Bell Canada launches autonomous Security Operations Centre

Bell Canada announced the launch of its new autonomous Security Operations Centre (SOC) as part of the new Bell Cyber portfolio. 

Developed over more than two years of research and development, the autonomous SOC platform employs artificial intelligence and automation technologies for real-time threat containment. According to Bell CEO Mirko Bibic in his opening remarks, the platform enables detection and containment of cyber threats within five minutes. 

Bell Cyber, a new pillar focus of its parent company, Bell, comes after the July 2024 aquisition of Security-as-a-Service firm Stratejm.

The announcement, made at the inaugural Bell Cybersecurity Summit in Toronto, featured a demonstration from Talha Iqbal, Senior Director, Cyber Intelligence Centre and Jawed Ahmad, CTO, Bell Cyber.

Iqbal says when he started working in SOC over a decade ago, work involved manually coordinating incident response efforts and manually transferring data from one platform to the other. Now, he notes, cyber threats are not human, but AI. This means faster technology to keep up with the speed of cyber threats.

"Think of the autonomous SOC as having a team of AI-driven digital analysts. These [automated] analysts are working around the clock to respond to your threats. They respond to the alerts, they analyze the events, they correlate the data, and they build a containment strategy to take an action within minutes," said Iqbal. "[This] means a reduction in noise...and true scalability, which means we can protect large organizations. without adding additional head count."

The system will use AI agents to address repetitive slot tasks at machine speed while analysing log data. Additionally, it will correlate events from various platforms and leveraging the cybersecurity mesh architecture, they can take action to contain the threat. This will be accompanied by human analysts working as "trusted advisors" within the automated SOC operations.

In a video demonstration at Tuesday's summit, an AI agent performed a threat investigation and provided a threat report. A human agent was then able to launch further action, such as launch a remediation agent to block the threat's IP address, disable the user and isolate the system. It also demonstrated "LLMs as a judge" to autonomously ensure that the operations are running smoothly. Then, all data is then saved in a vector database for further reference and training.

Ahmed, says the automated SOC is live today, being used to help Bell related operations.

The cybersecurity model promoted by Bell Cyber is intended to help customers stay ahead of threats posed by increasingly sophisticated and persistent threat actors affecting a range of sectors in Canada. This move comes against the backdrop of rapidly evolving cybersecurity challenges, including geopolitical factors and new regulatory requirements.