AI Agents for Telecom Network Segmentation and Alert Tuning

Meridian Communications runs three networks that used to belong to three different companies. The fiber build-out from a 2016 ISP acquisition still routes through its original edge hardware. The rural LTE network absorbed in 2019 kept its own evolved packet core and billing stack running in parallel with Meridian's for two years past the planned cutover, then simply stayed that way because nobody wanted to own the migration risk. The VoIP reseller picked up in 2022 brought a flat /16 with zero internal segmentation, because redoing it during the transition would have cost six weeks nobody had. None of this shows up on an org chart. It shows up as 340-plus services talking to each other across trust boundaries that nobody has mapped since the last M&A lawyer left the building, and it shows up every year when the CPNI certification and the PCI scope review land on the same quarter and the network team spends twelve weeks reconstructing, by hand, which system can actually reach which.

Why a chatbot and an autocomplete tool both stall on carrier-scale segmentation

Ask ChatGPT or Claude.ai how to segment a telecom network ahead of a compliance audit, and you get a competent, generic answer: define trust zones, put billing behind its own VLAN, enforce mTLS between services, document the boundaries. None of it is wrong. All of it assumes a green-field network where one team designed everything. It says nothing about the RADIUS server the 2022 acquisition still authenticates against over plaintext SOAP, or the fact that your RAN monitoring stack has a route straight into the billing subnet because someone opened it for a one-time migration in 2020 and never closed it. A generalist chatbot cannot read your actual Istio config, your actual firewall rule set, or your actual SIEM rule base. It can describe a segmentation project in the abstract. It cannot audit the one you actually have, which is the entire problem when the network in question is a decade of stitched-together acquisitions rather than something built with a single architecture in mind.

Cursor and GitHub Copilot solve a narrower, adjacent problem well: they are fast at editing the Terraform module or the Envoy config once you already know what needs to change. But a carrier segmentation project does not start with an edit. It starts with reconnaissance across services that were never inventoried together, because they arrived through different deals at different times. Autocomplete tools complete the YAML you are already writing. They do not walk your service mesh and tell you which of your 340 services have no mTLS, which of your SIEM's 460 detection rules still reference a network topology that hasn't existed since the last acquisition closed, or which alert nobody has looked at since the consultant who wrote it left the company. That reconnaissance work is where a segmentation project actually lives, and it is exactly the layer both categories of tool skip.

Mesh, with Forge and Siem alongside it

Mesh is Tonone's service mesh specialist: Istio and Linkerd configuration, mTLS policy, traffic management, and the observability that goes with running a mesh at scale. For a telecom carrier with an acquisition history, Mesh's starting point is almost never design, it's audit. The mesh-recon skill walks the existing mesh (or the absence of one) and reports back on mTLS gaps, traffic policy issues, and observability holes, service by service, without assuming the network was built coherently in the first place.

Tonone's Mesh runs mesh-recon across a carrier's full service inventory, including systems that arrived through acquisition, to find mTLS gaps before a segmentation project starts, not after an auditor finds them.

Once the gaps are known, mesh-design produces the actual segmentation plan: technology selection between Istio and Linkerd for the workload in question, the mTLS policy that separates PCI-scoped billing traffic from everything else, and the traffic management rules that let a phased rollout happen without an outage. This is the step a chatbot cannot do credibly, because it requires the recon output as an input; you cannot design a segmentation boundary around trust relationships you have not yet inventoried. After the segmentation lands, mesh-observe sets up the distributed tracing and service-level dashboards that keep the new boundaries visible instead of drifting back into an unmapped mess over the following eighteen months, which is roughly the timeline on which the last three network changes at Meridian quietly lost their documentation.

Two Tonone agents work alongside Mesh on a project like this. Forge, the infrastructure engineer, handles the layer underneath the mesh: the forge-network skill designs the VPCs, subnets, DNS, and firewall rules that the acquired flat /16 needs before mTLS policy has any real network boundary to enforce against, because a service mesh policy sitting on top of a flat legacy subnet is a paper wall. Siem, the SIEM specialist, handles the detection layer that has to change in lockstep: once segmentation closes off traffic paths that used to be legitimate, every alert rule written against the old topology needs re-tuning or it either goes silent on real threats or floods the queue with noise from paths that no longer exist.

A service mesh mTLS policy sitting on top of a flat legacy subnet is a paper wall. Tonone's Forge rebuilds the network layer underneath so Mesh's segmentation has a real boundary to enforce.

