a study published earlier this year of cyberattacks against space related organizations carried out in 2025 by the Center for Security Studies at ETH Zurich. Of the 407 cyber incidents affecting 183 space-related organizations worldwide, the report states, none of them directly targeted a satellite on orbit. Instead, the attacks targeted terrestrial infrastructure, corporate networks, ground systems, and user terminals.
“Adversaries didn’t need an anti-satellite missile to disrupt space-enabled services,” said Laughlin. “They targeted the infrastructure and the connections that made those capabilities useful, and the effects crossed organizational and national boundaries.”
She stressed that “the absence of publicly identified attacks against satellites in orbit doesn’t mean those threats also don’t exist.”
One response of the Space Force, Laughlin said, is to move away from singular, exquisite systems; to more numerous, distributed and proliferated architectures. “But more satellites doesn’t automatically mean more resilience. For instance, if hundreds of satellites depend on the same vulnerable ground infrastructure or compromised software component, we may have just distributed the platforms without distributing the risk,” she said.
She called on industry to build cybersecurity and resiliency into the baseline architecture of their systems: “When you’re designing these systems, I need you to think beyond whether it will perform under ideal conditions. I need you to help us understand how it will behave under attack. Where are the critical dependencies? What happens when a network connection fails? Can we restore capability quickly? What does your architecture allow our cyber defenders to see, and how does it enable them to defend?”
Defending military networks means that cyber operators have to understand more than simply the geography or architecture of those networks, “they must understand the larger missions those networks support and the operational consequences if something fails.”
The ultimate goal is not just to build systems that are difficult to penetrate. Rather, she said, the objective is to deny adversaries the operational advantages they hope to gain through the cyber attack. And that means designing systems in such a way that they can easily be restored.
“That’s the difference between treating cybersecurity as a compliance exercise and treating cyber resilience as combat power,” she added.
Laughlin said it was important to have realistic expectations. “I want to be clear: I’m not asking anyone in this room to make a system invulnerable, because that’s not realistic. I’m asking us to build systems, that are capable of fighting through disruption, recovering from compromise, and continuing to accomplish the mission. Because that’s what our warfighter needs. That’s what our nation expects. And that’s what digital combat power has to look over.”
