Autonomous security: Towards self-protection capabilities in autonomous networks
- Networks are transitioning from manual security management towards autonomously managed security.
- This shift addresses two dimensions of security: securing autonomous networks and embedding autonomous security in networks.
Experienced Researcher, Network security
Researcher Concepts Security
Master Researcher, Security of cloud, SDN, and NFV
Experienced Researcher, Network security
Researcher Concepts Security
Master Researcher, Security of cloud, SDN, and NFV
Experienced Researcher, Network security
Researcher Concepts Security
Master Researcher, Security of cloud, SDN, and NFV
Telecommunication networks have long operated behind the scenes as invisible yet critical infrastructure. Today, these networks carry not only human-to-human communication, but also support factory production lines, health systems, transportation systems, and other mission critical societal functions. Intensive care units, robots on production lines, and urban traffic light systems all depend on the same communication infrastructure.
As mobile networks grow more distributed, dynamic, virtualized, and service-oriented, autonomy is now essential to meet requirements for scale, mobility, and service assurance. Yet that same growth and autonomy expand the attack surface and accelerate the propagation of faults and threats across domains. As threats evolve faster and become more variable and less predictable than ever before, security cannot be left as an afterthought. Instead, security must evolve together with network autonomy and adapt to the same operational characteristics in terms of the speed, scale, and dynamicity that define autonomous networks.
This blog post discusses the vision behind autonomous networks and examines its security implications both in terms of protecting autonomous network operations and enabling security through autonomy.
The vision: Autonomous networks
The sheer scale and dynamicity of modern telecom infrastructure, including user mobility, fluctuating traffic loads, and spontaneous events like emergencies, make traditional manual network management increasingly infeasible.
The ultimate goal is to reach the vision of an autonomous network, an essentially self-driving network, which deploys, configures, maintains, and retires itself independently, with humans shifting from hands-on operators to supervisors who define high-level goals and requirements.
Autonomous networks bring three key advantages to network operators, as mentioned in the earlier blog post How zero can we touch?. First, network operating costs can be reduced by eliminating tedious manual tasks. Second, service assurance can be offered, meaning that network operators can generate additional revenue for already existing services. Third, new services can be offered, tailored to the customer’s requirements, with fast time-to-market, enabling new revenue streams. Technologies such as intent-based management and network digital twins are key enablers of this vision.
The transformation to a fully autonomous network does not happen overnight. Network management progresses through different degrees of autonomy, and network operators are at different maturity levels in the journey. The industry-wide consensus is to assess the level of autonomous behavior of an operator network by using autonomous network levels: A network’s autonomy is defined on a scale ranging from 0 (manual management) to 5 (fully autonomous networks). Many operators aim to progress towards level 4 autonomy in selected processes by 2030, a state of a highly autonomous network characterized by cognitive self-adaptation, decision-making based on predictive analysis, closed-loop management, AI modelling and continuous learning.
While the evolution towards autonomous networks brings operational and business benefits, it also fundamentally changes the requirements and expectations of network security.
Two key security aspects
Security should be examined from two complementary yet distinct perspectives, each addressing a different aspect of how autonomy changes security management and requirements of autonomous mobile networks.
The first aspect is the security of autonomous networks, which encompasses the protection of the mechanisms that enable autonomy as well as the baseline protection of the network as an asset. This perspective is about safeguarding the autonomous control loops, data, models, and orchestration, namely the “brain of the system”, to ensure that autonomy cannot be manipulated, subverted, or degraded.
The second aspect, autonomous security, focuses on how security decisions and operations themselves become autonomous within the network. It is a shift in security decision-making and execution, in which the network increasingly takes responsibility for perceiving security-relevant conditions, reasoning about risks, and enforcing protective actions within predefined goals and constraints, with human oversight when required.
Both perspectives are essential for achieving sustainable and resilient autonomous networks and are examined separately in the following sections.
Security of autonomous networks
As autonomy increases, networks increasingly depend on AI-driven decision logic, closed-loop control, and intent-based management. These autonomous decision-making mechanisms are the most critical components of the network. If they are misdirected, manipulated, or compromised, the network can make erroneous or harmful decisions at machine speed, potentially turning its own autonomous capabilities against the services it is meant to protect. At the same time, the network itself remains a critical asset that must continue to be protected using established security principles.
