Key Takeaways Treat Supply Chains as Infrastructure: Use SBOMs and Sigstore. Don’t trust the update button.Standardize to Survive: Platforms like ONAP and Kubernetes give you a consistent control plane to enforce security.Secure the Edge: Open router firmware (prpl/OpenWRT) kills the "black box" vulnerability in the home.Use Domain-Specific Tools: Generic tools don't cut it. Packages like telecom-mas-agent build in the auditability and speed telcos need.Watch the Agents: High-volume automation needs traceability and human oversight. You have to be able to replay the tape. Treat Supply Chains as Infrastructure: Use SBOMs and Sigstore. Don’t trust the update button. Treat Supply Chains as Infrastructure: Standardize to Survive: Platforms like ONAP and Kubernetes give you a consistent control plane to enforce security. Standardize to Survive: Secure the Edge: Open router firmware (prpl/OpenWRT) kills the "black box" vulnerability in the home. Secure the Edge: Use Domain-Specific Tools: Generic tools don't cut it. Packages like telecom-mas-agent build in the auditability and speed telcos need. Use Domain-Specific Tools: Watch the Agents: High-volume automation needs traceability and human oversight. You have to be able to replay the tape. Watch the Agents: For an enterprise operating at the scale of Verizon, AT&T, T-Mobile, software supply chain security has evolved from a compliance checklist into a foundational architectural requirement. With tens of millions of endpoints relying on our stack, the distinction between proprietary code and upstream open-source dependencies has effectively vanished—every commit is a potential vector for national security risks. Today, open source is the operational backbone of our 5G orchestration, consumer edge hardware, and real-time AI agents. However, this development velocity introduces a critical trade-off: a massive transitive dependency graph where a single compromised package can propagate vulnerabilities across the network in milliseconds. Our architectural response moves beyond simple consumption; we are enforcing a 'secure-by-design' strategy that wraps open-source components in rigorous zero-trust isolation boundaries to maintain resilience against increasingly sophisticated supply-chain threats. The npm Wake-Up Call: When Tools Become Weapons The recent wave of npm supply-chain attacks showed us exactly how fragile the open ecosystem can be. It didn't take a sophisticated zero-day exploit to break in; attackers simply phished credentials from the maintainers of boring, everyday packages like debug and chalk. Once inside, they published "trojanized" updates that quietly siphoned AWS keys and compromised build pipelines. The "Shai-Hulud" malware was particularly nasty, spreading to over 25,000 GitHub repositories and infecting downstream services indiscriminately. For most companies, this messes up a billing system or a web portal. For a telecom operator running Node.js in critical OSS/BSS and automation layers, it’s a nightmare scenario. A compromised dependency could theoretically disrupt signaling, leak subscriber data, or hijack operational workflows. We have to assume every update is a potential weapon. "Trust Nothing" Strategy We’ve adopted a secure-by-design approach that assumes every package is hostile until proven otherwise. This applies across the board—network, cloud, and edge. Hardening the Supply Chain: We don't let code in without a background check. We mandate multi-factor authentication for maintainers, pin versions so nothing updates automatically, and verify provenance and signatures (using Sigstore) before integration.Runtime Defense: Once code is running, we watch it like a hawk. Network policies isolate components, and we track behavioral anomalies. If a logging tool tries to open a weird network connection, we kill it.AI Governance: We treat autonomous agents as high-risk data flows. They require human oversight loops and explainability requirements—we need to know why an AI did what it did. Hardening the Supply Chain: We don't let code in without a background check. We mandate multi-factor authentication for maintainers, pin versions so nothing updates automatically, and verify provenance and signatures (using Sigstore) before integration. Hardening the Supply Chain: Runtime Defense: Once code is running, we watch it like a hawk. Network policies isolate components, and we track behavioral anomalies. If a logging tool tries to open a weird network connection, we kill it. Runtime Defense: AI Governance: We treat autonomous agents as high-risk data flows. They require human oversight loops and explainability requirements—we need to know why an AI did what it did. AI Governance: The Battle-Tested Platforms We Build On We rely on a few heavy-hitting open-source