James Pearce, TelecomTV (00:05):
Hello and welcome to TelecomTV. I'm James Pearce and I'm in Vienna for Network X. I'm delighted to be joined today by Terje Jensen, who's from Telenor. Thank you so much for joining us today. Let's talk cybersecurity. What are some of the biggest security threats facing telecom operators in 2026?

Dr. Terje Jensen, Telenor (00:21):
No, so we have seen an explosion of geopolitical turbulence that's of course coming back from these big states and what they are meaning about this other, which is changing almost from day to day. And that ripples down also into security. So we see a big engagement from state threat actors into criminal crime teams and also into individual levels. And this is course trending and that has been over the last years into security as a service. So it's a big business. And you probably know cyber crime is the third biggest economy in the world. So that means that you have USA, you have China, and you have cyber crime. So there's a lot of money in that and that attracts various criminal elements. But you also see back to the turbulence that the state actors are engaging criminal teams as proxies. So they get others to do the laundry or the dirty business.

(01:20):
And if you talk about the cases, what are they doing? So they are typically doing DDoS attacks, volume attacks to degrade the performance. And it's interesting to see when the government, for example, is like in Denmark was out and say that we are going to support and produce ammunition, within a couple of minutes they were attacked by DDoS. So that just exemplifies the relationship with different actors. So DDoS is one of attacks, but then we see ransomware and earlier it was ransomware and I pay you some money and I unlock it. Now these ransomware guys are actually exploiting the information. So they're doing a multi-sided business model. So they potentially get paid from me, for example, but they also sell the data further. So they are gaining from all the sides on that side. So ransomware is also still a big business, a big threat.

(02:15):
Then we have all the phishing. Their phishing is everywhere. It could be on voice, deep fake voice, video, emails, all this kind of 'ishing', if I may call it that. And there are attempts every day. And a good thing there, I think we are coming back to that later, but for example, so as a telco operator, we see that we have a role in society. So in Norway, for example, we are blocking more than seven million of those fraud attempts every day on behalf of our customers. And we have a customer base roughly on three million. So that means that there are more than two blocks every day on this. So it's incredible. Again, it comes back to how much money is in this. So that's some of the threats we see. And on top of that is also along the delivery chain. So we have of course ourself and protecting our assets.

(03:07):
We have the customers and we have the suppliers. And all these kind of things are exploding in terms of all these threats and cyber things and this makes our day very busy actually to stay on top of this.

James Pearce, TelecomTV (03:20):
I mean, it paints a fairly scary picture, I think. Obviously AI is another factor in that. So what impact is AI having on the threat landscape and how can telcos mitigate that?

Dr. Terje Jensen, Telenor (03:29):
Yeah. So we see that AI is, I think someone says that it's actually a multiplication factor, call it an amplifier, an accelerator. So it helps with capacity, it helps with speed, it comes with capabilities, deep fakes and these kind of things. And it's also reducing the threshold for not that advanced criminal teams to actually do these kind of things, back to all these criminal groups engaging in cyber crime. So all these kind of things is helping, if I may call the bad guys on doing this. So that's some of the things we have to be aware of. And then what do we do? Of course we are protecting ourself, our assets. We are using AI a lot actually into that. We are using AI just to understand the threat landscape. As I said, the threat landscape is very dynamic. It could be changing several times a day.

(04:21):
So have a human to have an overview of this is quite challenging. So we are using AI agent to do that, collecting information, trends, what's happening day to day several times a day, putting that together and what does it mean for my business or our business because there could be some threats out there, but maybe not relevant for me. So translating those threats into what it really means for my business is very important. Then we are using that information when something is happening, like monitoring what should we look for, what are the top 10 risks these days, what's happening and so on. Also in case there is an incident, okay, so who are actors, what are the traditional behaviour, what are you doing? So in case of incident or crisis management, what are you doing there? Then they're using AI all the way around from helping to improve the specifications, understanding specifications.

(05:12):
They're using AI as simple as gamifying our awareness and training. So we can use AI from a defence point of view in a lot of these different activities within security. Then of course, just to be a bit on the negative side, AI by itself comes of course with some new risks. There's a new surface there. You have large language models, you can pollute the data, you have prompt injections, you have lots of interesting things. So responsible use of AI and actually also monitoring that and have a governance regime around that one is also very important.

