If you use satellite links, a compromise of your provider's network can expose your own environment. CISA and the FBI said so in a 2022 advisory. Their advice for customers is practical: encrypt your own traffic, use strong authentication, review contracts and keep a tested continuity plan.
The core risk
The advisory states that a successful intrusion into a SATCOM network could expose the environments of that network's customers. The May 2022 update attributed the threat activity to Russian state-sponsored cyber actors. The page does not describe a specific breach. It is a warning and a to-do list.
This is the same shape as many supplier risks. You trust a provider's network, and their weakness becomes yours.
What customers can do
Encrypt independently. The advisory recommends encrypting all communication links leased from or provided by the SATCOM provider, separately from the provider's own encryption. Assume the provider's layer could fail.
Strong authentication. Use multi-factor authentication where possible and avoid default or weak credentials on terminals and management interfaces.
Least privilege. Audit accounts regularly and remove those not needed.
Review the contract. The advisory asks you to review trust relationships with IT service providers and make sure contracts include security provisions such as monitoring and incident notification.
Patch with priority. Prioritize vulnerabilities in CISA's Known Exploited Vulnerabilities catalog.
Watch the logs. Feed logs to a monitoring system, baseline traffic, and put endpoint detection on devices behind SATCOM terminals.
What providers are asked to do
Providers should monitor ingress and egress points for insecure remote access tools such as Telnet, FTP, SSH and VNC, unexpected traffic between segments or terminals, unauthorized local or backup account use, and brute-force login attempts.
A simple customer test
Ask your provider three questions. How will you tell us if your network is compromised? Can we run our traffic over our own encrypted tunnel? What happens to our service if your management network is down? If you cannot get answers, plan as though the answers are bad.
For the wider supplier angle, see Systemic cyber risk: a concentration checklist.
Who this applies to
The advisory is written for SATCOM providers and their customers, and it matters most to critical infrastructure organizations. But any business with remote sites on satellite links, such as maritime, energy, mining or logistics operations, inherits the same shape of risk. If your terminals sit on your network, a weakness in the provider's management side can become a path into yours.
A practical first step is to map every terminal: where it is, what it connects to, who manages it and what credentials it uses. Default or shared credentials on terminals are a common gap the advisory tells you to remove.
Keep one more point in mind: the advisory also stresses maintaining tested incident response, resilience and continuity of operations plans. For a remote site, that means deciding in advance what the site does if the satellite link is lost for hours: which operations continue locally, which pause, and who is told. Write it down and test it once.
Quick check
Should I rely on my SATCOM provider's encryption alone?
CISA and the FBI recommend encrypting leased links independently of the provider's encryption.
Sources
Last reviewed: 19 October 2026.
