A cryptographic inventory built for the enterprise looks at a telecom network and sees almost nothing, because the cryptography that matters most in a mobile network does not live where enterprise tools look. Enterprise CBOM discovers TLS on web services, certificates in PKI, keys in cloud key stores, crypto in application code. A telecom operator certainly has all of that in its IT estate, but its network, the part that actually carries subscriber traffic, runs a different and largely invisible cryptographic world: mutual TLS between 5G network functions, the Security Edge Protection Proxy at the boundary between operators, Diameter and GTP on the signaling and user planes, SIP over TLS for voice, the NAS protocol between the device and the core, and the subscriber authentication that happens every time a phone attaches to the network. None of that is visible to a tool designed for enterprise IT.
Telco cryptography discovery is therefore a distinct problem, not a variant of the enterprise one, and it is best understood as a capability the CBOM category must grow into rather than one any enterprise-focused platform delivers off the shelf today. The protocols are specialized, the cryptographic material exists at subscriber scale, and the quantum exposure of long-lived subscriber secrets has a character enterprise risk models were not built for. This post is written for the telecom and communications-service-provider audience as a map of why their cryptography is a separate discovery challenge, what a post-quantum transition means for a mobile network, and why telco-protocol discovery is an emerging frontier the strongest platforms are moving to address rather than a shipped feature to assume.
PQC Migration Trajectory (CNSA 2.0 Timeline)
Projected algorithm distribution across enterprise infrastructure
⚠️ Organizations that haven't started inventory by 2026 will miss CNSA 2.0 network equipment deadline (2030) — migration typically takes 3-5 years.
The Crypto Enterprise Tools Do Not See
The gap starts with the protocols. A mobile network runs a protocol stack that has no analog in enterprise IT, and each layer of it carries cryptography that an enterprise scanner has no reason to understand.
| Telco Element | Cryptographic Role |
|---|---|
| 5G SBA mutual TLS | Network functions authenticate to each other with mTLS |
| SEPP | Security Edge Protection Proxy guards the inter-operator boundary |
| Diameter | Signaling-plane protocol, often secured with its own transport |
| GTP | User-plane tunneling between network nodes |
| SIP over TLS | Voice signaling protected by TLS |
| NAS | Non-access-stratum signaling between device and core |
| 5G-AKA and EAP-AKA’ | Subscriber authentication and key agreement |
| DTLS | Datagram TLS used in several network-plane contexts |
In the 5G Service-Based Architecture, the network functions that make up the core communicate over service interfaces secured with mutual TLS, which means the core is full of machine identities and certificates that an enterprise tool would never discover because it is not looking at the service mesh of a mobile core. At the edge between two operators sits the SEPP, which protects signaling as it crosses the boundary between networks, a cryptographic control point with no enterprise equivalent. Diameter carries signaling and GTP carries user traffic, each with its own security considerations. SIP over TLS protects voice. NAS secures the conversation between the handset and the core. And beneath all of it, subscriber authentication through 5G-AKA and EAP-AKA’ establishes keys for every device on the network.
The point of the catalog is that this is an entire cryptographic estate living on a plane, the network plane, that enterprise discovery does not reach. An operator who inventories only the IT side has inventoried a fraction of the cryptography the business actually depends on, and the larger fraction, the part that keeps subscribers connected and secure, is exactly the part a general-purpose CBOM tool is blind to.
Why Telco Crypto Is a Different Discovery Problem
It would be convenient if telco cryptography were just enterprise cryptography in a different building, but it is structurally different in ways that make discovery its own discipline. Four characteristics set it apart.
The first is the specialized protocols themselves. Discovering cryptography in Diameter, GTP, NAS, or the 5G service-based interfaces requires understanding those protocols, how they establish security, where keys and certificates live within them, what a weak configuration looks like in each. An enterprise tool that understands TLS and X.509 does not thereby understand the security of GTP or the key hierarchy of 5G-AKA, and the knowledge does not transfer for free. The second is the network-equipment plane: much of this cryptography lives in specialized network equipment and virtualized network functions rather than general-purpose servers, so even reaching it requires discovery that speaks to that equipment on its own terms.
The third characteristic is scale and the nature of the key material. A mobile network holds cryptographic material at subscriber scale, keys and secrets associated with every SIM and every device, which is a population orders of magnitude larger than the machine and human identities of a typical enterprise, and organized according to telecom-specific key hierarchies rather than enterprise PKI. The fourth is the one with the longest shadow: the quantum exposure of long-lived subscriber secrets. Subscriber authentication rests on secret key material that can remain valid for the lifetime of a SIM, which may be many years, and secrets that are both long-lived and foundational to authentication are precisely the kind of asset for which future quantum capability creates present-day concern. These four together, specialized protocols, a distinct equipment plane, subscriber-scale key material, and long-lived secrets, are why telco cryptography discovery cannot be treated as an enterprise feature with a telecom label, and why it is a capability the category has to deliberately grow into.
What Quantum Migration Means for a Mobile Network
For a communications-service provider, the post-quantum question is not the same question an enterprise asks, because the assets at stake and the timelines are different in kind. A mobile network’s cryptographic dependencies are deep, long-lived, and embedded in equipment and standards that evolve on their own schedule, which makes migration a longer and more structural undertaking than swapping certificates on web services.
