- Home
- Industries
- Telecommunications
Security for the networks Canada runs on,
from the core to the edge.
Carriers, ISPs, cable and wireless providers are among the highest-priority targets for state-backed espionage, and every outage is public. We watch around the clock, hunt for the quiet intruder in your network devices and help you show government your work.
Where telecom providers get hit.
The attackers want what flows through your network, the subscribers behind it, or the leverage of taking it down.
State-backed espionage
Nation-state groups target carriers for call records, location data and lawful-access systems. The Canadian Centre for Cyber Security reported in 2025 that network devices at a Canadian telecom were compromised in this campaign.
Edge and network devices
Routers, firewalls and VPN gateways at the perimeter are exploited to pull configurations, mirror traffic and move deeper. Endpoint tools rarely see them.
SIM swap and account takeover
Fraudsters social-engineer retail and support staff, or buy insider help, to port numbers and take over subscriber accounts that protect banking and email.
Signalling and interconnect abuse
Weaknesses in roaming and interconnect signalling are used to track subscribers and intercept messages. Detection has to understand the protocols.
Ransomware and outages
Operators know a carrier cannot tolerate downtime. An infection in billing, provisioning or support systems can force a service-affecting shutdown.
Vendor and supply-chain risk
Managed network services, equipment vendors and outsourced support hold privileged access. The government can now order you to stop using specified products and services.
The frameworks you report against.
Canadian requirements first, then the US and EU rules that apply when you operate abroad.
| Framework | Who it applies to | What we help with |
|---|---|---|
| Critical Cyber Systems Protection Act (Bill C-8, Royal Assent June 2026, not yet in force) | Telecommunications service providers, once designated by order. Telecommunications services are listed as a vital service | Cyber security programme design, supply-chain risk management, and readiness to report incidents to CSE within the window set by regulation, no more than 72 hours |
| Telecommunications Act, security orders (sections 15.1 and 15.2, added by Bill C-8) | Canadian telecommunications service providers | Security plans, vulnerability assessments and the asset and vendor inventory you need to act quickly on an order |
| CRTC major service outage reporting (Telecom Decision CRTC 2025-225) | Canadian telecommunications service providers | Fast scoping of cyber-caused outages so notifications and post-outage reports are accurate and on time |
| PIPEDA and Quebec Law 25 | Providers handling personal information of Canadians and Quebec residents | Breach investigation, harm assessment support and documented incident records for subscriber data |
| FCC CPNI rules | Providers with US operations handling customer proprietary network information | Breach investigation and the facts behind notification |
| NIS2 Directive | Providers of public electronic communications networks or services in the EU | Risk management measures, incident handling and supply-chain security support |
Specialist work for carrier environments.
Network device compromise
Hunting and forensic review of routers, firewalls and VPN gateways: configuration changes, unexpected tunnels and accounts that should not be there.
Subscriber fraud investigations
Investigation of SIM swap and account takeover cases, including insider involvement, with evidence handled to a standard that holds up.
Outage and order exercises
War games built on a cyber-caused outage or a government security order, run with network operations, legal and communications in the room.
How we help telecom providers.
MSOC
An autonomous SOC that detects and contains threats in under two minutes, around the clock, with guardrails that keep core network systems out of automatic containment.
Learn more →IR retainer
Pre-agreed terms and guaranteed response from four hours down to one, so the team answers first when an incident turns into an outage.
Learn more →Threat hunting
Hypothesis-driven hunts for the patient, state-backed intruder that lives in network infrastructure and avoids automated detection.
Learn more →RagnarökPenetration testing
Testing of customer portals, support tooling, provisioning systems and the management plane, every finding with a fix.
Learn more →Supply chain & third-party risk
Tiering, technical assessment and monitoring of the vendors with privileged access to your network, ready for CCSPA supply-chain obligations.
Learn more →Darknet & leak-site monitoring
Watch for stolen subscriber data, staff credentials and insider recruitment for SIM swap fraud on criminal forums and leak sites.
Learn more →What buyers ask.
Does the CCSPA apply to us yet?
Not yet. The act has Royal Assent but is not in force, and no operators have been designated. Telecommunications services are listed as a vital service, so expect it. Designated operators get 90 days to establish a cyber security programme, which is why we suggest starting now. Separately, Bill C-8 also gave the government order-making powers under the Telecommunications Act.
Will an autonomous SOC act on our core network without asking?
No. It acts inside boundaries you set, logs everything and takes nothing irreversible without senior sign-off. Network infrastructure can be kept out of automatic containment entirely, and you can run it human-in-the-loop.
We think someone is in our routers. What do we do?
Call the hotline. Our responders scope it, preserve the evidence and work through the devices with your network team, without causing the outage you are trying to avoid. Our Bifrost examiners document what happened for regulators and government partners.
Where does our data live?
100% Canadian-owned, with primary operations in Canada. We deploy to meet each client's data-residency requirements, and Canadian clients' data stays in Canada.
Talk to someone who knows carrier networks.
Put a specialist on a call to scope monitoring, response or CCSPA readiness. No charge, no commitment.