One security programme across a complex telecom estate

The challenge

A major telecom company needed consistent security management across datacentres, cloud services, network infrastructure and software delivery. Its managed inventory exceeded 24,000 assets, with responsibility spread across many teams.

Separate programme inventories included 600K+ cloud resource records, 250K+ stored container images and 140+ onboarded web applications. These were distinct assessment scopes, each needing reliable ownership and follow-up.

What I did

I led security architecture, platform deployment and process design, connecting assessment technology with the teams responsible for remediation.

• Established coverage and ownership. I combined agents, scanners, cloud connectors and container sensors for a segmented environment. Axonius, asset-management and CyberArk integrations supplied ownership, context and controlled assessment access.
• Connected cloud and application security. AWS, Azure and Google Cloud fed a common Qualys view. Registry and workload scanning connected container findings to delivery teams; web application scanning was operational. API testing and broader pipeline checks were part of the security design.
• Built the operating process. I defined onboarding, prioritisation, reporting, risk acceptance and remediation verification. Resource tags routed findings to owners, while shared baselines addressed recurring cloud configuration problems.
• Implemented complementary controls. I deployed Abnormal AI for email protection and anti-spam, Cymulate for continuous threat exposure management (CTEM) and breach and attack simulation (BAS), and Exabeam for SIEM and security log management.

A QScanner pilot introduced a reporting-only pipeline gate. Wider integration and blocking gates remained staged rollout work.

The outcome

The company gained an operational vulnerability-management programme with connected cloud, container and application coverage, supported by email protection, exposure validation and security monitoring. Service owners had a shared inventory, repeatable assessments and a defined route to investigate, remediate and verify findings.

The value was in making exposure actionable across team boundaries, with clear responsibilities for both coverage gaps and remediation. Related approach: assigning ownership to findings.