A worked example: segmenting Meridian's network ahead of audit season

Meridian's network team has a CPNI certification due in ten weeks and a PCI DSS scope review from its card processor due six weeks after that, both requiring evidence of which systems can reach cardholder data and customer network information, and neither of which the team can currently produce without a spreadsheet-and-screenshot exercise that took twelve weeks the previous year. They start with mesh-recon across the full service inventory, all 340-plus services spanning the RAN, the evolved packet core, OSS/BSS, and billing.

Mesh Recon, Meridian Communications service mesh audit
Inventory: 14 network domains (RAN, core/EPC, OSS/BSS, billing, corp IT),
340 services, 3 inherited trust models (2016 fiber, 2019 LTE, 2022 VoIP).

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
mTLS coverage
  6 of 14 domains: zero mTLS, plaintext service-to-service traffic.
  Billing subnet (2022 VoIP acquisition): reachable from RAN monitoring
  tools via a route opened for a 2020 migration, never closed.
  22 services still authenticate to legacy VoIP billing over plaintext
  SOAP, credentials in query strings.

Traffic policy gaps
  No egress restriction between OSS/BSS and corp IT. A compromised
  corp laptop has a clear path to customer billing records today.
  Core/EPC domain has no ingress policy at all, flat trust with RAN.

Observability holes
  No distributed tracing across the 2019 LTE core, billing events
  there are invisible to the current dashboard stack.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Recommendation: phase mTLS rollout starting at PCI-scoped billing,
close the RAN-to-billing route in phase 1, before touching anything
in the core/EPC domain.
Next: Mesh drafts phased segmentation plan (mesh-design), Forge
rebuilds the flat /16 underneath the 2022 acquisition, Siem re-tunes
alert rules to match new traffic boundaries.

mesh-design turns that recon into a phased plan: phase one, roughly six weeks, puts mTLS around the PCI-scoped billing systems and closes the RAN-to-billing route entirely, which alone removes the single finding most likely to fail the PCI scope review outright. Phase two, roughly eight weeks, establishes the core-to-RAN boundary. A full mesh rollout across every remaining domain is scoped as a phase three that Meridian defers, because the audit deadline only requires the PCI and CPNI-relevant boundaries to be provably closed, not a complete architectural overhaul on a ten-week clock.

In parallel, Siem runs siem-recon against the existing detection stack: 460 rules, last meaningfully tuned in 2019 by a consultant who is no longer with the company, producing roughly 40,000 alerts a day with a true positive rate under 2 percent. Once Mesh's phase one closes the RAN-to-billing route, several rule families built around monitoring that exact plaintext path become either dead weight or, worse, silent about the boundary that matters now. siem-alert re-tunes the rule set against the new segmentation: alert volume drops from roughly 40,000 a day to under 900, and the rules that fire are now pointed at the boundaries the phased mesh rollout actually created, instead of a topology that stopped being accurate three acquisitions ago.

Tonone's Siem re-tunes a SIEM's alert rules against a network's actual current segmentation, not the topology it had before the last acquisition, cutting a 40,000-alert-a-day queue down to under 900 without losing coverage on the boundaries that matter.

The audit prep itself changes shape too. The mesh-recon and siem-recon outputs, kept current through mesh-observe's ongoing dashboards, become the living evidence base for both the CPNI certification and the PCI scope review. What took Meridian's team twelve weeks of manual spreadsheet reconstruction the previous year drops to roughly three weeks of verification and sign-off, because the question an auditor asks, which systems can reach which, already has a maintained answer instead of one assembled from memory and Visio diagrams nobody has updated since the 2022 close.

Mesh, Forge, and Siem vs the alternatives

None of this replaces the judgment call of which phase to fund first or how much rollout risk Meridian's network team is willing to carry into a live audit window. What Mesh, Forge, and Siem remove is the twelve weeks of manual reconstruction that used to precede that judgment call, the spreadsheet archaeology that stood in for an actual inventory of what talks to what. A carrier that has grown by acquisition does not get to start segmentation from a clean architecture. It gets to start from an honest map of the mess it actually has, and that map is the thing a generalist chatbot cannot produce and an autocomplete tool was never built to produce.

Install and try

Tonone is free and MIT-licensed. Install it once and all agents, including Mesh, Forge, and Siem, are available in your Claude Code session. You pay only for the Claude Code token usage during the work itself.