Critical infrastructure application, reviewed 8 October 2026
The banking example generalizes to civilian critical services that need to survive a terrestrial disruption. It does not establish that any named military force operates the architecture. The relevant question is whether the fallback path preserves an essential service without inheriting the primary path’s power, authentication or network-management failure.
CISA and partner agencies’ communications-infrastructure hardening guidance places visibility and secure administration at the centre of defensive practice. That supports including the management plane, logging and supplier access in the resilience test. It does not provide a product endorsement or a current satellite price/performance benchmark. CISA guidance.
A public institution should own the impact tolerance, the commercial acceptance test and the decision about which services may operate in degraded mode. The supplier owns only the contracted components. Procurement is complete when those responsibilities can be exercised together during a realistic test.
Satellite connectivity becomes valuable to a bank when it preserves a defined service through a terrestrial failure. Peak bandwidth is a secondary purchasing criterion. The central decision is whether a satellite path, its ground infrastructure and its managed-service wrapper together provide sufficiently independent, predictable and auditable recovery.
The source assessment dates to February 2026. This edition retains its banking continuity use case and moves it to The Defense Lens because critical-service resilience is its principal public-policy contribution. Historic vendor latency and price ranges have been removed from the public comparison: they were not current quotations or independently tested service levels.
Four use cases require four different specifications
Four satellite-related use cases require different specifications
| Aspect | Retained observation |
|---|---|
| Continuity | The most persuasive banking use case is continuity: a terrestrial connection carries normal traffic while a satellite path preserves important services when fibre, mobile backhaul or a submarine cable fails. Success means that a customer can complete an essential transaction within the institution’s impact tolerance. It does not necessarily mean that every application retains its usual speed. |
| Coverage extension | A second use case is coverage extension. A remote branch, temporary operating site or cash machine may lack a dependable terrestrial option. Satellite service then becomes a primary access path. That changes the acceptable commercial structure, the importance of local installation support and the consequences of a terminal failure. A backup service used during occasional incidents and a primary service carrying daily operations should not share an unmodified specification. |
| One-to-many distribution | The third use case is one-to-many distribution. Broadcast architecture can distribute common information over a broad footprint efficiently. Its relevance depends on whether recipients need an identical stream and whether the application tolerates the propagation delay. Interactive transactions and geographically distributed broadcasts are different workloads. |
| Quantum-related security research | The fourth is quantum-related security research. Post-quantum cryptography changes cryptographic algorithms; quantum key distribution attempts to distribute keys through a different physical mechanism. Neither is synonymous with a satellite connection, and neither compensates for weak identity management or an untested recovery procedure. The historical report expected quantum-safe capability to differentiate suppliers by 2030. That remains an archived forecast, not an established competitive outcome. |
Figure 01 · Qualitative comparison
Start with the work that must continue
| Design input | Question |
|---|---|
| Task | What must complete under degraded conditions? |
| Performance | What delay and throughput can that task tolerate? |
| Fallback | What usable route remains after failure? |
| Support | Who restores and maintains the service? |
Latency is a distribution, not a brochure average
A procurement specification should measure latency, variation, loss, interruption and application recovery separately. Orbit geometry constrains propagation, but the purchased service also depends on gateways, routing, contention, weather and the terminal installation.
| Measurement | Evidence required |
|---|---|
| Ordinary latency | Median and upper percentiles on the full application path |
| Handover and recovery | Duration and frequency of observed interruptions |
| Packet integrity | Loss, reordering and application reconciliation |
| Availability | Endpoint boundary, clock, exclusions and failure clustering |
| Commercial cost | Current comparable quote including support, licences and integration |
Averages can obscure the failure that matters. A payment application may tolerate a stable 80-millisecond path more comfortably than a 35-millisecond average with repeated multi-second stalls. A voice application may remain usable under moderate delay but become difficult under rapid jitter. A market-data consumer may need sequence integrity more urgently than absolute bandwidth.
Testing should therefore record the median, upper-percentile delay, packet loss, jitter, interruption frequency and recovery duration. These should be measured under weather stress, busy-period contention and terminal handovers. The service-level agreement should say whether it measures the satellite segment, the provider’s managed endpoint or the complete application path. Only the last of these directly captures the customer experience, although responsibility may be shared.
The distinction is economically material. A theoretical availability of 99.99% permits about 52.56 minutes of annual unavailability in a 365-day year. At 99.9%, the comparable allowance is about 8.76 hours. Neither number describes the clustering of failures. Fifty minutes during a critical settlement window can be more damaging than several isolated overnight interruptions.
Diversity has to survive a dependency audit
A second connection is useful only to the extent that it fails differently from the first. Two nominally separate suppliers can share terrestrial backhaul, electricity, rooftop access, a ground station, an identity provider or a managed-service control plane. Counting contracts is an inadequate substitute for mapping dependencies.
Begin at the important business service and trace its dependencies to the customer. Include the branch terminal, local router, power supply, authentication service, satellite terminal, ground gateway, network-security service and destination application. Mark which dependencies remain common when traffic switches to the satellite path. A backup that requires the failed terrestrial link to authenticate or receive its configuration is not independent in the relevant incident.
Physical dependencies matter too. An antenna needs a workable view of the sky, appropriate mounting, a maintenance plan and power during a local outage. A geographically remote backup path still provides little value if its terminal shares the same unprotected distribution board as the primary router. The resilience design must include what happens when the building itself becomes unavailable.
