A Space Security Threat Intelligence Matrix for the EU: Bridging Technical Events and Strategic Risk

ABSTRACT

Russia’s 2021 ASAT test, the cyberattacks observed during the Russia-Ukraine war, China’s increasing anti-space capabilities, and the proliferation of signal jamming activities in the Middle East demonstrate why the EU should prioritize the security dimension of space, defined as a strategic security and defence domain. Recent critical developments reveal that threats to space infrastructure have diversified and become operational, directly impacting the EU’s space infrastructure at both global and regional levels. Therefore, a space security-focused matrix should be developed in alignment with the emerging European Space Shield agenda. This matrix should be designed to monitor regional developments that could directly or indirectly threaten the EU’s space security. It should be synchronized with the SPACE-SHIELD matrix developed by ESA. A unit responsible for the currency of the matrix data, its strategic analysis, and providing insights to EU actors should be established and funded by the EU.

INTRODUCTION

Space has become a critical infrastructure in both civilian and military domains. Russia’s 2021 ASAT test (Council of the European Union, 2021), the KA-SAT/Viasat cyberattack at the beginning of the Russia-Ukraine war (Council of the European Union, 2022), China’s rapidly developing counterspace capabilities (Samson and Cesari, 2025; Swope et al., 2025), and the proliferation of GNSS jamming/spoofing activities in Eastern Europe and the Middle East (EASA and IATA, 2025; Swope et al., 2025) demonstrate that space threats have diversified and acquired an operational character. These developments require the EU to treat space as a strategic security and defence domain and to prioritize the protection of its space assets.

In this context, the EU’s 2023 Space Strategy for Security and Defence provides the broader strategic basis for assessing space threats, while the European Space Shield, proposed under the 2025 Defence Readiness Roadmap 2030, offers an emerging framework for strengthening the protection and resilience of European space assets and services (European Commission and High Representative, 2023, 2025).  However, for such resilience-oriented initiatives to translate into an effective security capacity, threats must be assessed through technical vectors, actor rationale, regime context, geographical diffusion, and escalation potential. This article proposes a two-layered Space Security Threat Intelligence Matrix to complement the European Space Shield. The matrix will be synchronized at the classification level with ESA’s SPACE-SHIELD, an ATT&CK-like knowledge-base framework for space systems (European Space Agency, no date), and will be supported by a dedicated analytical unit that translates technical threat information into political-strategic risk analysis. 

Existing EU Space Security Ecosystem and the Gap

The European space security ecosystem is functional but fragmented. While the EU Space Programme manages service continuity and the EU Space ISAC generates cyber awareness (European Union Agency for the Space Programme, no date), ESA tools monitor technical risks, and INTCEN provides general intelligence analysis. However, although the EU’s 2023 Space Strategy for Security and Defence recognizes that space threats should be assessed through the dimensions of actor behaviour and geopolitical context (European Commission and High Representative, 2023), the current structure does not provide this assessment within a single comparative intelligence framework. INTCEN performs a general function, but there is no space-system-specific strategic analysis tool that is synchronized with ESA SPACE-SHIELD and oriented toward decision support. The practical cost of this gap was visible in the 2022 KA-SAT/Viasat attack: the attribution decision for an operation affecting several EU Member States was delayed, and coordinated response capacity remained limited (Council of the European Union, 2022). The proposed matrix aims to fill this gap. While existing systems answer the questions “what happened?” and “how did it happen?”, the matrix additionally addresses “who, why, in what political context, and what does it mean for the EU?” In this way, it makes technical data comparable, prioritizable, and action-oriented.

Proposed Matrix

The proposed Space Security Threat Intelligence Matrix evaluates each space security event through a two-layered structure composed of ten variables. Events that generate direct or indirect concrete security effects related to Galileo, Copernicus, EGNOS, GOVSATCOM, IRIS², and other EU space systems are included in the matrix. By contrast, general IT/cyber incidents for which no reasonable and traceable security link can be established with EU space systems, the ground segment, user terminals, data links, or space-based services are excluded. Disruptions that only constitute commercial service-quality problems and space safety risks that do not involve a hostile or operational security dimension are also kept outside the scope.

The first layer focuses on the actor and strategic-context dimensions of the event. It examines who produces the threat, how the actor positions itself in the international system, within which political-regime logic the threat is shaped, and which geographical context it is associated with. In this way, the event is read not as an isolated technical risk, but within a specific pattern of actor behaviour, political logic, and strategic orientation. This layer consists of four variables:

