External estate discovery
Enumerating the full internet-facing surface across brands, regions and legacy programmes, then assessing what is found.
Industries · Telecom
Operator scale makes every small flaw a large one
A single authorisation flaw in a subscriber portal is not one exposed account. At operator scale it is a data set — and the same flaw in a provisioning API is an operational one.
AIPTx tests the digital estate: the portals, the APIs, the partner surfaces, and the domains nobody remembers registering.
01
Industry overview
Telecom operators run some of the largest and least uniform IT estates of any sector, and almost none of it was built as a single system.
There is a subscriber-facing tier — web portal, mobile app, self-service, retail point of sale — usually built at different times by different teams. Beneath it sits business support: billing, provisioning, order management, CRM. Beneath that, operational support systems touching the network itself. Alongside all of it, partner and wholesale interconnects, MVNO tenants running on shared infrastructure, roaming agreements, and content or bundling partnerships.
Then there is the accumulated estate: brands acquired and partly integrated, regional operations with their own domains, marketing campaign sites that outlived their campaigns, and infrastructure from technology generations that were superseded but never decommissioned. Two things make the security problem distinctive. Scale multiplies consequence — a flaw that exposes one record per request is a different event when there are fifty million records. And subscriber data is unusually rich: identity documents, payment details, location history, communication metadata, device identifiers.
02
Security challenges
- R01
Authorisation across many channels, one account
Web, app, retail, IVR and API all reach the same subscriber record through different paths, each with its own authentication and its own assumptions. The weakest path defines the security of the account.
- R02
Provisioning and BSS APIs carry operational power
These interfaces do not just read data; they change service state, transfer numbers, modify plans and issue credit. An authorisation failure here has operational consequences as well as data ones.
- R03
MVNO and wholesale tenancy
Shared infrastructure serving multiple brands or virtual operators is a multi-tenancy problem with the same isolation risk as SaaS, usually with older architecture underneath it.
- R04
Enormous, poorly-inventoried external surface
Regional domains, acquired brands, campaign sites, partner portals, technical subdomains. Operators routinely find that a meaningful share of their internet-facing estate is not in any inventory.
- R05
Number-based identifiers as a weakness
Subscriber identifiers are sequential or predictable by nature, which makes enumeration and object-level authorisation failures both easier to exploit and more damaging.
- R06
Partner interconnects
Trust extended to roaming partners, content providers and resellers, frequently over interfaces designed for a different era of threat.
03
How AIPTx helps
- Stage 1
Discovery at estate scale, ending in testing
See External Attack Surface ManagementReconnaissance enumerates subdomains, ports, services and endpoints, fingerprints versions and frameworks, and builds an inventory of what is genuinely reachable. Discovered ranges then receive network assessment (service and version detection, CVE matching, TLS posture, default credentials) and discovered web and API surfaces receive application testing.
For an operator, the first run is usually the most valuable thing on this page: it produces an honest picture of the external estate.
- Stage 2
Cross-account testing against subscriber records
Web Application SecurityConfigure multiple subscriber accounts and the agent attempts cross-access. Object-level authorisation failures (one subscriber reaching another's records, usage, billing or documents) are found by holding both sessions and comparing, which is the only way they surface.
Accounts are configured per role rather than per test, with bearer, basic, cookie, custom header and OAuth2/OIDC all supported and sessions re-established as they expire. In an operator estate the accounts worth comparing are rarely equivalent, and the interesting failures sit between the shapes: a prepaid line against a postpaid contract, a sub-line against the business account it hangs from.
- Stage 3
Provisioning and BSS APIs tested from the contract
REST via OpenAPI or Swagger, GraphQL with introspection, gRPC with proto files. Spec-driven testing covers every declared endpoint including the ones no channel calls, which in a BSS environment is a substantial proportion.
That includes deprecated versions still routed for a partner integration nobody switched off. A BSS estate accumulates those faster than most, because the contract is often the only place a retired provisioning call is still written down.
- Stage 4
Tenant separation for MVNO and wholesale
The same multi-account cross-access approach applies to brand and virtual operator separation on shared infrastructure.
- Stage 5
Internal assessment where it is authorised
The Docker-deployed agent covers internal IP ranges and CIDR blocks: port and service detection, version detection, CVE matching, TLS posture and default credentials, with SSH, MySQL and Redis specifics.
- Stage 6
Rate control that respects production
Request rate is configurable and destructive actions are off by default, necessary when the target serves live subscribers and any load event is a customer-visible one.
04Features & Solutions
Relevant features and solutions
Attack surface discovery
subdomain and asset enumeration, service and version fingerprinting, across estates too large to inventory manually.
Multi-account cross-access testing
subscriber to subscriber, brand to brand, tenant to tenant.
Access control coverage
IDOR, horizontal and vertical privilege escalation, 35+ active tests.
Full authentication support
bearer, basic, cookie, custom headers, OAuth2/OIDC, scripted login with token extraction.