The subscriber-authentication layer is the clearest example. The secrets underpinning 5G-AKA and EAP-AKA’ are provisioned into SIMs and network elements and are expected to last, and a transition that touches subscriber authentication reaches into the device population, the provisioning systems, and the standards themselves. The network functions of the 5G core, authenticating to one another with mutual TLS, carry the same quantum exposure as any other asymmetric cryptography, but at the scale and criticality of a national or multinational network. The inter-operator boundary guarded by the SEPP, the signaling protected across Diameter, the tunnels secured in GTP, each is a place where the cryptography will eventually need to move to quantum-resistant algorithms, and each depends on the pace of the telecom standards that define those protocols.
What this means in practice is that a mobile operator’s quantum migration begins with a discovery problem that enterprise tooling does not solve: you cannot plan the migration of cryptography you cannot see, and the cryptography that matters most lives in the network plane. The migration timeline is also governed by the evolution of telecom standards, so an operator’s planning has to track where those standards are going, not only where its own estate is today. The honest statement of the situation is that mapping telco cryptographic exposure for a quantum transition is an emerging capability, something the category is building toward as operators begin to ask for it, rather than a mature inventory function that exists for the asking.
An Emerging Capability, Framed Honestly
It would be easy, and wrong, to present telco-protocol discovery as a solved, shipped feature, and the credibility of any platform in this space depends on not doing that. The accurate framing is that telco cryptography discovery is a frontier the CBOM category must grow into, driven by the fact that operators have a large and largely invisible cryptographic estate and a genuine quantum-migration problem that general-purpose tools do not address. The strongest platforms recognize this as a direction worth moving toward, because the telecom cryptographic estate is real, important, and underserved, not because the capability is finished.
For a telecom or communications-service-provider buyer, the practical takeaway is to treat telco-specific cryptographic discovery as an area still maturing and to evaluate any claim about it with appropriate skepticism. The right questions are about which telco protocols a platform can actually reach, how it reaches the network-equipment plane, and how it reasons about subscriber-scale and long-lived key material, and the right expectation is a candid answer about present reach versus intended direction rather than a blanket assertion of coverage. A vendor that is honest about the frontier is more trustworthy than one that claims the whole telco estate is already in view, because the former understands the distinctness of the problem and the latter is describing the enterprise tool it actually has.
The reason to engage with this now, despite its emerging status, is that the quantum clock runs the same for telecom as for everyone else, and the long-lived subscriber secrets at the heart of mobile authentication are among the assets for which early planning matters most. Understanding that telco cryptography is a separate discovery problem, and that the capability to address it is still being built, is how a CSP sets realistic expectations and starts the conversation at the right level, treating the mapping of its network-plane cryptography as the emerging and important work it is.
FAQ
Q: Why can’t an enterprise CBOM tool discover telecom cryptography? Because the cryptography that matters in a mobile network lives on the network plane, not the IT plane. A telco runs 5G service-based-architecture mutual TLS, a SEPP at the inter-operator boundary, Diameter and GTP on the signaling and user planes, SIP over TLS, NAS between device and core, and subscriber authentication through 5G-AKA and EAP-AKA’. Enterprise tools understand TLS and X.509 on web services and do not understand these specialized protocols or the equipment they run on.
Q: What makes telco cryptography a distinct discovery problem? Four things: specialized protocols that require protocol-specific knowledge to discover, a network-equipment plane of specialized and virtualized functions rather than general-purpose servers, cryptographic material at subscriber scale organized by telecom key hierarchies rather than enterprise PKI, and long-lived subscriber secrets whose lifespan creates distinct quantum exposure. Together these mean telco discovery is its own discipline, not an enterprise feature relabeled for telecom.
Q: What does post-quantum migration mean for a mobile network? A deeper and more structural undertaking than swapping web-service certificates. Subscriber-authentication secrets provisioned into SIMs are long-lived and reach into the device population and provisioning systems; the 5G core’s mutual-TLS identities carry quantum exposure at national scale; and the SEPP, Diameter, and GTP layers all depend on telecom standards that evolve on their own schedule. Planning begins with a discovery problem enterprise tooling does not solve, and the timeline tracks the standards, not just the estate.
Q: Is telco-protocol cryptographic discovery a shipped capability? It is best framed as an emerging frontier the CBOM category must grow into, not a finished feature. The telecom cryptographic estate is real, important, and underserved, which makes it a direction the strongest platforms are moving toward. A credible vendor is candid about which telco protocols it can reach today versus where it intends to go, and that candor is more trustworthy than a blanket claim that the whole telco estate is already covered.
Q: Why should a CSP engage with this now if the capability is still maturing? Because the quantum clock runs the same for telecom as for everyone, and the long-lived subscriber secrets at the heart of mobile authentication are among the assets for which early planning matters most. Understanding that telco cryptography is a separate discovery problem, and that the capability to address it is still being built, lets a provider set realistic expectations and start the conversation at the right level about mapping its network-plane cryptography.
About QCecuring
QCecuring sees telco cryptography discovery, the 5G service-based-architecture mutual TLS, SEPP, Diameter, GTP, SIP over TLS, NAS, and the 5G-AKA and EAP-AKA’ subscriber authentication that enterprise tools miss, as an emerging frontier the CBOM category must grow into rather than a shipped feature. Mapping the network-plane cryptographic estate and the quantum exposure of long-lived subscriber secrets is an area QCecuring is advancing toward alongside communications-service providers, and the direction it sees cryptographic discovery heading for telecom rather than a present-tense claim of full coverage.
Talk to us about telco cryptographic discovery and quantum readiness
Tags: CBOM, Post-Quantum Cryptography, Telco Security, 5G, SEPP, Diameter, GTP, Subscriber Authentication, 5G-AKA, Network Security, Quantum Migration, Communications Service Providers