Security for autonomous networks therefore encompasses both baseline network protection and the protection of the mechanisms that enable autonomous operation.
Figure 1: A conceptual model illustrating the relationship between security automation efficiency and the risks introduced by AI-driven decision-making in autonomous networks.
Protecting the autonomous decision‑making
In autonomous networks, AI-driven mechanisms are responsible for analysis, decision-making, and closed-loop control, making them critical components. Protecting and ensuring the reliability of autonomous decision-making is foundational. Protection must span the full lifecycle and address three high-level themes.
Pre-deployment trust
The integrity of AI needs to be protected before deployment by securing the data and machine learning (ML) development pipeline, ensuring model provenance, a verified record of a model's origin, training data, and transformations. The objective is to prevent compromised, poisoned, or tampered models from entering the autonomous network control layer.
Runtime protection and resilience
Once deployed, AI models and decision-making mechanisms must operate in trusted, tamper-resistant environments. Confidential computing can ensure hardware-enforced isolation that protects data and code during processing. Remote attestation can provide cryptographic proof that software is running as expected. Zero-trust controls enforce an architecture in which no component is implicitly trusted and every action is verified. Together, these measures help verify integrity and increase confidence that models have not been tampered with.
Equally important is protecting AI systems from adversarial attacks such as evasion, backdoors, and model extraction through robust training methods, input validation, and anomaly detection. The closed-loop control processes themselves must also be secured, policies should be validated and their impact assessed before enforcement, with human override available to prevent cascading failures. These measures are necessary to prevent cascading failures and ensure that the decisions made by autonomous systems are controlled and auditable.
Accountability and transparency
Autonomous networks must maintain immutable audit logs, provide explainable AI decisions, support compliance verification, and enforce separation of duties. These mechanisms can ensure that every automated action is then traceable and auditable.
Building confidence in the cognitive core requires explainability, validation, and governance
Trust in autonomous networks ultimately depends on the ability to understand, validate, and govern the autonomous decision-making layer, including the cognitive core, intent handling, models, and control loops. Explainable AI techniques play a key role in providing insight into autonomous decision-making, enabling network operators to assess whether decisions align with policies, intent, and operational expectations.
In addition, validation mechanisms such as network digital twins can evaluate the potential impact of planned actions before deployment. This is especially important for security, where a planned remediation might disrupt service availability. Digital twins allow operators to test whether proposed controls effectively mitigate threats and to assess resource impact before enforcement. Moreover, digital twins can continuously identify attack preconditions or increased exposure caused by state changes, whether those changes are related to configuration, traffic patterns, or security state.
Autonomous security: Protecting networks
Why traditional security management no longer scales
The rapid expansion of mobile network services introduces a complex threat landscape. Each new service or technology is accompanied by its own set of threats, which can be leveraged to achieve multistage attacks to ensure stealthiness and high impact. The threats do not only concern the infrastructure, but also the telecom stack, for example, radio protocols and non-terrestrial networks, the AI/ML models and pipelines, and the interconnections with legacy systems.
In such an environment, network behavior and threats can evolve at machine speed, while security decision‑making is often still dependent on human‑speed workflows.
A security operations center may take minutes or hours to detect a threat, analyze it, and respond. This gap between threat speed and response speed requires security that operates both by design and continuously during runtime. Mobile networks must be able to identify, protect, detect, respond to, and recover from threats, while supporting service availability and resilience. However, the intersection of technologies and the security capabilities needed to protect them creates a tangled control landscape, making it difficult to plan, configure, and scale security efficiently.
Figure 2: The tangled relationship between network technologies and security controls illustrates why manual security management cannot keep pace with autonomous network operations.
From reactive defense to cognitive security loops
Security in autonomous networks should not be a passive, external safeguard, but an integral part of the network’s own decision-making.
This represents a fundamental shift from reactive, event driven security toward continuous, cognitive security management. Traditional practices are triggered after an incident is detected and rely on human driven interpretation and response. In contrast, autonomous security relies on closed loop processes that continuously sense the environment, reason about risk, and adapt security behavior in near real time.