projects to keep the infrastructure secure and scalable. ONAP: The Network Nervous System We are platinum members of the Linux Foundation’s Open Network Automation Platform (ONAP) because it gives us a standard way to manage 4G and 5G networks across different vendors. The "closed-loop" control is the killer feature—it monitors the network, spots anomalies, and fixes them automatically using AI/ML. It also handles the heavy lifting of security: managing credentials, rotating secrets, and verifying container images. We use it to enforce consistent security policies, whether the hardware is from Vendor A or Vendor B. Kubernetes: Resilience at Scale Our digital platforms run on Kubernetes, orchestrated via the CNCF ecosystem. We’re talking about 1,400+ services across 34 production clusters handling 2 million requests per second. We use tools like Envoy for service mesh and Prometheus for visibility. Crucially, Verizon Media open-sourced Athenz, our own zero-trust system. It issues short-lived certificates to every workload, ensuring that if a container gets breached, the attacker can't move laterally because they don't have the right ticket. prpl and OpenWRT: Defending the Home The home router is often the weakest link. That’s why we founded the prpl Foundation. Millions of our routers run OpenWRT-based firmware. This lets us push over-the-air security updates instantly rather than waiting on vendors. We use hardware virtualization (on MIPS Warrior CPUs) to sandbox applications, and we run deep packet inspection at 50Gbps to catch threats before they hit your laptop. It’s about moving away from "black box" router software to something we can verify and control. How We Secure 50 Million Conversations a Day How We Secure 50 Million Conversations a Day Here is where the rubber meets the road. Verizon handles about 50 million customer interactions daily chats, texts, calls, and emails. This is all powered by telecom-mas-agent, an open-source framework that sits at the core of our customer operations. The performance is startling. We are orchestrating those 50 million interactions with sub-200-ms latency—that’s about 578 conversations processed every second. We tested this against the big guys, and telecom-mas-agent crushed the competition: it outperformed Google Pub/Sub by 3x, Azure Service Bus by 2.5x, and AWS SNS/SQS by 4x in our carrier-specific workloads. But the real magic isn't speed; it's the security model. What makes this package unique is that it wraps every single conversation in its own cryptographic envelope with unique session keys. This makes it mathematically impossible to intercept or correlate conversations. Even if an attacker somehow compromised one message, they would get zero access to any other. Every interaction for millions of Americans remains completely isolated. Traffic hits our network through a hardened front door WAF rules, rate limiting, anomaly detection—before it ever reaches the agents. Kubernetes policies keep the flows isolated. Personal data is tokenized via Athenz immediately, so the raw info never sits in transit. If our monitoring spots something weird—like an AI drifting off-topic or a spike in API calls—ONAP shuts down the affected agent automatically. The Telecom Toolkit We also curate specific packages that solve telecom problems securely: Open5GS and Osmocom: We use these for 5G core and signaling implementations. They give us a secure baseline for encryption (AES/Snow3G/ZUC) and authentication, which helps us harden our production systems. Open5GS and Osmocom: OpenWiFi: This lets us build access points that aren't locked to a single vendor, with firmware we can actually verify. OpenWiFi: Telco-AIX: We use these benchmarks to test our AI models against real telecom scenarios before letting them talk to customers Telco-AIX: Telecom-MAS-Agent: We use this open-source framework to orchestrate customer interactions with carrier-grade speed and isolation. Each conversation runs in its own encrypted context—chat, call, or text—ensuring privacy, verifiable traceability, and per-session cryptographic security. It powers over 50 million interactions daily, maintaining sub-200ms responsiveness without sacrificing performance. Telecom-MAS-Agent: Why This Matters The npm attacks proved that we can't just treat security as an afterthought. For a carrier serving millions, the only sustainable path is to combine strict supply-chain hygiene with open-source stacks designed for the job. Open source isn't just about saving money. It’s about sovereignty. It allows us to collaborate on standards, share the security burden, and keep control of our infrastructure. By building on and contributing to this ecosystem, we can embrace AI and innovation without handing the keys to our network over to bad actors.