Sensitive data and PII detection in responses, including identifiers, tokens and personal data.
Internal network assessment via Docker agent, outbound connectivity only.
Business logic testing
plan changes, credit application, entitlement logic, with race conditions in Deep mode.
Compliance evidence
control mapping for GDPR, ISO 27001, SOC 2, PCI DSS, NIST and CIS, with gap analysis.
AIPTx does not test telecom signalling or radio infrastructure. There is no support for SS7, Diameter, GTP, SIP or RAN protocol assessment, and no core network capability.
This page covers the IT and digital estate: subscriber-facing applications and APIs, business and operational support system interfaces reachable over HTTP, partner and wholesale portals, internal IT networks, and the external attack surface.
05
Benefits
- An honest external inventory
- The first discovery run typically finds assets the team did not know were reachable, which for an operator is where the unmaintained exposure concentrates.
- The multiplier gets tested
- One authorisation flaw across fifty million accounts is a different event from one flaw across five thousand. Cross-account testing addresses the class directly.
- Provisioning interfaces treated as high-value
- They are, and they are usually tested less than the customer portal.
- Brand and tenant separation verified
- Rather than assumed from the architecture.
- Coverage that scales with the estate, not with consultant days
- Which is what makes assessing an operator-sized surface financially realistic.
- Consistent methodology across regions and brands
- So results from one operating company are comparable with another.
06
Use cases
Subscriber portal assessment
Multi-account testing with cross-access attempted across records, usage, billing and stored documents.
Provisioning API review
Spec-driven assessment of interfaces that change service state, with authorisation tested per operation.
MVNO tenant isolation
Cross-tenant access attempted between virtual operators on shared infrastructure.
Partner interconnect assessment
Testing the surface exposed to a roaming, content or reseller partner before enabling or renewing a connection.
Post-acquisition integration
Mapping and assessing an acquired brand's estate before connecting it.
FAQs
Do you test the core network or signalling?
No. There is no SS7, Diameter, GTP, SIP or RAN capability and no core network assessment. AIPTx covers the IT and digital estate: subscriber applications, APIs, BSS and OSS interfaces reachable over HTTP, partner portals, internal IT networks and the external surface. Signalling security is a specialist discipline and we would rather scope honestly than claim adjacency.
Can you handle our external surface size?
Discovery enumerates subdomains, services and endpoints across the domains you provide, and assessment runs against what is found.
How do you test subscriber data isolation?
By configuring multiple subscriber accounts and attempting cross-access between them. Object-level authorisation failures only surface when a tool holds two identities at once and compares what each reaches.
Is it safe against live subscriber systems?
Destructive actions are off by default and the request rate is configurable, so testing does not become a load event. Scope is verified before anything runs and out-of-scope paths are respected. Most operators begin against pre-production and extend to production with limited scope.
Can you test our MVNO tenant separation?
Yes, using the same cross-account approach. Configure identities in separate tenants and the agent attempts to cross the boundary.
What about our OSS systems?
Those reachable over HTTP with an API can be assessed as APIs. Systems using proprietary or telecom-specific protocols are out of scope, as is anything touching the core network.
Start with what you have exposed
Give us your domains. We will map the estate, then test what matters: subscriber portals, provisioning APIs and partner surfaces.
Core network out of scope · Configurable request rate
Security testing for other sectors
Same engine, different threat model, different auditor. Each page covers the systems, regulations and attack paths that sector actually lives with.
Financial Services
Payment flows, lending decisions, account servicing, open banking APIs — the logic that handles money is the logic attackers study hardest. It is also the logic no signature database describes.
ExploreHealthcare
Patient portals, scheduling systems, clinical APIs, payer integrations: all of it holds data that carries a lifetime of consequence if it leaks, and much of it runs on systems that cannot be taken offline for a test.
ExploreGovernment
Benefits portals, licensing systems, tax filing, records access — services that must be open to everyone by design, running on estates that were often built decades apart and connected later.
ExploreManufacturing
Almost nobody breaks into a plant by attacking a controller. They arrive through a corporate account, a supplier portal, an ERP integration or an exposed remote access service, and then walk into a network that was designed for reliability, not for containment.
ExploreRetail
The vulnerabilities that cost retailers money are rarely exotic. A discount that stacks when it should not. A price accepted from the client. A gift card balance that survives a concurrent request. A loyalty account reachable from another customer's session.
ExploreSaaS
Every enterprise deal arrives with a questionnaire, a SOC 2 request and someone technical asking when you last tested. Meanwhile you ship on Tuesday and again on Thursday, and the last pentest describes a product that has since changed twice.
ExploreEducation
A department stood up a project site in 2019. A research group runs its own server. A faculty subdomain points at infrastructure that was decommissioned two years ago. None of it went through central IT, and all of it is reachable.
ExploreLegal
Clients do not retain a firm because of its document management system. They retain it on the assumption that what they share stays privileged — and increasingly they audit that assumption before instructing.
Explore