Telecommunications
Telecom networks carry everyone else’s traffic, run on cryptography that has to outlive today’s algorithms, and are a prime target for state-backed intrusion. We test the equipment, the core and the customer-facing systems — and never the public radio network without authority.
Book a ConsultationThe network is software now — and so is the attack surface
A 5G core is a set of cloud-native network functions talking to each other over HTTP APIs. Radio access is being virtualised, interconnects still carry legacy SS7 and Diameter signalling, and millions of customer routers sit at the edge. Each layer brings software flaws, management interfaces and trust relationships that an attacker can chain.
Regulation has caught up. In the UK, the Telecommunications (Security) Act and its regulations impose binding security duties, and the government’s code of practice sets out expected dates running to the end of 2029 — now including signalling, SIMs, APIs and security testing. In the EU, NIS2 covers network and service providers and the Cyber Resilience Act covers routers, modems and SIMs. In the US, intrusions into carrier networks led CISA, NSA and FBI to issue joint hardening guidance in December 2024.
Post-quantum work is under way in telecom’s own standards bodies: the GSMA has published post-quantum guidelines for telecom use cases, and 3GPP has completed its study on migrating 5G and begun the standards work. No post-quantum replacement for subscriber identity protection has been standardised yet — and keys in SIMs and network elements last for years, so the inventory comes first.
Three services, tuned to the network
Artificial Intelligence Security (AI-BOM)
AI in network automation and operations, and customer-service assistants and agents that can change accounts, numbers and SIMs. We test whether someone can talk an AI into a SIM swap — and what an operations agent can be steered into reconfiguring.
Learn more →Post-Quantum Cryptography Readiness (CBOM)
A cryptographic inventory across SIM and eSIM provisioning, subscriber identity protection, network-element PKI, IPsec and TLS on backhaul and interconnect, and management access. Re-keying millions of SIMs or devices is a logistics problem, so the roadmap starts with what you procure next.
Learn more →Product Penetration Testing
For equipment makers: routers, customer premises equipment, RAN and core network functions, with their firmware and management interfaces. For operators: 5G core interfaces, signalling interconnect exposure, management and OSS/BSS platforms, and the portals and apps where SIM-swap and account-takeover fraud begins.
Learn more →Built for carrier networks, not adapted from enterprise IT
Interfaces, not just perimeters
Network functions trust each other through APIs and certificates. We test the authorization between them — which function can call which, with what token — not just what is reachable from outside.
Fraud paths are findings
SIM swaps, port-outs and account takeovers start in customer care, retail and self-service flows. We test those business processes and the AI in them, and rate them on what an attacker gains — a victim’s number and everything tied to it.
Equipment evidence operators can use
For vendors, results structured so your operator customers’ security teams can review them — firmware, management plane, update integrity and hardening, pinned to the exact version tested.
Live elements, scheduled
Testing of production network elements happens in maintenance windows agreed with your operations centre, with a stop channel open. Labs and staging cores come first wherever they exist.
Where the rules stand, market by market
Telecoms carries some of the most prescriptive security law of any sector, and post-quantum work is already under way in its standards bodies. Current as of October 2026.
