Telecom security regulations expose the limits of legacy identity tools

At a glance

What this is: This is a telecom governance analysis showing that modern regulation demands broader identity visibility than legacy IGA and PAM deployments typically provide.

Why it matters: It matters because telecom IAM, PAM and IGA teams must prove control over network, cloud and third-party access paths that traditional tools often do not see.

By the numbers:

• Traditional Identity Governance and Administration tools typically see only 20-30% of actual access due to limited connectors.
• The UK Telecommunications Security Act passed in November 2021, with enforcement beginning in October 2022.

Context

Telecom identity governance is the discipline of making sure every privileged account, access path and supplier credential is visible, reviewed and controlled across network, cloud and legacy environments. In this article, the core governance gap is not policy intent but incomplete inventory, because regulators now expect evidence across systems that traditional IAM tools were never designed to cover.

The source article argues that telecom operators face converging mandates in the UK, EU, Australia and Singapore. Those mandates push access governance beyond directory-based controls and into full estate discovery, continuous monitoring and third-party oversight.

The important point for practitioners is that compliance pressure is now exposing coverage blind spots that were tolerable in older IAM programmes but are no longer defensible when network oversight functions and supplier access are in scope.

Key questions

Q: Where do telecom identity controls fail when the estate includes legacy systems and supplier access?

A: They fail when review and monitoring programmes depend on incomplete inventories. If a control cannot see local accounts, service credentials, indirect escalation paths or vendor access, it cannot certify or revoke them reliably. The practical test is not whether a tool exists, but whether it covers every privilege-bearing path regulators expect to be governed.

Q: Why does telecom regulation make incomplete identity visibility a compliance risk?

A: Because the regulations described in the article require evidence over all privileged access, not just the subset managed inside one directory or PAM workflow. When access exists outside discovery, organisations cannot demonstrate least privilege, temporary access or auditability. That turns blind spots into regulatory exposure, not merely operational debt.

Q: What do telecom teams get wrong about PAM coverage?

A: They often assume vaulting known admin accounts is enough, even when service accounts, local accounts and supplier credentials sit outside the workflow. That mistake leaves real privilege ungoverned and makes session logging only partially useful. Coverage has to start with discovery, then extend PAM to the accounts that actually carry risk.

Q: How should security teams validate third-party access claims?

A: They should require evidence that matches the claim, such as access logs, certification records, revocation proof, or audit artefacts. A vendor saying it enforces least privilege is not enough; teams need proof that the access model is actually in place and remains current throughout the relationship.

Technical breakdown

Why telecom identity discovery fails across legacy and cloud estates

Telecom environments combine routers, switches, firewalls, mainframes, cloud workloads, SaaS platforms and DevOps tooling, each with different identity models and connector maturity. Traditional IGA depends on known systems and predictable integrations, so it misses local accounts, embedded service credentials and unmanaged third-party access paths. In practice, the governance problem is not only that access exists outside the tool, but that the tooling is blind to whole classes of privilege that regulators still count as in scope.

Practical implication: build inventory coverage before relying on certification or monitoring outputs.

How telecom regulations redefine privileged access control

The telecom rules described in the article require privileged access to be temporary, ticket-based, logged and monitored, with no self-granting of administrative rights. That is a stronger model than simple PAM vaulting, because it ties privilege to purpose, auditability and ongoing justification. It also assumes organisations can identify all privileged paths first, including indirect escalation through group membership, trust relationships and service accounts.

Practical implication: validate whether your privileged access model can prove purpose, duration and revocation across non-directory accounts.

Why assumed compromise changes monitoring expectations

Assumed compromise is a control posture that treats some parts of the network as already exposed and demands continuous detection rather than periodic comfort checks. In telecom, that matters because security critical functions can be reached through many access layers and supplier pathways. Continuous monitoring becomes a governance requirement, not just a detection preference, because point-in-time reviews cannot prove that access stayed within policy between review cycles.

Practical implication: align monitoring and review evidence to continuous access change, not quarterly snapshots.

Threat narrative

Attacker objective: The attacker seeks durable access to telecom-critical functions and supplier pathways while staying outside the view of legacy governance tools.

1. Entry typically begins through overextended supplier, contractor or administrative access in a telecom environment with incomplete identity inventory.
2. Privilege escalation follows when standing access, unmanaged local accounts or indirect trust relationships give the attacker broader reach than governance teams realised existed.
3. Impact arrives when the adversary can reach security critical functions, alter network settings, or maintain covert access long enough to evade periodic review.
4. The attacker objective is sustained, low-visibility control over telecom-critical access paths that should have been constrained, monitored or revoked.

