// Space ISAC Member Program

Full Spectrum Space Cybersecurity Professional

Space Cybersecurity Operations and Resilience (SCOR) platform professional training

A shared mindset. A real-world method. An incident response your crew has actually rehearsed. Does your organization have all three?

Space ISAC logo
Space ISAC
Proof Labs logo
Proof Labs
Zendir logo
Zendir
D2 Team CORP logo
D2 Team CORP
Who to send

Two courses. Two audiences.

SCOR Associate (4 Hours)

Send your SOC analysts, satellite operators, engineers, program managers, and risk staff.

They return with:

  • The mindset: defense measured by what every move costs the adversary
  • The method: METEORSTORM, the Resilient Cyber Operations framework, run end to end
  • The tools: a standardized taxonomy and ontology their platforms can ingest the same week
  • 4 CPE credits
Sessions and pricing

SCOR Practitioner (8 Hours)

Send your IR leads, security operations, satellite operations, and risk management, together.

They return with:

  • The mindset: defense measured by what every move costs the adversary
  • The method: METEORSTORM, the Resilient Cyber Operations framework, run end to end
  • The tools: a standardized taxonomy and ontology their platforms can ingest the same week
  • The reflexes: a confirmed incident triaged, contained, and recovered under a clock, with the scores to prove it
  • 8 CPE credits
Cohorts and pricing
Why both courses

Three reasons to send your staff to both

01One partner for workforce development and tooling: D2 Team CORP

D2 Team CORP is a 501(c)(3) workforce development and tooling partner operating inside the converged commercial, government, and academic space community. That position is what makes high impact, low cost workforce solutions possible: content built and refined inside the community it serves, subsidized member rates, and open source tooling your teams keep, and directly shape, after the session ends.

02Reflexes are built on a digital twin: Zendir

Incident response is a reflex, and reflexes are built through repetition against realistic consequences. The Zendir digital twin gives your crew a flying spacecraft to defend: live telemetry, real orbital behavior, real consequences, and zero risk to your platform. That is how cyber resilience moves from a document your organization owns to a reflex your people have.

03A 360 degree view of the fight: Proof Labs

Proof Labs brings operational, on-orbit defense experience into the instruction, developing a 360 degree view of the space platform: how an adversary targets it (contextualized threat modeling), how the response runs when they do (incident response preparation), and how the fight is turned back on them (adversary management).

Why it pays

This is workforce development and tooling.

Your people return with tooling: a standardized taxonomy and ontology that can be published as a machine-tag set your threat intelligence platform can ingest the same week, and the method to keep producing entries in it. The Practitioner cohort sends a team home with the ideas and reflexes to update your incident response plan and playbooks. And because everything runs on a provided scenario platform, your architecture, telemetry, and vulnerabilities never enter the room. Only reflexes, ideas, and inspiration leave it.

The shared mindset

The Pentagon of Pain

Most security programs judge their work by what they have put in place. The Pentagon of Pain changes the question to what the adversary now has to pay. It is a way of judging, not a set of steps.

The Pentagon of Pain Five mastery areas around one judgment, what the adversary now has to pay. Each mastery area is judged against one METEORSTORM function. ONE JUDGMENT what the adversary now has to pay 01 Master Decomposition judged against Concept of Operations 02 Master Contextualized Threat Modeling judged against Contextualized Threat Modeling 03 Master Converged Detection Engineering judged against Converged Detection Engineering 04 Master Exposure Management judged against Incident Response Preparation 05 Master Adversary Management judged against Adversary Management
Figure 1. Five points of one judgment, not five stages of a process. Point 04 is judged against Incident Response Preparation: a mastery area and a function are different things, so the names differ.

A mindset with no framework is a poster. A framework with no mindset is compliance work with better filing.

  1. Master DecompositionThe adversary suffers when you know your platform better than they ever can.
  2. Master Contextualized Threat ModelingThe adversary suffers when every strike they imagine is already prepared for.
  3. Master Converged Detection EngineeringThe adversary suffers when they cannot hide, and every move is seen.
  4. Master Exposure ManagementThe adversary suffers when every path they take ends in a trap.
  5. Master Adversary ManagementThe adversary suffers when their plans are known, broken, and turned against them.

Read the one-pagerDownload the PDF

The shared method

METEORSTORM

METEORSTORM covers the ground, user, link, and space segments, and also the aquatic, aerial, and deep space environments. When a merger, an acquisition, or a new market strategy takes your organization toward cislunar, maritime, or drone operations, your staff and your data model come with you: no expensive re-upskilling, no framework migration.

And you do not have to choose METEORSTORM over other frameworks: the analytic layer normalizes past, present, and future frameworks into the same standardized taxonomy and ontology, without building a new taxonomy for each.

