Bangladeshi Telecoms Operator Cuts Detection Time by 55% with Managed SOC

The Bangladesh Telecommunication Regulatory Commission (BTRC) had issued a directive requiring telecoms operators to maintain active security monitoring capabilities. For this operator — serving over 15 million subscribers across voice, data, and mobile financial services — the directive exposed a fundamental gap: they had no dedicated security monitoring function whatsoever.

The operator had experienced two security incidents in the prior 12 months, both detected by customers rather than internal teams. In one case, a subscriber data exposure went unnoticed for 11 days until affected customers reported unusual activity on their accounts. The reputational damage and BTRC scrutiny that followed made clear that reactive detection was no longer tenable.

The internal IT team of six had no dedicated security personnel or SOC experience. Their responsibilities spanned network operations, system administration, and application support — security monitoring was an afterthought handled through periodic manual log reviews that covered less than 10% of the infrastructure.

Core network infrastructure, OSS/BSS systems, and subscriber data platforms lacked centralized monitoring. With 15 million subscribers' personal and billing data at risk, the operator faced both regulatory consequences and significant commercial exposure from any future breach.

A previous attempt to build an in-house SOC had been abandoned after six months. The operator had invested in SIEM tooling but could not recruit qualified SOC analysts in the Bangladeshi market — the few candidates with relevant experience commanded salaries the operator's HR framework could not accommodate, and those who were hired left within months for higher-paying positions in banking or international firms.

• BTRC (Bangladesh Telecommunication Regulatory Commission) issued directive requiring telecoms operators to maintain active security monitoring
• Operator had experienced 2 security incidents in prior 12 months — both detected by customers, not internal teams
• Internal IT team of 6 had no dedicated security personnel or SOC experience
• Core network infrastructure, OSS/BSS systems, and subscriber data platforms lacked centralized monitoring
• 15M+ subscribers' personal and billing data at risk
• Previous attempt to build in-house SOC abandoned after 6 months due to talent shortage and cost

Generic SOC rules designed for enterprise IT environments miss the threat patterns unique to telecommunications infrastructure. A telecom operator's attack surface extends far beyond standard endpoints and servers — it includes signaling protocols, interconnect interfaces, subscriber identity management, and billing systems that have no equivalent in other industries. Applying standard detection rules to a telecom environment produces either overwhelming noise or dangerous blind spots.

EIC built detection capabilities specifically tailored to the operator's telecom environment, covering four critical threat categories that generic SOC providers typically cannot address:

• SIM swap fraud patterns — Unusual IMSI reassignment sequences that indicate unauthorized SIM swaps, including rapid successive reassignments and reassignments originating from non-standard dealer channels
• Interconnect abuse — Unauthorized SS7 messages from unexpected sources, including location queries and call interception attempts from network elements not on the operator's trusted peering list
• Subscriber data access anomalies — Bulk CRM queries outside business hours, unusual export patterns, and access to subscriber records by accounts that had not previously accessed those data sets
• Billing system manipulation — Unusual credit adjustments, balance modifications outside established thresholds, and patterns consistent with internal fraud or compromised billing administrator accounts

Within the first month of operation, the SOC detected and escalated three genuine security events that would have gone unnoticed under the operator's previous monitoring approach. One involved an unauthorized bulk query against the CRM database from a compromised service account during off-hours — a pattern that generic IT security rules would not have flagged because the account had legitimate access permissions. EIC's telecom-specific behavioral baseline identified the anomaly within 14 minutes of occurrence.