Breaches seen in the wild

• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Telecom identity governance has become a discovery problem before it is a control problem. The regulations cited in the article assume organisations can see every account, privilege path and third-party dependency that touches security critical functions. Traditional IGA and PAM programmes were designed for narrower estates, so the first failure is incomplete visibility rather than weak policy. The practitioner conclusion is simple: governance cannot certify what inventory cannot prove exists.

The telecom compliance burden now exposes a standing privilege assumption that no longer holds. Legacy PAM models often assume privileged access is a known set of accounts that can be vaulted and reviewed. Telecom environments include local accounts, embedded service credentials and supplier access that sit outside that model, so the control boundary is too small for the regulatory demand. Practitioners need to treat privilege scope as an estate-wide question, not a directory-only one.

Assumed compromise is becoming the right default for telecom access governance. The TSA language in the article reflects a shift from periodic attestation to continuous suspicion of critical functions and supplier pathways. That posture makes access review necessary but insufficient on its own, because reviews do not close the gap between review cycles. The implication is that telecom programmes must pair governance evidence with live identity intelligence.

Telecom regulations are turning supplier access into a first-class governance domain. The article makes clear that third-party access is no longer a peripheral procurement issue but part of the regulated identity perimeter. That widens the accountability model to include shared responsibility, audit powers and segregated management environments. The practitioner conclusion is that third-party identity visibility now belongs inside core IAM and PAM design, not beside it.

Identity control in telecom is now measured by coverage, not by tool count. The article repeatedly shows that organisations can own mature IGA or PAM products and still fail compliance because the tools do not cover enough of the estate. The governance signal is that regulators are judging whether the control plane sees everything material, not whether the stack looks complete. Practitioners should re-baseline programme maturity around discovered coverage and revocation reach.

From our research library:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Identity coverage is now the gating control for telecom compliance. The regulatory trend described in the article means governance teams have to stop treating discovery as an operational hygiene task and start treating it as the prerequisite for every access decision. When the estate spans legacy networks, cloud platforms and supplier accounts, incomplete visibility is the control failure that causes downstream review and PAM gaps.

Discovery gap: This is the term telecom IAM leaders should use for the difference between where identity controls are deployed and where access actually exists. In practice, the gap determines whether privileged access can be time-bounded, reviewed and revoked at all, and it is often widest in non-directory systems and third-party environments.

Assumed compromise is becoming the right operating model for telecom access governance. That means programmes should behave as if critical functions may already be under observation or manipulation, then verify whether their monitoring, logging and review cadence can detect drift fast enough to matter. The article's message is that periodic certification alone is too slow for a sector where access paths change constantly.

For practitioners

• Expand identity inventory beyond directory-connected assets Map accounts, privileges and authentication paths across network equipment, legacy platforms, cloud services and DevOps tools before refreshing review campaigns.
• Test privileged access against regulatory time bounds Check whether administrators can self-grant access, whether tickets prove purpose, and whether open tickets are updated with current justification.
• Validate supplier access visibility end to end Confirm that contractor and vendor accounts are discovered, segregated and monitored even when they do not pass through your PAM workflow.
• Rebuild access review scope around discovered accounts Use complete identity data to ensure certifications cover local accounts, service accounts and indirect escalation paths instead of only directory objects.

Key takeaways

• Telecom security regulation has moved access governance from a directory problem to an estate-wide discovery problem.
• The evidence in the article shows that legacy IGA and PAM tools often miss large parts of telecom access, especially outside standard connectors.
• Practitioners need a coverage-first model that can inventory, monitor and certify privileged access across network, cloud and supplier environments.

Key terms

• Discovery gap: The discovery gap is the time between when people start using an application and when governance systems first record it. In identity and SaaS management, that gap is what allows hidden spend, unreviewed access, and incomplete offboarding to accumulate before any control plane can act.
• Assumed Compromise: A governance posture that treats critical functions as potentially already exposed and designs monitoring accordingly. For telecom identity programmes, it shifts emphasis from periodic review to continuous detection, because access paths can change faster than manual certification cycles can confirm.
• Security critical functions: Systems or components whose compromise would materially affect operations, resilience, or trust in the service. Telecom regulations use this concept to draw a hard boundary around the identities, privileges, and suppliers that need stronger protection, tighter monitoring, and more complete audit evidence.
• Third-Party Access: Third-party access is access granted to vendors, contractors, or support partners who are not direct employees of the organisation. It is higher risk than internal access because accountability, device assurance, and access duration are harder to control, so it usually requires tighter time limits and stronger auditability.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.