Resources Categories
INDUSTRY FACT FILE · SPACE, SATELLITE & GEOSPATIAL SERVICES
Market Landscape and the Drivers of Cybersecurity Demand in Space
The business, technology, regulatory, legal and statutory forces that create testing, audit, monitoring and response work for satellite, launch, ground station, satcom, geospatial and navigation businesses.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: Space Policy, IN-SPACe, telecom, CERT-In and DPDP 5. Legal and statutory drivers 6. How the drivers differ by organisation type 7. What this means for buyers and for Codec Networks |
1. Market landscape
India's space market has been reshaped by policy since 2020. The creation of IN-SPACe, the Indian Space Policy 2023, IN-SPACe's authorisation norms of May 2024 and the February 2024 FDI amendment have opened satellite building and operation, launch, ground systems and satellite data products to private and foreign-funded companies. IN-SPACe's Decadal Vision targets an increase in the space economy from about US$8.4 billion in 2022 to US$44 billion by 2033, and the October 2024 ₹1,000 crore venture capital fund, planned to support about 40 start-ups, adds risk capital. By August 2026 about 440 space technology start-ups were registered on the DPIIT portal and IN-SPACe had granted 113 authorisations to 52 non-government entities. Government remains the anchor customer through ISRO, NSIL, defence and civil ministries, while satcom licensing for low-earth-orbit broadband, the rule since 1 April 2025 that foreign satellite capacity in India needs IN-SPACe authorisation, and liberalised geospatial rules are creating commercial markets for connectivity, earth observation data and location services.
Cybersecurity demand follows five pressures. Customers: government departments, telecom operators, banks, energy companies and enterprises ask space and geospatial suppliers for security evidence, VAPT reports and data handling commitments before they sign. Regulation: CERT-In's six-hour reporting and audit guidelines, the Telecom Cyber Security Rules and satcom licence security conditions, geospatial data rules and the DPDP Act turn good practice into obligations, and the proposed EU Space Act signals tougher expectations abroad. Capital: venture investors, strategic partners and foreign shareholders entering under the new FDI limits run technical due diligence. Threat: the 2022 KA-SAT attack, which disabled tens of thousands of terminals through the ground segment, ISRO's report of more than 100 attacks a day and GNSS interference near Indian airports have made the risks concrete. Concentration: shared ground stations, cloud platforms and terminal fleets mean that one weakness can affect many customers. Most firms are lean engineering businesses that rely on external testers, auditors, SOC providers and responders for depth.
|
74% FDI via automatic route for satellites (Feb 2024) |
₹1,000 crore Space venture capital fund under IN-SPACe (2024) |
US$44 bn Space economy target for 2033 (IN-SPACe) |
1 Apr 2025 Foreign satellite capacity needs IN-SPACe nod |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Satellite makers and suppliers |
Start-ups and MSMEs scaling with government orders, exports and FDI |
Engineering IT and IP protection, supplier assurance, software integrity |
|
Satellite operators |
PSU, private and joint-venture operators of communication and EO fleets |
Mission control reviews, privileged access, SOC |
|
Launch start-ups |
Venture-funded firms moving from test campaigns to commercial launches |
Engineering IT and OT assessments, recovery testing |
|
Ground stations and teleports |
Shared antenna networks and GSaaS for domestic and foreign operators |
Ground network VAPT, vendor access, portal and cloud testing |
|
Satcom providers |
Licensees serving enterprises, government, maritime, aviation and homes |
Hub and NMS assessments, managed SOC, telecom rule support |
|
EO, geospatial and location platforms |
SaaS and data businesses serving government, infrastructure and enterprises |
API and cloud VAPT, DPDP programmes, abuse monitoring |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Winning government and enterprise contracts |
Buyers ask for security questionnaires, VAPT reports and audit evidence |
Platform VAPT, CERT-In empanelled audits, evidence packs |
|
Securing IN-SPACe authorisation and licences |
Applications and licence conditions raise security and data questions |
Authorisation security reviews, licence condition support |
|
Raising capital and admitting foreign investors |
Due diligence under the new FDI limits |
Maturity assessments, ISO 27001 readiness |
|
Opening ground stations to many customers |
Shared infrastructure demands isolation and evidence |
Ground network VAPT, segmentation, SOC |
|
Launching satcom services at scale |
Terminal fleets and gateways become critical infrastructure |
NMS and update server assessments, managed SOC |
|
Selling data through APIs |
Customers want assurance that their orders and data stay private |
API and multi-tenant testing, DPDP programmes |
|
Serving foreign customers |
EU Space Act proposal, NIS2 and partner security clauses |
Space cyber readiness reviews, threat-led testing |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Ground stations and teleports |
Vendor tunnels, flat networks and exposed control units |
Ground network VAPT, segmentation and access reviews |
|
Mission control and TT&C |
Misuse of command access and weak key custody |
Privileged access and key management reviews |
|
Satcom hubs, NMS and terminals |
Management plane compromise and malicious updates |
Hub, NMS and update pipeline assessments |
|
Cloud ground segment and GSaaS |
Misconfiguration, weak isolation, portal takeover |
Cloud configuration and tenant isolation testing |
|
EO, geospatial and location APIs |
Broken authorisation, data leaks, enumeration |
API VAPT, abuse monitoring, DevSecOps reviews |
|
Flight software and supplier images |
Tampered components and backdoored libraries |
Software integrity, SBOM and supplier assessments |
Figure 3: The four groups of drivers behind cybersecurity spending in space, satellite and geospatial services.
