Telecom Penetration Testing
Salt Typhoon went undetected inside a U.S. carrier for roughly three years. Nothing replaces skill against an adversary that patient.
Salt Typhoon Proved the Stakes
A Chinese state group breached at least nine U.S. carriers, AT&T, Verizon, T-Mobile among them, stole call records, and in one case went undetected for roughly three years. If the largest providers can be lived in that long, an untested network doesn’t stand a chance.
Raxis finds those paths first.
Where We Attack
Core Network
We probe routers, switches, firewalls, and management systems for the misconfigs and weak remote access that hand an attacker your core.
APIs & Customer Apps
Billing portals, self-service, and partner APIs tested for broken auth, data exposure, and injection.
VoIP & Unified Comms
SIP trunks and UC platforms tested for registration hijacking, toll fraud, eavesdropping, and denial of service.
OSS/BSS
Provisioning and billing systems checked for access-control gaps and insecure integrations that expose subscriber data.
Signaling
SS7, Diameter, and GTP paths tested for the tunneling and signaling abuse generic providers skip.
Why Carriers Choose Raxis
Telecom-Fluent Testers
Certified engineers (OSCP, GPEN, GWAPT) who know telecom protocols and architectures and test them by hand.
We Don’t Take You Offline
Testing runs within your operational limits, no hit to availability, call quality, or subscribers.
Built for Big Networks
AI accelerates discovery across large, multi-segment environments; humans validate and exploit what it surfaces.
Reports You Can Act On
Prioritized fixes, proof-of-concepts, and compliance mapping in Raxis One. No waiting for a PDF.
Retesting Included
After you fix, we retest. Remediated, not patched on paper.
Optional Continuous Coverage
Point-in-time testing leaves gaps. Raxis Attack delivers continuous penetration testing.
Pentest Evidence Your Regulators and Customers Expect
Networks Change Weekly. Test Like It.
Point-in-time testing leaves gaps between assessments. Raxis Attack PTaaS delivers continuous, on-demand penetration testing through Raxis One, so your posture keeps pace with new services and infrastructure changes, not just the annual audit.
FAQ: Telecom Penetration Testing
What is telecom penetration testing?
A hands-on simulated attack on carrier infrastructure: the core network, SS7, Diameter, and GTP signaling, VoIP and unified communications, OSS/BSS provisioning and billing, and customer-facing APIs and portals. The goal is to find the paths a state actor or fraudster would use before they do.
Can Raxis test SS7, Diameter, and 5G signaling?
Yes. Signaling and tunneling abuse across SS7, Diameter, and GTP is part of a Raxis telecom engagement, the layer generic penetration testing providers skip, and it is tested within limits agreed for live infrastructure.
Will testing affect call quality or subscribers?
No. Testing runs within your operational limits, with no impact on availability, call quality, or subscribers.
What compliance requirements does telecom penetration testing support?
Carriers' network-security obligations under CALEA and CPNI rules (47 CFR), CISA telecom-hardening guidance, and audit-ready evidence for ISO 27001, PCI DSS, SOC 2, and NIST SP 800-115.
How often should carriers perform penetration testing?
After significant network changes, new services, or infrastructure rollouts, and at least annually for audit evidence. Networks that change weekly use Raxis Attack for continuous, on-demand testing through Raxis One.
What certifications do Raxis penetration testers hold?
OSCP, GPEN, GWAPT, and more, listed on our certifications page.