A national carrier serving more than thirty million subscribers generates security telemetry at a scale where the traditional SOC equation — more alerts, more analysts — stops being an equation at all. By pairing Trace8's investigation-by-default architecture with CAELION's 24×7 pod oversight, the carrier reached round-the-clock investigation coverage without growing headcount, and changed what its board hears about security from alert counts to answers.
The organization
The client is a national telecommunications carrier with more than 30 million subscribers across mobile and fixed-line services. Its monitored estate reflects what carriers are: part critical national infrastructure, part enterprise IT, part sprawling customer platform. Network elements, subscriber-facing systems, billing and support platforms, corporate IT, and cloud workloads all feed a central security operations function — one whose failures would be measured in national headlines, regulatory attention, and subscriber trust.
The challenge
Carrier scale breaks SOC arithmetic. Alert volume tracks the size of the monitored estate, and a thirty-million-subscriber estate produces a queue no economically defensible analyst bench can investigate. The carrier's SOC was staffed with capable people running a mature detection program, but the volume forced the standard compromises: severity-based triage that investigated a fraction of the queue, suppression rules that traded visibility for tractability, and overnight shifts that were thinner than the threat landscape respects.
Leadership faced a scaling decision with no good conventional option. Growing an in-house 24×7 bench to match volume was a permanent, escalating cost in a market where senior analysts are scarce. Outsourcing to a traditional MSSP meant ticket-queue economics and verdicts the internal team would re-verify anyway. Meanwhile, board reporting reflected the compromise underneath: leadership received alert counts and closure statistics — measures of activity, not of coverage or speed, and silent on the question that matters: of everything that fired, what fraction did we actually understand?
The deployment
CAELION deployed Trace8 against the carrier's existing security stack, then wrapped it with the pod model — the combination designed for exactly this scale problem.
Trace8 took over investigation. Its Frame Agents work the full queue as alerts fire: the Triage agent investigates every alert end-to-end, the Hunt agent pursues the leads investigations expose, and the Evidence agent binds every conclusion to the queries and findings behind it. Critically for an estate of this sensitivity, no verdict stands on a single agent's judgment: the Challenge agent adversarially tests each proposed conclusion — attempting to break it against the evidence — before it is allowed to close an alert. What survives is not a plausible answer but a verified one, and every closure carries a case file a reviewer can interrogate.
Around the platform, CAELION's 24×7 pods — named senior engineers operating from the US and India — provide continuous human oversight. The pods review escalations, sample auto-closed case files for quality, tune the investigation pipeline against the carrier's environment, and own the handoff when a verified incident needs response. Follow-the-sun coverage means the overnight hours are watched by the same caliber of senior attention as the business day — without the carrier hiring a night shift.
The results
| Dimension | Before | After |
|---|---|---|
| Investigation coverage | Triage-limited fraction of the queue | 24×7, every alert investigated |
| SOC headcount | Baseline | Unchanged — no growth required |
| Verdict quality | Single-analyst judgment under time pressure | Adversarially verified, evidence-backed |
| Overnight coverage | Thin shifts | Follow-the-sun pod oversight |
| Board reporting | Alert counts and closure statistics | MTTI and coverage |
The carrier now operates with 24×7 investigation coverage across its full alert volume — and reached it without adding headcount, converting an open-ended staffing trajectory into a bounded platform-and-pod arrangement. Every verdict the system produces has survived adversarial verification, which is what allowed the internal team to stop re-checking machine conclusions and start supervising them.
The reporting change reached the board. Security leadership no longer presents alert counts — a number that grows with the estate and says nothing about safety. It reports MTTI and coverage: how fast the organization understands what fires, and what fraction of everything that fires gets understood. Those are the two numbers a board can actually govern with, and for the first time the carrier can state them with evidence behind each.
Why it worked
Three design choices carried the engagement. Investigation-by-default resolved the arithmetic that headcount never could: machines absorb volume, so coverage scales with the estate instead of with the bench. Adversarial verification made machine verdicts trustworthy enough to act on — in critical national infrastructure, an unverified auto-closure is a liability, and the Challenge agent is what converts throughput into confidence. And the pod model kept senior human judgment continuously in the loop without the cost curve of building a 24×7 bench — oversight as a service, not a shift schedule.
If your alert volume has outgrown every staffing model you can defend, CAELION can show you what Trace8 with pod oversight looks like against your own estate in a private briefing.
Client identity withheld by agreement. Figures anonymized and rounded from engagement reporting.