From zero-day to AI-defense: Advancing predictive OT security in telecom

In Nokia’s recently published Threat Intelligence report, only 13% of surveyed North American telco security professionals say they are fully prepared to respond to zero-days, where vulnerabilities are exploited without warning. These attacks are increasingly customized for telecom-specific protocols, platforms, and management systems, often serving as the initial foothold in broader, multi-stage campaigns. Groups such as Salt Typhoon use zero-day tactics to gain access, then move laterally through networks and exfiltrate data using advanced post-compromise techniques.

60% of North American telco security operations teams faced at least one LOTL attack last year — and more than 25% experienced four or more. These silent infiltrations leverage legitimate tools and trusted processes, blending seamlessly into normal network activity and making detection exceptionally difficult.

As explored in my previous articles, “Closing the Telecom Security Gap: Proactive AI is the Future” and “Alarms are sounding: Why telecoms need a proactive AI defense,” the need for smarter, faster, and more predictive security solutions has never been clearer.

Real-time OT threat detection at network scale

In telecom environments, detection must occur at packet-level speed — without adding latency or operational disruption.

Advanced platforms such as Nokia’s NetGuard EDR deliver real-time OT threat detection through high-speed packet inspection across both network and endpoint sensors. By combining supervised and unsupervised analytics with reinforcement learning techniques, the system identifies emerging threats exploits — at their earliest observable stage.

A key differentiator is the combination of ML-driven supervised multi-classifier and unsupervised clustering engine, which autonomously discovers unseen attack patterns through real-time packet-level inspection. Rather than relying solely on signatures or previously known labeled indicators, the clustering engine continuously analyzes behavioral deviations across telecom and industrial protocols. This enables proactive threat detection and dynamic intelligence generation — even when facing highly customized or novel attack techniques.

The result is deterministic visibility across complex, multi-vendor OT environments, delivering:

For telecom operators defending against zero-day campaigns and LOTL tactics, this level of speed and accuracy is foundational.

Unified analytics: reducing noise, increasing confidence

As threat velocity increases, alert fatigue becomes a strategic risk. Fragmented tooling generates redundant signals and slows investigation cycles.

Unified XDR frameworks such as NetGuard Cybersecurity Dome correlate telemetry across heterogeneous sensors and platforms to create a single, contextualized incident view. By eliminating duplication and noise, security teams gain higher-confidence alerts and a streamlined workflow.

This consolidated visibility is especially critical in detecting LOTL behavior, where malicious activity hides within legitimate operational processes.

Agentic AI: autonomous threat hunting

The next evolution in OT security is the integration of Agentic AI — autonomous agents capable of continuous threat hunting.

Unlike static automation, these agents learn from interactions, adapt to evolving attack patterns, and execute full workflows from detection and investigation to containment. They operate persistently across the infrastructure, identifying weak signals that human analysts might miss in high-volume environments.

This shifts security operations from tactical triage to strategic risk management, allowing teams to focus on resilience while AI-driven agents manage operational threat suppression in real time.

From reactive defense to predictive cyber resilience

By integrating real-time detection, intelligent correlation, Agentic AI, and consolidated threat intelligence, telecom operators can move from reactive defense to predictive cyber resilience.

As emphasized in my earlier LinkedIn discussions, the future of OT cybersecurity lies in collaborative, AI-driven ecosystems that anticipate adversarial behavior rather than merely respond to incidents.

For telecom and mission-critical OT enterprises, predictive, AI-supported security is no longer aspirational — it is operationally essential.

For more information on how Nokia is revolutionizing OT security, I encourage you to explore our NetGuard Cybersecurity Dome and NetGuard EDR solutions.

Join us in San Francisco at RSAC — meet the Nokia security team, experience our latest breakthroughs firsthand, and discover how we’re shaping the future of telecom-grade protection. We can’t wait to connect with you at RSAC 2026.