Network diversity can also create new security paths. Failover must preserve encryption, segmentation, inspection and access policy. A recovery test that proves connectivity while silently bypassing a control has solved the wrong problem. The bank should agree in advance which degraded services remain permissible and which transactions must stop until full controls return.
Figure 02 · Conceptual framework
Diversity must survive the dependency check
How the parts connect
- Primary pathmay shareShared dependencies
- Satellite pathmay shareShared dependencies
- Shared dependenciestest and reduceIndependent recovery
- Independent recoveryvalidateService continuity
The managed-service layer is part of the product
Banks rarely purchase an isolated radio link and operate every surrounding component themselves. They buy installation, monitoring, escalation, network integration and incident accountability. Consequently, the managed-service provider can matter as much as the constellation operator.
An effective service contract identifies who owns each stage of an incident. If the satellite segment is healthy but traffic fails between the ground gateway and the bank’s application, the customer should not spend the recovery window coordinating incompatible support desks. The contract needs a lead responder, clear escalation rights and access to evidence from subcontractors.
Support quality becomes particularly important across jurisdictions. Local licensing, import requirements, maintenance availability and permitted traffic routing can affect whether a technically suitable service is deployable. A provider’s global coverage map does not establish that every legal entity can use the same service configuration. Country availability should be tested at the product, licence and installation level.
The historical analysis regarded financial-grade managed low-orbit connectivity as underserved. Its stronger claim was that buyers would prefer an enforceable committed service to a much larger advertised bandwidth figure without operating evidence. That claim is preserved as a procurement thesis. It should not be read as a statement that no supplier now offers a relevant service-level agreement.
A useful proof of concept includes deliberate failure
The test environment should contain representative applications, traffic priorities and security policies. A high-speed file transfer alone establishes little about continuity of banking services. Run ordinary workloads first, then reproduce the incidents the service is intended to survive.
Useful tests include loss of the primary circuit, degradation rather than complete loss, ground-gateway interruption, loss of local power, delayed authentication, packet reordering and a prolonged incident during which the recovery link becomes congested. Test the return to the primary circuit as carefully as the initial failover. Oscillating between paths can be more disruptive than remaining temporarily on a slower stable connection.
For each scenario, record detection time, traffic-switching time, application recovery time, failed transactions and manual interventions. Distinguish transactions that failed safely from transactions with an uncertain outcome. The latter require reconciliation before retrying, especially in payment and trading workflows.
Acceptance should be tied to business outcomes. A branch may need to support essential cash and account services for a defined period while noncritical traffic is restricted. A dealing operation may need secure communications and access to risk information even when latency-sensitive activity is paused. These are different recovery objectives and should produce different capacity allocations.
Figure 03 · Conceptual framework
A proof of concept that can reject the purchase
How the parts connect
- Agree acceptancetest planSimulate disruption
- Simulate disruptionrecoverFail over
- Fail overprove serviceComplete the task
- Complete the taskevidenceDecide and retest
- Decide and retestreviewAgree acceptance
Cost should be measured against preserved service
This edition does not publish an unverified 2026 monthly price. Obtain like-for-like quotations for the actual geography, terminal, committed capacity, support and legal service perimeter.
Annual direct cost is only one component. Add terminal installation, integration, monitoring, maintenance, backup power, resilience exercises, replacement equipment and the internal effort required to keep the configuration current. A dormant backup link that has not been exercised may carry a low monthly invoice and very little actual resilience value.
The business case should relate the total cost to services preserved during a credible incident. Relevant benefits include avoided disruption, reduced recovery time and a lower probability that a local communications failure becomes a wider operational event. Avoid presenting a precise return on investment when incident frequency and loss severity are poorly established. Scenario ranges are more honest and often more decision-useful.
Capacity can be tiered. Essential transactions and controlled communications receive priority; bulk replication, software downloads and nonurgent analytics can be deferred. This prevents the requirement from expanding until the backup is priced as a duplicate of the entire primary network.
Keep the recovery configuration current
The backup path should be exercised after material changes to routing, identity, security policy or important applications. A connection that worked during installation can become ineffective through ordinary configuration drift. Record the tested configuration, observed recovery time and unresolved limitations. Operations should know whether the latest application release has been tested on the reduced-capacity path. This turns a purchased backup into a maintained recovery capability and gives procurement evidence for the next renewal.
Buying criteria and review triggers
Evidence required before accepting a satellite recovery service
| Decision area | Evidence to demand | Reason to reject or redesign |
|---|---|---|
| Independence | Documented power, gateway and backhaul dependencies | Primary and recovery paths share the critical failure |
| Performance | Application tests under load and handover | Average latency hides unacceptable interruption |
| Controls | Verified routing, encryption and access policy during failover | Recovery bypasses mandatory controls |
| Operations | Joint runbook and accountable incident lead | Supplier boundaries delay diagnosis |
| Contract | Defined service boundary, remedies and exit rights | Availability exclusions remove the protection sought |
| Maintainability | Scheduled tests, firmware control and local support | Backup configuration drifts out of service |
Review the design when an important application changes, a provider changes ground infrastructure, a legal entity expands into a new jurisdiction or a recovery exercise reveals an unexpected common dependency. Annual procurement review alone may miss a material change in resilience.
The strongest satellite proposition for banking is therefore a controlled recovery service with tested dependencies, clear accountability and a credible operating cost. Lower-orbit architectures can reduce propagation delay, while the full purchased service still requires measurement. They do not remove the need to prove that a bank can recover the service its customers actually use.