The closed automation loop follows the Monitor–Analyze–Plan–Execute (MAPE‑K) reference architecture, enabling continuous sensing, reasoning, planning, and actuation of security decisions. Each phase of the loop can be handled by specialized agents for sensing, analysis, proposal, and actuation with human oversight built in at every stage. Agents are expected to explain their decisions, ensuring that the loop remains transparent and open to operator intervention when needed. Figure 3 illustrates how this cognitive loop is operationalized for security operations by mapping the MAPE-K phases to concrete security functions.
Figure 3: Adopting cognitive loops for security
- Measurement: collecting telemetry and security signals.
- Assurance: assessing posture and detecting deviations from intent.
- Proposal: recommending candidate controls and solutions.
- Evaluation: validating impact, risk, and policy compliance before execution.
- Actuation: enforcing the selected action and updating the security state.
Risk and cost aware autonomous decisions
Security controls in autonomous networks inevitably carry cost, both in business terms such as operating expenses and compliance burden, and in technical terms like latency and resource consumption. Treating security as a static, all-or-nothing domain is unsustainable. Instead, understanding the impact of security controls on cost is crucial.
Predicting the impact allows a clear risk-based decision-making where accepted risk and accepted cost meet at a suitable intersection, ensuring the use of an optimal security solution given the available resources, as illustrated in Figure 4. Different enterprise services carried over mobile networks have different traffic characteristics and requirements. There is no single security solution that fits all: Security capabilities and their configurations must adapt to each set of constraints.
Figure 4: Autonomous security enables risk-based decision making by balancing the cost of security controls against the risk of potential threats, finding an optimal operating point for each scenario.
Autonomous security enablers: Observability and intent management
A key prerequisite for autonomous security is the ability to continuously observe and quantify the security state of the network.
Expanding traditional logging and monitoring with quantitative security observability enables the network to determine whether security goals are being fulfilled or whether deviations are occurring at any given point in time. The ability to objectively and automatically calculate different security metrics provides continuously updated insights into the security posture of a system and creates the opportunity to track any degradation of security health and understand potential weaknesses.
Quantified security observability enables goal‑based security management, where security objectives can be expressed as intents rather than static configurations. Using intent‑based management, security controls can be planned, configured, and adapted dynamically to continuously satisfy high‑level security goals during both integration and runtime. This reduces operational complexity while allowing security behavior to evolve in response to changing network conditions.
Similar to a broader autonomous network vision, autonomous security is expected to evolve incrementally. Early stages focus on observability, automation, and decision support, while more advanced stages introduce autonomous reasoning, closed-loop remediation, and policy-driven adaptation. However, unlike autonomous networks, there is currently no broadly adopted industry framework defining maturity levels for autonomous security.
Our goal and future call
The telecom industry is currently at a juncture as it transitions from static, rule-based automation to dynamic, adaptive AI-powered autonomy, which also fundamentally transforms the security mindset. While fully autonomous security remains a longer-term vision, the near- and mid-term focus is controlled autonomy; security capabilities that can sense, reason, recommend, and in selected cases act within predefined policies, risk thresholds, and human oversight models.
In practice, the industry goal is not to remove humans from the loop entirely but to combine machine-driven decision-making with human governance, freeing human intelligence from operational burdens so it can focus on strategic oversight. The measure of success for this transition will not be operational speed alone, but the sustainability of the network's security posture and its resilience as critical infrastructure.
The zero-touch vision implies having a proactive security posture such as detecting an anomaly even if it is an undefined threat and isolating it without waiting for human approval. However, current industry efforts are focused on controlled autonomy, where autonomous security capabilities operate within predefined guardrails and under human oversight. As security operations become increasingly autonomous, protecting the mechanisms that enable that autonomy becomes just as important. If the autonomous decision-making layer is compromised, autonomous capabilities could amplify the impact of an attack rather than contain it. For these reasons, the integrity and security of autonomous network enablers must also be taken into account when assessing the risk related to adoption of the zero-touch vision.
Success will be determined by verifiable confidence, auditability, resilience, and governed autonomy. In autonomous networks, trust should not be implicit; it must be continuously verified through explainability, validation, auditability, and human oversight. Building that trust requires advancing autonomy and security together, not as separate workstreams.
Acknowledgement: The authors would like to thank Leyli Karaçay and András Zahemszky for contributing to this blog post, and Eva Fogelström for valuable review and feedback.