Space doesn't just change the physics of compute.

It fundamentally rewrites how AI systems fail.

On Earth, when AI goes wrong, humans intervene:

• Security teams investigate alerts
• Engineers deploy patches
• Operators halt processes
• Technicians physically access systems

In orbit, light-speed lag makes human intervention impossible.

This dashboard quantifies how threat surfaces shift when autonomous systems leave Earth—and why loss of control becomes the dominant risk, not intrusion.

On Earth: Security protects systems FROM attackers

In Orbit: Security protects systems from THE INABILITY TO RESPOND

Key Finding:

Autonomy Requirement (Orbital): 4.70 risk severity

vs. Earth: 1.60

In orbital systems, autonomy fails BEFORE security—not because of attacks, but because humans can no longer intervene when response windows exceed orbital latency constraints.

Translation:

The biggest threat isn't a hacker breaking in.

It's the system needing human judgment when humans are 240ms away (GEO) and the decision window is 50ms.

Critical Failures (Risk Severity 4.2 - 4.7):

🔴 Autonomy Requirement: 4.70

• System needs human decision
• Light-speed lag = 240ms (GEO)
• Decision window = 50ms
• Result: Autonomous failure, not security breach

🔴 Incident Response Window: 4.50

• Attack detected
• Response requires human authorization
• Latency exceeds response window
• Result: Incident becomes liability, not safeguard

🔴 Physical Access Risk: 4.20

• System requires physical intervention
• Technician is on Earth
• Asset is in LEO/MEO/GEO
• Result: Unrecoverable failure state

Degraded Operations (Risk Severity 3.4 - 3.8):

🟡 Patch Latency: 3.80

• Critical vulnerability discovered
• Patch requires extensive testing (no rollback in space)
• Deployment window = days to weeks
• Result: Extended exposure window

🟡 Supply Chain Trust: 3.60

• Hardware authenticity questioned post-launch
• Physical verification impossible
• Result: Trust becomes existential, not operational

🟡 Telemetry Reliability: 3.40

• Monitoring depends on orbital comm passes
• Gaps in observability = blind spots
• Result: Silent failures compound undetected

On Earth:

• Autonomy = optimization (faster response, cost savings)
• Humans remain in control loop
• Override always possible

In Orbit:

• Autonomy = requirement (physics mandates it)
• Humans cannot remain in control loop (latency)
• Override often impossible within decision windows

Risk Delta: +194% (1.60 → 4.70)

Implication:

Systems must be designed for autonomous incident response, not human-supervised security.

Traditional security models (human-in-the-loop, manual approval) fail by design in orbital environments.

Terrestrial Security Priority:

1. Perimeter defense (firewalls, access control)
2. Intrusion detection
3. Human response
4. Physical security

Orbital Security Reality:

The dominant threat is not intrusion—it's loss of control.

When humans leave the loop:

• Perimeter defense must be autonomous
• Intrusion detection must trigger autonomous response
• Incident response becomes a liability (not a safeguard) when response windows exceed latency
• Physical security becomes impossible

Earth-first architectures prioritize perimeter over continuity.

Orbital systems must prioritize control continuity over perimeter defense.

Space Systems Cannot Depend On:

❌ Real-time human authorization for critical decisions ❌ On-site technicians for emergency response ❌ Rapid patch deployment with rollback capability ❌ Continuous telemetry (comm windows create blind spots) ❌ Physical verification of hardware integrity

What Works Instead:

✅ Pre-authorized autonomous decision frameworks ✅ Self-healing architectures with redundancy ✅ Extensively tested updates (no rollback = no mistakes) ✅ Store-and-forward telemetry with gap tolerance ✅ Cryptographic hardware attestation at launch

Risk comparison:

Humans-in-the-loop reliance:

• Earth: 1.60 (manageable)
• Orbital: 4.70 (critical failure mode)

1. Autonomy-First Architecture

• Assume humans cannot intervene within decision windows
• Design for autonomous incident detection + response
• Pre-authorize decision frameworks (not case-by-case approval)

2. Control Continuity Over Perimeter Defense

• Priority: Maintain operational control under all conditions
• Secondary: Prevent unauthorized access
• Rationale: Loss of control = mission failure, even without adversary

3. Fail-Autonomous, Not Fail-Safe

• Fail-safe (Earth model): Stop operations, wait for human intervention
• Fail-autonomous (Orbital model): Maintain minimum viable operations, self-heal where possible

4. Extensive Pre-Launch Validation

• No rollback capability in orbit
• Testing must catch 99.99% of edge cases
• Formal verification for critical decision logic

5. Redundancy at Every Layer

• Assume component failures (no physical access for repair)
• N+2 redundancy minimum for critical systems
• Graceful degradation paths

Control_Stress = (Latency_Constraint / Response_Window) × Autonomy_Factor

Where:
- Latency_Constraint: Time for signal to reach Earth and return
- Response_Window: Time available to make decision
- Autonomy_Factor: Degree of autonomous capability required

When Control_Stress > 1.0 → Human intervention impossible

Example (GEO):

Latency: 240ms round-trip
Response Window: 50ms (real-time decision)
Control_Stress = 240/50 = 4.8 → CRITICAL

Humans cannot intervene within the decision window.
The system must be fully autonomous.

Risk_Delta = (Orbital_Severity - Earth_Severity) / Earth_Severity × 100%

Autonomy Requirement:
Risk_Delta = (4.70 - 1.60) / 1.60 × 100% = +194%

• Visualization: Tableau Public
• Data Processing: Python, pandas, NumPy
• Risk Modeling: Control theory, latency constraint analysis
• Physics: Speed-of-light propagation, orbital mechanics

For Space Systems Engineers:

• Design autonomous AI architectures for orbital deployment
• Understand latency constraints on control loops
• Plan redundancy and fail-autonomous strategies

For Security Architects:

• Recognize where Earth-first security models fail
• Design autonomous incident response frameworks
• Prioritize control continuity over perimeter defense

For AI Safety Researchers:

• Study how autonomy requirements change failure modes
• Model scenarios where human oversight is physically impossible
• Design pre-authorized decision frameworks

For Policy Makers:

• Understand regulatory challenges for autonomous space systems
• Define liability frameworks when humans cannot intervene
• Balance safety requirements with physical constraints

Part of the Texas Energy → Orbital Infrastructure Analysis Series:

• 🛰️ TX-1 Orbital Prototype - Physics and economics of orbital compute
• 🔒 Orbital AI Security (this project) - How security changes when humans leave the loop
• 🔐 OWASP LLM Attack Surface - Terrestrial AI security
• 🎯 RAG Propagation Map - RAG-specific vulnerabilities

Tracy Manning
Production MLOps Engineer | AI Security Specialist | Austin, TX

🌐 Portfolio
💼 LinkedIn
🐦 X/Twitter
📊 Tableau Public

Building AI systems that work on Earth—and beyond.

MIT License - free to use with attribution.

• NASA engineers who reviewed TX-1 analysis
• Orbital systems researchers
• AI safety community
• Space security practitioners

@misc{manning2025orbitalaisecurity,
  author = {Manning, Tracy},
  title = {Orbital AI Security: When Humans Leave the Loop},
  year = {2025},
  publisher = {GitHub},
  url = {https://github.com/TAM-DS/...}
}