Industries · Telecommunications
Banks, ministries and hospitals all wrote resilience plans that quietly depend on your network staying available and your subscriber identity staying trustworthy. Both assumptions are now under active attack — one through the transport layer, the other through a dealer counter. Zentara works on the second as seriously as the first, because that is where the money actually moves.
What we are defending
The SIM swap surface. Not a network vulnerability — a process one, spread across thousands of retail points with uneven training and a sales target.
Where fraud actually enters. Testing the core and ignoring the counter measures the half of the estate that was never the weak point.
SS7 and Diameter assume peer operators behave. Location disclosure and message interception through interconnect remain viable against operators who have not filtered.
Provisioning, billing and the customer service desk. A social engineer who reaches an agent with authority does not need a network exploit.
Service-based architecture moves the problem into APIs and shared infrastructure, where a slice boundary is a security boundary whether it was scoped as one or not.
Subsea landings, backhaul, unmanned huts and towers. Physical access at a remote site is a network compromise nobody is watching.
Instrument · Obligation · Operational outcome
Permenkomdigi 7/2026 introduced biometric registration precisely because NIK and Family Card numbers were being abused, and it has been fully binding since 19 July 2026. The exposure did not close with it: the tens of millions of numbers registered under the old standard are still active, and replacement is the path back to them.
Permenkomdigi 7/2026
Komdigi
Requires
Customer registration for mobile services with facial-biometric verification. Enacted 19 January 2026, mandatory for new numbers from 1 July, fully binding since 19 July 2026.
We do
Assess the installed base rather than the new-registration path — every number issued before July sits behind the old standard, and replacement is where that legacy is reachable.
What the operator ends up with
Channel-wide identity assurance assessment
Perpres 82/2022
Pelindungan IIV
Requires
Vital information infrastructure protection under BSSN coordination, with an organisational cyber incident response team required of designated operators.
We do
CSIRT stand-up and exercise at the pace a carrier actually runs, plus the assessment establishing what within the estate is in scope.
What the operator ends up with
Operating CSIRT, scoped asset register
UU PDP
Republik Indonesia
Requires
Lawful processing and 72-hour breach notification, over subscriber holdings that rank among the largest personal data estates in the country.
We do
Governance across subscriber, network and retail data, and a notification runbook rehearsed against a realistic volume rather than a tabletop one.
What the operator ends up with
DPIA records, rehearsed runbook
PSE registration
Komdigi
Requires
Registration and associated obligations for electronic system providers, including the platforms and partners operating on your behalf.
We do
Partner and platform assessment, because obligations extend to services offered under your brand by somebody else's code.
What the operator ends up with
Partner assurance register
ISO 27001
Certifiable
Requires
Information security management system, routinely required in enterprise and government contracting.
We do
Implementation scoped to include network operations rather than only corporate IT, which is the common and unhelpful shortcut.
What the operator ends up with
Certifiable ISMS covering network operations
Identity · What it takes to become someone else
Almost every bank, wallet and government service in Indonesia treats possession of a mobile number as proof of identity. That makes number takeover the highest-leverage fraud available, and it is why Permenkomdigi 7/2026 moved to biometrics. Registration is now the strong link. Replacement is not: a number issued in 2019 against a NIK and a Family Card number is still active, and the counter that reissues it is where an attacker will go. The ladder below is the honest question — at your weakest channel, on your busiest day, what does someone actually have to present to walk out with another person's number?
Subscriber identity assurance
Knowledge
NIK and Family Card number. Both widely circulated, neither secret.
Document
Physical identity document sighted at a counter, verified by eye, under a sales target.
Multi-signal
Document plus account history the real subscriber would know, checked systematically.
Biometric
Face match at registration and again at replacement, with liveness — not only at first sale.
Continuous
Biometric plus velocity, device and behavioural signals, correlated across every channel including dealers.
Highlighted: where the replacement-SIM flow has to sit given what the number now unlocks.
Framing derived from Permenkomdigi 7/2026 and observed SIM swap methodology
Sector threat model
What this sector answers to
The regulatory landscape for telecommunications. Our own accreditations are listed on certifications.
Track record
Managed SOC and EDR operations for national carriers and fiber operators.
Where telecommunications meets banking
A SIM swap is a telco process failure and a banking loss, investigated by two organisations who each see half of it. Neither has the whole picture, and the attacker relies on exactly that. Zentara works on both sides of this line — the same team that assesses a bank's authentication assesses the channel that issues its second factor.
Before you have to justify us internally
So here is the answer to the questions your risk committee will ask, before they ask them.
Assessment covers the retail and dealer channel as a first-class attack surface, because that is where number takeover begins and it is routinely out of scope elsewhere.
Lawful intercept infrastructure is not something we supply, configure or advise on. Our work is defensive, and that boundary is written into scope.
Assessments are designed around synthetic and consented test identities. We do not ask for production subscriber records and will not accept them.
Interconnect and signalling testing runs through your change process, in your window, with rollback agreed before anything is sent.
SIM swap sits between two teams that report separately. A report that only one of them reads is a report that changes nothing.
Detection content, playbooks and runbooks are handed over and taught. A carrier the size of yours should not depend on us to run its own floor.
VAPT & Offensive Security
33 services in the catalog apply to Telecommunications — from point-in-time pentests to red team and continuous validation.
Black-box test of internet-facing assets, perimeter exposure, and exploitable services.
Assumed-breach lateral movement, AD abuse, sensitive data discovery from inside.
Kerberoasting, AS-REP, ACL abuse, BloodHound paths, hybrid identity review.
Rule base hygiene, ACL drift, hardening against CIS Benchmarks.
IKE/IPsec, SSL VPN, split tunneling, ZTNA migration readiness.
SPF/DKIM/DMARC, MTA-STS, DNSSEC, BIMI, phishing surface.
OWASP Top 10, business logic, authenticated/unauthenticated flows.
Manual review of critical flows + SAST tooling for OWASP/CWE coverage.
What we have written about it
Most security gaps aren’t sophisticated. They’re a dormant admin account, an unpatched server, a backup nobody has tested since it was configured. Each one is boring on its own, and each one is how attackers get in. A cybersecurity audit checklist gives you a repeatable way to find those
Most guides describe ransomware as software that locks your files until you pay. That description is a decade out of date, and believing it is exactly what gets businesses caught. Modern ransomware doesn’t just lock your data. It steals it first, then encrypts what’s left, then threatens
Most cyberattacks don’t start with code. They start with a conversation. An attacker doesn’t need to break your firewall if they can convince someone to open the door. That’s social engineering: manipulating people into handing over access, information, or money. It skips the techn
Start with a scored maturity baseline or go straight to a specialist conversation.