4. Regulatory drivers: Space Policy, IN-SPACe, telecom, CERT-In and DPDP
|
Instrument |
Key requirements |
|
Indian Space Policy 2023 and IN-SPACe NGP (2024) |
Authorisation of space objects, launch and ground systems; eligibility and registration; IN-SPACe authorisation for foreign satellite capacity from 1 April 2025 |
|
Telecommunications Act 2023 and satcom licences |
Authorisation of satellite communication services, administrative assignment of listed satellite spectrum, licence security and monitoring conditions |
|
Telecom Cyber Security Rules 2024 |
Security incident reporting within six hours with further details in 24 hours, a Chief Telecommunication Security Officer and security operations for telecom entities |
|
CERT-In Directions (2022) and audit guidelines (2025) |
Six-hour incident reporting; 180-day ICT logs in India; risk-based independent audits including OT and ICS |
|
Geospatial Data Guidelines 2021 and National Geospatial Policy 2022 |
Liberalised acquisition and publication of geospatial data and maps, with a list of sensitive attributes and self-certification |
|
DPDP Act 2023 and Rules 2025 |
Safeguards, retention limits and breach intimation for personal and location data; most obligations from May 2027 |
|
Confirm applicability Obligations depend on what you build, launch, operate or sell, your IN-SPACe authorisations and telecom licences, the data you handle, the customers and countries you serve, listing status and contracts. A dedicated space activities law has been drafted but, as of October 2026, not enacted; confirm against the official instruments and your agreements. |
Figure 4: Legal and regulatory timeline shaping space and geospatial security, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
Telecommunications Act, 2023 |
Authorisation of telecom services, including satellite services, and spectrum assignment |
Licence condition reviews, network security assessments |
|
IT Act, 2000 |
Offences such as unauthorised access; protected systems under Section 70 |
VAPT, incident response, forensics |
|
DPDP Act, 2023 and Rules, 2025 |
Personal and location data of customers, drivers and app users |
Privacy programmes, data maps, safeguards |
|
Foreign exchange and FDI rules |
Ownership limits and approvals for space activities |
Investor due diligence, governance reviews |
|
Export control and foreign partner terms |
Controls on sensitive space items and technology, and partner security clauses |
Access control and IP protection reviews |
|
Companies Act, 2013 and SEBI LODR (listed firms) |
Board risk responsibility; quarterly cyber incident disclosure |
Board reporting, incident records |
|
Contracts with government, operators and customers |
Security, confidentiality, audit and notification clauses |
Assurance reports, supplier reviews |
6. How the drivers differ by organisation type
|
Organisation type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Satellite makers and suppliers |
Contracts, exports, FDI |
Engineering IT, flight software, suppliers |
Space Policy, IN-SPACe, export terms, CERT-In |
|
Satellite operators |
Authorisations, customer SLAs |
Mission control, TT&C, keys |
IN-SPACe NGP, CERT-In, NCIIPC where relevant |
|
Launch start-ups |
Launch campaigns, investors |
Engineering IT, test and range OT |
IN-SPACe authorisation, CERT-In audits incl. OT |
|
Ground stations and teleports |
Shared customers, GSaaS growth |
Antennas, modems, scheduling, cloud |
IN-SPACe NGP, DoT licences, CERT-In |
|
Satcom providers |
Licences, enterprise and government users |
Hubs, NMS, terminals |
Telecom Act, Telecom Cyber Security Rules, CERT-In |
|
EO, geospatial and location platforms |
Enterprise clients, investors |
Cloud platforms, APIs, SDKs |
Geospatial Guidelines, DPDP, CERT-In |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“A government client wants a VAPT report on our ground station and portal.” |
Ground network and portal VAPT with retest |
Annual assurance cycle |
|
“We push firmware to thousands of terminals.” |
NMS, update server and terminal firmware assessment |
Review of every major update process change |
|
“Our investors and foreign partner want evidence of security maturity.” |
Maturity assessment and ISO 27001 readiness |
Annual maturity reassessment |
|
“Vendors maintain our antennas and modems remotely.” |
Vendor access and segmentation review |
Managed SOC for remote sessions |
|
“Customers order imagery and data through our API.” |
API and multi-tenant VAPT, cloud review |
Testing in every major release |
|
“We track vehicles and people for our clients.” |
DPDP and location data handling review |
Privacy programme and periodic checks |
|
“Something is wrong with our ground network and we do not know why.” |
Incident response, forensics and root cause analysis |
IR retainer and SOC |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, regulatory, licensing, export control or national security advice. Obligations differ by activity (manufacturing, launch, satellite operation, ground systems, satellite communication services, earth observation, geospatial data or navigation and location services), by the IN-SPACe authorisations, telecom licences and permissions held, by the customers and countries served, listing status, contracts and the data each organisation handles; confirm them against the official Department of Space, IN-SPACe, Department of Telecommunications, TRAI, Department of Science and Technology, CERT-In, NCIIPC, MeitY and Data Protection Board instruments, any space activities law if enacted, and your agreements. Radio frequency and link testing is described only as authorised testing in controlled environments, coordinated with the customer and any required licences and permissions. Incident references are summarised from official statements and widely reported events.