| Market | Instrument | What it means for you |
|---|---|---|
| United Kingdom | Telecommunications (Security) Act 2021 SI 2022/933 and Code of Practice v1.1 (July 2026) | Binding since 1 October 2022 and enforced by Ofcom: the Act’s security duties cover every public telecoms provider, and the regulations all but micro-entities. The code is guidance that Ofcom and the courts must take into account. It sets expected dates for providers with £50m or more relevant turnover: the first measures by March 2024 and March 2025, more by March 2027 and March 2028. Version 1.1 (14 July 2026) adds signalling, SIM, API, automation and security-testing measures expected between March 2028 and December 2029, and strongly recommends Ofcom’s threat-led TBEST testing. |
| United Kingdom | Designated vendor directions (Huawei) | Binding directions, in force since October 2022, on the operators that received them: no use of Huawei equipment or services in any part of their 5G networks after 31 December 2027. |
| European Union | NIS2 — Directive (EU) 2022/2555 | Providers of public electronic communications networks and services are in a sector of high criticality (Annex I, digital infrastructure); the Directive binds through national law, which Member States had to apply from 18 October 2024. The telecom security rules that used to sit in the European Electronic Communications Code moved into NIS2 in October 2024. |
| European Union | Cyber Resilience Act — Reg (EU) 2024/2847 | Routers, modems and switches, network management systems and VPN products are Class I important products; firewalls and intrusion-prevention systems are Class II; secure elements — the basis of SIMs and eSIMs — are critical products. There is no exclusion for carrier-grade equipment sold to operators. In force since 10 December 2024: manufacturers have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026, and the main obligations apply from 11 December 2027. |
| European Union (proposed) | Cybersecurity Act 2 and Digital Networks Act (January 2026) | Proposals, not law. The Cybersecurity Act 2 would phase high-risk suppliers out of mobile networks within three years of a supplier list being published; the Digital Networks Act would replace the European Electronic Communications Code. Both are still before the European Parliament and the Council. |
| United States | CISA, NSA and FBI — Enhanced Visibility and Hardening Guidance (December 2024) | Joint guidance, with Australian, Canadian and New Zealand partners, issued after PRC-affiliated intrusions into telecom networks: visibility, logging and hardening of network devices. The FCC withdrew its related CALEA ruling in November 2025. |
| United States | FCC SIM-swap and port-out rules | Adopted in 2023 to require secure customer authentication before SIM changes and number port-outs — but compliance is on hold until the FCC announces a date, and none has been set. |
| United States | Secure and Trusted Communications Networks Act | The rip-and-replace programme for covered equipment: the main deadline was May 2026, with extensions granted, and 53 of 126 projects were complete by June 2026. |
| Industry | GSMA FS.31, FS.11, FS.19 NESAS 3.0 | Voluntary industry baseline security controls, SS7 and Diameter interconnect security guidelines, and the network-equipment security assurance scheme. The UK code cites FS.11 and FS.19 for signalling, but says NESAS’s paper-based assessments, as currently defined, are unlikely to give operators useful evidence of product security. The EU’s planned 5G certification scheme based on NESAS has not been adopted. |
| Post-quantum | GSMA PQ.03 (October 2024) 3GPP TR 33.703 and Release 20 work items | Voluntary post-quantum guidelines for telecom use cases. A 3GPP study approved in June 2026 recommends standalone and hybrid post-quantum schemes for subscriber identity protection; the normative work on that, and on network-domain security, is under way in Release 20, whose protocol freeze is targeted for March 2027. There is no telecom-specific deadline; the general timelines on our PQC page are the reference points. |
| European Union | AI Act — Reg (EU) 2024/1689, Annex III point 2; dates as amended by Reg (EU) 2026/1744 | Binding regulation. AI used as a safety component in the management and operation of critical digital infrastructure — public telecom networks and services included — falls under the high-risk rules from 2 December 2027, after the Digital Omnibus on AI (in force since 27 July 2026) postponed them from 2 August 2026. |
What you get
- Findings by network function and interface — with reproduction steps, the exact software versions tested, and fixes ranked by what an attacker could reach
- Fraud-path results — SIM-swap, port-out and account-takeover attempts across care, retail, self-service and AI channels, with the controls that stopped or missed them
- Equipment security evidence — for vendors, results your operator customers’ security teams can review
- Cryptographic bill of materials — SIM, signalling, PKI and transport cryptography in CycloneDX format, with a post-quantum roadmap tied to procurement and refresh cycles
- AI bill of materials — the models, data and tools behind your network and customer AI, delivered as a CycloneDX ML-BOM
- Retest of fixes — evidence that remediation landed
Secure the network everyone else depends on.
A telecommunications engagement starts with your network architecture, your equipment, and the regulator you answer to.
Get in Touch