  1. F01Concept of OperationsDecompose the platform tailored to your requirements.
  2. F02Contextualized Threat ModelingAnchor every threat to the platform you just decomposed.
  3. F03Converged Detection EngineeringEnumerate attack paths and the data and signals needed to detect each step.
  4. F04Incident Response PreparationWrite the detection signatures and the response playbooks.
  5. F05Adversary ManagementShrink the attack surface the threats keep using.

The METEORSTORM data model: taxonomic elements in four structural layers

Figure 2. Every component of a platform in scope is recorded as exactly one enumerated element, in one of these four layers, and every element names its parent. A fifth layer, Analytic, holds the findings: threats, attack paths, detection signatures and resilience measures, each anchored to the elements it concerns. Published as the MISP taxonomy meteorstorm, version 2.
Figure 3. The Analytic layer. Six elements, three target fields, one destination. Read left to right, they answer the questions an analyst asks as a situation unfolds: has a platform been compromised, is an attack confirmed, is an attack path active, is a threat confirmed, is a detection signature available, and can the threat be engineered out of the platform. Layer 5 has no parent: each finding reaches the platform through its target field.
Table 1. What METEORSTORM normalizes, the Analytics Catalog: frameworks and intelligence feeds, and the analytic elements each normalizes into; recommendations, not restrictions. Past, current and evolving frameworks normalize into the same six elements, anchored to the same decomposition. METEORSTORM does not replace these frameworks, and it does not compete with them. An indicator entry is never drawn from an architectural framework, because an indicator cannot be theoretical.

Read the one-pagerDownload the PDF

Compliance

Your annual incident response exercise, performed and documented

The Practitioner course includes a second four-hour session that is a conducted incident response exercise: your crew responds to a confirmed incident under a clock, and comes back with the experience, the scores, and the takeaways to update your incident response plan and playbooks.

Enroll

Sessions, September to December 2026

Anyone who touches space cyber

SCOR Associate (4 Hours)

150.00 USD per seat for Space ISAC members (standard 250.00 USD)

Tuesdays, 13:00 to 17:00 ET. Complete in one session. 15 seats per date.

SessionDate
Session 18 Sep 2026
Session 215 Sep 2026
Session 322 Sep 2026
Session 429 Sep 2026
Session 56 Oct 2026
Session 613 Oct 2026
Session 720 Oct 2026
Session 827 Oct 2026
Session 910 Nov 2026
Session 1017 Nov 2026
Session 111 Dec 2026
Session 128 Dec 2026
Session 1315 Dec 2026
Center of Excellence
Your incident response chain

SCOR Practitioner (8 Hours)

1,500.00 USD per seat for Space ISAC members (standard 2,500.00 USD)

Wednesday and Thursday, 13:00 to 17:00 ET. Both parts in the same week. 15 seats per cohort.

CohortPart One (Wed)Part Two (Thu)
Cohort 19 Sep 202610 Sep 2026
Cohort 216 Sep 202617 Sep 2026
Cohort 323 Sep 202624 Sep 2026
Cohort 430 Sep 20261 Oct 2026
Cohort 57 Oct 20268 Oct 2026
Cohort 614 Oct 202615 Oct 2026
Cohort 721 Oct 202622 Oct 2026
Cohort 828 Oct 202629 Oct 2026
Cohort 1018 Nov 202619 Nov 2026
Cohort 112 Dec 20263 Dec 2026
Cohort 129 Dec 202610 Dec 2026
Cohort 1316 Dec 202617 Dec 2026
Center of Excellence
Space ISAC members only

METEORSTORM Resilient Cyber Operations Exercise (2 Hours)

Free for Space ISAC members, 20 seats per session, first come first served

A two-hour, facilitated team exercise that introduces parts of the Resilient Cyber Operations framework. Five teams each run a company defending one environment against one adversary campaign modeled on real-world attacks, and live with the cost of every decision.

  • Counts towards annual space-specific cybersecurity training, with a certificate of completion for your training record
  • 2 CPE credits and a shareable, blockchain-backed digital badge (see an example)
  • Members are seated the moment they register while seats remain, and confirmed by email within minutes

Third Monday of the month, 13:00 to 15:00 ET. Registration closes two days before each session.

SessionDate
October19 Oct 2026
November16 Nov 2026
December21 Dec 2026

A minimum of five registered participants is required for a session to take place.

Register Details and the walkthrough video
The METEORSTORM Resilient Cyber Operations Exercise digital badge, 2 CPE
The next step

Send fifteen.

Every session caps at 15 seats. The organizations that get the most from this program reserve a full session and send security operations, satellite operations, engineering, and risk management through the door together. Preregister through the Center of Excellence and tell us you want all fifteen.

Center of Excellence: Associate Center of Excellence: Practitioner