James Pearce, TelecomTV (05:47):
Because the other issue obviously is telcos are making plans to integrate AI into their networks and into their systems, but we're seeing a lot of threats from the models and a lot of behaviour that's maybe not expected. So should telcos maybe reassess their AI plans in the face of those concerns, especially after the recent incidents that we've seen involving some of the frontier AI models?

Dr. Terje Jensen, Telenor (06:09):
I would say yes and no, depending on your perspective because AI is going to happen. So to try to close your eyes or stick your neck into this or head into the sand doesn't really help. But you need to keep track on what's following, I think, and what's happening out there. So typically that will make you change your original plans. But if your original plan was to be naïve, it should be about, you should have changed it no matter what. So I will probably say yes, you should change your plan, but it's not only because these frontier AI models, but because things are happening, the new information coming and so on. So what we are doing is we are looking into some specific what are coming from the new frontier models. And then we are saying that, okay, there are four different topics we should do.

(06:58):
The first one is we should definitely understand what is beyond the hype. And there is some hype associated with this. Of course there are some interesting cases as well, but there are some hypes. So we have been practising also on the frontier testing on software based, for example, and I can confirm it finds quite a number of vulnerabilities. Not all the vulnerabilities are critical. So it's good to know that even though there are some old softwares, some call it holes in the security holes in that, it's not really that all of them can be exploited. But that's what we are doing. One of the things is to understand the threats, what's happening and what does it mean for us? Then the second one, as I said, we are also using those models to test our own software. And we have, as I said, found some interesting things.

(07:47):
And this goes back to that AI have better capacity. They can test very, very unlikely scenarios. So meaning that a human, we say that, "Oh, that will never happen." It will go there and it might be finding something. And then that's the second part of it. We are using this AI model to test our own, call it developed software. Then the third one is to ask the suppliers, "What are you doing? Are you using these frontier AI models? What's the findings? How is that affecting us? Should we update the processes?" We typically are asking for something we call early notification, meaning that we are not only leaning on the patch and then we implement a patch. You have to ask them to tell us upfront right away when they come across the vulnerability, what does it really mean for us and what should we do?

(08:36):
So should we activate a firewall? We could do other things than wait for the patch. So that's the third thing we are doing on this. And then the fourth thing we are doing is something called business continuity because this will potentially trigger new disaster or crisis scenarios. And do we have plans in place? Have we tested them? Are we comfortable that we are prepared for these kind of things and they have a recovery plan or come back to business when these things happens? These are the four things we are doing when it comes to this. So we are changing the plans in that respect.

James Pearce, TelecomTV (09:10):
That's interesting. I just wanted to, on a slightly different topic, ask you about APIs. What role will network APIs play in the future security landscape?

Dr. Terje Jensen, Telenor (09:19):
I think as a network operator, we have a lot of information and also insight which is valuable for many partners. So we are very much supporting standardising APIs, the API gateways. And there is a lot of, as I said, information about location, identity and so forth, which can be used by others. So let me take a simple example of... I'm probably not into the question, but as some examples of the things we are doing. So we are sharing, for example, information about phone. So if someone is logging into a bank, for example, from a different country, the bank potentially could check with us, okay, is this phone roaming or is it home or is it... So they are kind of checking and so working together with banks on financial sectors with fraud is just one small example of what we are doing. So that's kind of the APIs.

(10:10):
And we're using APIs for location, for example. So we have a collaboration with delivery companies and then they are delivering food or delivering other things. So online shopping, as you know, are very popular these days and they are delivered to the door. And these delivery companies, they actually don't want to place the goods outside the door. They want to get in the entry door, meaning that unlocking the door, or it could be the garage or whatever, should be remotely controlled and they should be open, not too early before the delivery person is there and not too late either. So location and unlocking and making that connection between a remotely controlled door or garage gate or whatever and the location of delivery person is also very important. So that's just simple example, which is a kind of also in security space. So we are doing those kind of things.

(11:03):
Then we are doing, for example, the sharing information about roaming people or people roaming to a country. If you're running a tourist shop, you would actually very much like to understand the next bunch of people, where are they coming from? They will reorganise the shops depending on whether you come from England or you come from Germany or you come from France, Spain or whatever. So that's valuable for them. So there's a lot of information which is interesting for exposing, which then could be delivered through an API.

James Pearce, TelecomTV (11:37):
I think that's fascinating stuff. Thank you so much for joining us today on TelecomTV.

Dr. Terje Jensen, Telenor (11:41):
Thanks.