Ethio Telecom
SAI helps Ethio Telecom resolve the threefold security operation crisis
Client Introduction
Ethio Telecom is Ethiopia’s state-owned leading telecom and digital transformation provider. Rooted in 130 years of telecom history, it serves 83.2M subscribers with nationwide mobile, 4G and city-wide 5G. It operates telebirr mobile money, cloud, digital ID and enterprise services, posting FY2024/25 revenue of 162B Birr (~USD2.8B).
Pain Points
Ethio Telecom faces significant operational challenges categorized into four core areas: 1. Round-the-Clock Operations Rotating Shift Overhead: The team must maintain continuous 24/7 security operations through a demanding rotating shift schedule. Absence of Performance Metrics: There is no ticketing system in place to track, measure, or evaluate the performance of the operations team. 2. SIEM Data Management Crisis SIEM License Strain: Valuable SIEM licensing is consumed by redundant Palo Alto Networks (PANW) Next-Generation Firewall (NGFW) logs that offer no actual detection value. Inaccurate Alerting: The system generates wrong Kaspersky alerts triggered by loopback SIP traffic. Rigid Rulesets: The platform suffers from a distinct lack of customized SIEM rules tailored to the organization's specific threat landscape. 3. Skills Gap Reality Talent Shortage: The security team lacks sufficient members who are properly skilled in managing and executing SIEM operations. Platform Complexity: Security personnel are forced to operate across multiple disparate platforms, which demands a high level of expertise that the current team struggles to meet. 4. Manual Process Burden Inefficient Workflows: Day-to-day operations rely heavily on manual or mostly manual processes to achieve closed-loop incident management. Manual Reporting: Tracking and reporting core security metrics is highly burdensome due to a heavy reliance on manual data collection.
Products & Solutions
Deployed the security LLM-powered SAI agentic SOC solution, which natively integrates with existing SOC platforms and underlying security tools, delivering 24/7 fully automated security operation capabilities covering alert triage, full-chain incident investigation, forensics and response, with built-in multi-scenario security agents and knowledge base system.