1. Actor: This variable indicates who produces the threat. It makes strategic behaviour traceable. It also helps identify recurring threat patterns associated with specific actors.
2. Role Conception: This variable is based on Holsti’s conceptualization of national roles. According to Holsti, foreign policy behaviour is shaped not only by capabilities or systemic pressures, but also by the roles that decision-makers attribute to their states (Holsti, 1970). Space security threats particularly benefit from this framework. For example, an ASAT test may function as a strategic message when conducted by an actor operating with a revisionist great-power identity. In the case of a regional disruptive actor, the same act may signal an asymmetric capacity demonstration. Although the technical label remains the same, the orientation behind the threat and its political meaning for the EU differ. The role conception variable makes this difference visible and allows analysis of why similar events may generate different needs for attribution, deterrence, and response.
3. Regime Type: Regime type indicates the political decision-making and accountability structure within which the threat is produced. Decision-making opacity, elite control, institutional constraint, risk-taking propensity, and the credibility of deterrence signals are important for understanding the political context of space security threats (Geddes et al., 2014; Levitsky and Way, 2002; Weeks, 2008, 2012). This variable shows why similar technical threats may generate different attribution, escalation, and response needs under different political structures. For example, Russia’s 2021 ASAT test and the 2022 KA-SAT/Viasat attack attributed to Russia can be read as threat behaviours that generate high escalation risk and a need for resilience within an authoritarian and security-centred decision-making context. By contrast, GNSS jamming/spoofing incidents observed in the Middle East and Eastern Europe increase attribution uncertainty in grey-zone activities and highlight the need for early warning and regional monitoring capacity.
4. Geographical Theatre: This variable indicates the regional crisis, conflict theatre, or great-power competition context in which the threat emerges. It allows the threat’s proximity to EU space security, risk of spillover, and response priority to be assessed. The KA-SAT/Viasat attack demonstrated that the Russia-Ukraine war could generate cyber-space consequences affecting EU Member States as well (Council of the European Union, 2022). GNSS jamming/spoofing incidents in Eastern Europe and the Middle East, in turn, highlight the need for early warning, airspace safety, and civil-military coordination (EASA and IATA, 2024, 2025). For this reason, the geographical theatre variable enables threats to be assessed according to their strategic proximity and level of regional sensitivity from the EU’s perspective.

The second layer focuses on the technical-operational character of the event and the security impact it creates for the EU. It analyses the threat’s technical vector, ESA SPACE-SHIELD classification, targeted EU system, operational impact, escalation potential, and the EU’s response priority. In this way, the strategic-context analysis in the first layer is integrated with concrete system effects and decision-support outputs. This layer consists of six variables:

1. Threat Type: This variable classifies the technical nature of the threat. Activities that directly or indirectly affect the security of EU space systems are included within this scope. For an event to be included in the matrix, it must generate a concrete security impact on Galileo, Copernicus, EGNOS, GOVSATCOM, IRIS², the ground segment, user terminals, or the EU’s crisis management and security services. Within this scope, kinetic ASAT activities, co-orbital/proximity operations, cyberattacks, jamming, spoofing, directed-energy interference, ground-segment attacks, interference with TT&C/command-and-control links, and disruptions targeting satellite communication services are assessed.
2. ESA SPACE-SHIELD: This variable indicates the level at which the proposed matrix will be synchronized with ESA SPACE-SHIELD. Synchronization does not mean institutional merger; it refers to classification alignment. Each threat event is matched with the corresponding tactics and techniques within ESA SPACE-SHIELD. This synchronization creates a common language between technical threat classification and strategic risk assessment. It also makes the matrix comparable and usable for both security teams and policymakers.
3. Targeted EU Space System: This variable shows which EU space asset, service, or infrastructure layer is affected by the threat. It links the threat to concrete EU systems such as Galileo, Copernicus, EGNOS, GOVSATCOM, IRIS², the ground segment, and user terminals. This makes it possible to identify which service area is exposed to vulnerability, disruption, or data reliability problems from the EU’s perspective.
4. Operational Impact: This variable codes the practical consequence produced by the threat on EU space systems. In this respect, it differs from threat type. While threat type indicates how the attack takes place, operational impact shows what the attack causes. Communication outages, signal degradation, loss of data integrity, service unavailability, false positioning information, space debris risk, or disruption of crisis management capacity can be assessed within this category. For example, the 2022 KA-SAT/Viasat attack caused communication outages for public authorities, businesses, and users, and also affected some EU Member States (Council of the European Union, 2022).
5. Escalation Potential: This variable assesses the extent to which the threat may generate a crisis and require a response. It indicates whether the event is a low-intensity grey-zone activity, a coercive action disrupting critical services, a strategic attack, or a high-threshold behaviour that could trigger a debate on collective response. This distinction helps policymakers assess more clearly which events require monitoring, crisis management, deterrence, or collective response.
6. EU Response Priority: This variable translates the coded threat into actionable policy and security options. It shows whether the event requires monitoring, resilience-building, attribution, sanctions, crisis management, or collective response. Therefore, the matrix is not merely a tool for classifying threats. It is also a strategic intelligence tool that generates decision support.

When these two layers work together, the matrix becomes a tool that assesses space security events holistically in terms of both their strategic-political context and their technical-operational consequences. By linking technical event records with political-strategic meaning, it provides EU decision-makers with a comparable, prioritizable, and actionable basis for threat assessment. Table 1 illustrates how the proposed matrix would code four representative threat events and patterns frequently cited in recent EU space security discussions.

Table 1. Illustrative Coding of Selected Space Security Threat Events and Patterns