By Martin Ekpeke
As the telecommunications sector shifts from rapid development to broad implementation in 2026, the landscape of digital threats is becoming increasingly complex. According to the latest Kaspersky Security Bulletin, nearly 13% of telecom users encountered web threats last year, while almost 10% of telecom organizations worldwide were hit by ransomware.
To combat these evolving risks, ranging from Advanced Persistent Threats (APTs) to the complications of AI automation, experts have outlined a strategic “four-legged” framework to bolster industry resilience.
- Continuous Intelligence and Human Awareness
The first leg of a resilient defense is the ability to see threats before they strike, which is why experts emphasize the need to track the APT landscape and telecom-specific infrastructure without interruption. To achieve this, organizations should utilize tools like the Kaspersky Threat Intelligence Portal to monitor actor campaigns and identify emerging patterns. However, this intelligence must be paired with regular security awareness training to address the human element of cybersecurity. Such training ensures that employees, who serve as the first line of defense, can recognize suspicious activity and apply security policies consistently to prevent stealthy espionage.
- Managed AI and Automation Rollouts
While AI-driven network automation offers efficiency, it also introduces the risk of confidently wrong changes at scale if noisy or manipulated data feeds the system. To mitigate this, the recommended strategy is to treat AI implementation as a comprehensive change-management programme rather than a simple technical upgrade. Essential controls include maintaining a human override for high-impact actions and rolling out automation in stages. This phased approach allows for clear rollback paths and the continuous validation of the data influencing the network’s “brain.”
- Capacity-Based DDoS Readiness
Distributed Denial of Service (DDoS) attacks remain a primary threat to network availability, leading experts in 2026 to suggest viewing these attacks not just as security breaches but as fundamental capacity-management problems. The core strategy involves validating upstream mitigation and protecting edge routing to ensure the network remains resilient against sudden traffic surges. To gain a proactive edge, organizations should use threat intelligence to identify botnet infrastructure early, allowing them to spot congestion signals before they impact the end-user experience.
- Advanced Endpoint Detection and Response (EDR)
The final leg of the stool is the deployment of robust EDR capabilities, such as Kaspersky Next EDR Expert, to counter the rising threat of supply-chain vulnerabilities. Since telecom ecosystems rely on a vast web of vendors and contractors, these supply chains have become frequent entry points for attackers. The primary strategy involves implementing EDR to detect advanced threats at the earliest possible stage. In terms of response, these tools support rapid investigation and enable effective incident containment, ensuring that if a breach occurs, it is remediated before it can spread through privileged network positions.
The Road Ahead: 2026 and Beyond
According to Leonid Bezvershenko, Senior Security Researcher at Kaspersky, the industry is at a crossroads where traditional threats like supply-chain attacks intersect with new operational risks from 5G-to-satellite integration (NTN) and post-quantum cryptography transitions.
“Telecom operators need visibility across both dimensions: maintaining strong defenses against known threats while building security into these new technologies from day one. The key is continuous threat intelligence that spans from endpoint to edge to orbit,” Bezvershenko noted. “
By adopting this four-legged approach, operators can move beyond reactive security and build a foundation capable of supporting the next generation of global connectivity.