Key Takeaways
- Telecom operators face fragmented security and network data, making it hard to link cyber alerts with service impact and compliance requirements such as NIS2 and DORA.
- The Catalyst project “Cyber twin: Cyber‑aware ontology for AIOps” introduces a semantic digital twin that unifies network topology, service relationships, and cybersecurity intelligence in a single knowledge graph.
- By combining a telecom‑specific ontology, cyber‑threat data, and agentic execution (GraphRAG, MCP, LLMs), Cyber Twin enriches alerts, predicts impact, and recommends or autonomously executes remediation actions.
- Early results target a 50‑70 % reduction in mean‑time‑to‑detect/repair and a 50 % acceleration toward cyber‑resilient autonomous operations, delivering lower costs, higher customer trust, and streamlined compliance.
- The solution aligns with TM Forum’s Digital Twin for Decision Intelligence framework and supports the broader Autonomous Networks journey through closed‑loop, context‑aware automation.
The Growing Cyber‑Risk Landscape for Telecom Operators
Telecom operators now manage cyber risk across a sprawling set of assets—fixed and mobile networks, cloud‑native platforms, APIs, edge computing, IoT ecosystems, and AI‑enabled services. Each domain introduces distinct vulnerabilities and operational dependencies, while threat actors increasingly view telecom infrastructure as critical national infrastructure. Security operations teams are overwhelmed by fragmented data and high alert volumes, and network operations teams often lack the cyber‑risk context needed to assess whether a vulnerability, configuration drift, or security incident could affect services, customers, or regulatory compliance. This siloed view hampers effective triage, prioritisation, and remediation.
Limitations of Current NOC and SOC Environments
Traditional Network Operations Centres (NOC) and Security Operations Centres (SOC) rely on tools such as XDR, SIEM, and vulnerability‑management platforms that can detect suspicious activity but rarely possess real‑time awareness of network topology, service chains, configuration data, resource dependencies, or customer impact. Conversely, NOC teams observe alarms, performance degradation, or service incidents without understanding the underlying cyber risk. The resulting disconnect makes it difficult to correlate cyber alerts with specific assets, prioritise actions by blast radius, and reduce false positives. Regulatory pressures from frameworks like NIS2 and DORA further demand stronger visibility, risk analysis, and resilience, pushing operators beyond mere alerting toward cyber‑aware, context‑driven operations.
Introducing Cyber Twin: A Semantic Digital Twin for Cyber Resilience
Cyber Twin addresses this gap by acting as a contextual intelligence layer between operational and security systems, creating a single source of truth for network, service, and cyber‑risk data. Built as a semantic digital twin, it combines a knowledge graph and an ontology that model telecom assets, services, relationships, software releases, security configurations, and known vulnerabilities. The model can represent a broad spectrum of environments—mobile and fixed network infrastructure, cloud platforms, enterprise IT, IoT devices, applications, and network devices—enabling vulnerability analysis across heterogeneous operational landscapes. This foundation supports graph‑based analytics, contextual enrichment, relationship inference, service‑impact analysis, root‑cause analysis, predictive analysis, and change‑impact simulation.
Data Integration and the Agentic Enrichment Layer
The solution ingests data from diverse sources: CMDB inventory, NMS telemetry, events and alarms, XDR and SIEM feeds, CVEs, end‑of‑life/support information, vulnerability‑management tools, security‑posture‑management systems, and ITSM ticketing. An agentic layer powered by GraphRAG, MCP, and large‑language‑model (LLM) capabilities interprets incoming alerts, identifies impacted services and customers, scores incident priority, recommends actions, and enriches tickets before they reach an analyst queue. In the demonstrated workflow, the first seven steps of incident enrichment and prioritisation run automatically; final execution employs a hybrid approach where actions requiring sign‑off receive human approval, while routine responses can be fully automated.
Agentic Vulnerability Management and Posture Management
Cyber Twin also showcases agentic vulnerability management and network security‑posture management. In the vulnerability use case, the twin detects vulnerabilities, analyses their contextual relevance, prioritises patches or upgrades, and generates resolution recommendations. In the posture‑management use case, it supports continuous configuration data collection, AI‑driven network discovery, drift detection, compliance validation, cyber‑risk identification, correlation of alarms with performance metrics, impact prediction, remediation planning, and continuous learning. These capabilities enable operators to move from periodic scans to an ongoing, context‑aware security posture that adapts to network changes in real time.
Turning Insight into Autonomous Action
The innovation lies in the fusion of three elements often treated separately: a semantic telecom ontology, cybersecurity intelligence, and agentic execution. Rather than merely visualising data, Cyber Twin equips AI‑driven systems with the context needed to understand which services and customers are exposed, how a threat could propagate, and which response reduces risk without causing unnecessary operational disruption. This context is crucial because cyber issues often manifest first as network symptoms, service degradation, or policy deviations. By linking cyber alerts with topology, dependencies, service impact, and operational data, Cyber Twin supports faster triage, clearer prioritisation, and more effective remediation, shifting security from a reactive, manual function to a proactive, autonomous component of network operations.
Measuring Success and Anticipated Business Benefits
Success is gauged through improvements in operational efficiency, cyber resilience, and automation. The project aims to cut investigation time and operational effort, enhance data quality, reduce alert noise, boost AI effectiveness, and accelerate response to cyber‑related service degradations. Specific targets include a 50‑70 % reduction in mean‑time‑to‑detect (MTTD) and mean‑time‑to‑repair (MTTR) for cybersecurity threats, and a 50 % acceleration toward cyber‑resilient autonomous network operations. For communications service providers (CSPs), expected benefits encompass greater customer trust, lower operational costs, improved resilience, and streamlined compliance with evolving regulations such as NIS2 and DORA. For the wider industry, the project promotes the adoption of secure autonomous networks and helps operators manage increasingly complex 5G and cloud‑native environments recognised as critical national infrastructure.
Alignment with TM Forum Frameworks
Cyber Twin aligns with TM Forum’s Digital Twin for Decision Intelligence framework, specifically IG1307 DT4DI, by leveraging a digital twin, data fabric, AI and analytics, decision intelligence, APIs, UI, and northbound integration concepts. It also supports the Autonomous Networks journey through closed‑loop, context‑aware automation applied to security operations. TM Forum Open APIs facilitate integration and closed‑loop mitigation across operational workflows, ensuring that the solution can be incorporated into existing Telco technology stacks while fostering interoperability and standards‑based innovation.
Why Cyber Twin Matters
The Catalyst addresses a structural weakness in telecom operations: the traditional separation of cybersecurity and network assurance. By introducing a cyber‑aware digital twin, the project enables operators to move beyond isolated alerting toward a shared operational view of network, service, and cyber risk. This integration is vital as cyber threats directly affect service quality, customer trust, regulatory exposure, and the resilience of critical national infrastructure. For CSPs, the value extends beyond faster threat handling to the creation of a self‑defending, context‑aware operational environment where security becomes a core component of AIOps and autonomous networks. Cyber Twin thus offers a practical, standards‑aligned pathway toward safer, smarter, and more resilient telecom operations.