The useful way to understand Telesoft Technologies is to begin with a stubborn engineering question: what if the security system watched the network before it decided what was worth keeping? In a market full of dashboards fed by sampled summaries, the British company starts down at the wire. Its FlowProbe appliances turn live traffic into enriched records; CERNE adds intrusion detection and selective packet capture; TDAC stores and correlates the history; IntSOC applies machine learning and agentic investigation. The hardware, software and managed service come from the same shop in Dorset.
That stack is aimed at awkward customers, in the most complimentary sense. Governments, telecom operators, financial firms, energy companies and data centres run networks that are large, regulated or both. They cannot casually export sensitive telemetry to a third-party cloud. They also cannot assume that a sampled NetFlow record will preserve the one connection an investigator needs six months later. Telesoft sells them a way to keep the evidence local and inspect it at carrier speed.
A telecom company in cyber clothing
The old plumbing became the new advantage
Rob Downham founded the business in 1989 as Telesoft Design. Its original territory was telecom voice, media and signalling - the machinery that lets networks carry calls and interactive services reliably. The catalogue still bears that history. ARNE and vARNE handle interactive voice response; TDAPI supports signalling; OKEFORD is a media platform. In a recent deployment, Ericsson Australia integrated vARNE into its CRIMSON IVR for Optus, helping the carrier move prepaid recharge services off an ageing HP hardware platform.
This lineage matters because high-rate cyber monitoring is also a problem of timing, throughput and loss. Telesoft did not wander into security armed only with a classifier and a pitch deck. It already knew how to build appliances for carrier networks, write protocol software and manufacture specialised cards. Its cyber products reuse that competence: FPGAs capture and enrich traffic deterministically, GPUs run inference, and NVMe storage keeps the local evidence searchable.
One evidence plane, four jobs
The result is less a single product than a connected evidence plane. FlowProbe can export IPFIX or JSON into Telesoft's own systems, Kafka, Elastic or other collectors. It recognises tunnelled traffic such as GRE, GTP and MPLS, and extracts context from DNS, HTTP, SIP and encrypted handshakes. TDAC scales storage horizontally into what the company describes as hundreds of petabytes. IntSOC then combines anomaly models, reputation intelligence, behavioural analytics and investigation agents.
Two specialised lines reveal how far the underlying machinery can travel. Triton simulates devices and loads so cable operators can test virtualised CCAP and CMTS infrastructure at production scale before exposing subscribers to a shaky rollout. The fintech platform turns similar high-rate capture and FPGA processing toward trading networks. Its 2U design can be configured for 32 100Gbps or eight 400Gbps ports, with precision timing for microburst analysis, trade-cycle diagnosis, compliance and risk controls. These are not mass-market applications. They are places where a millisecond, a dropped packet or a badly timed capacity decision can become expensive quickly.
The most interesting part of Telesoft's AI pitch is the thing underneath it: a cleaner, less sampled record of what actually crossed the wire.YesPress analysis
What the buyer gets
A box, a data lake and fewer midnight alerts
IntSOC is the flagship expression of the strategy. In one 1U configuration, the FPGA handles capture, the GPU handles inference and local NVMe backs the data lake. Preloaded models look for beaconing, command-and-control patterns, unusual long flows, domain-generation algorithms, typosquatting, lateral movement and microbursts. Customers can also deploy their own models using PyTorch, TensorFlow and scikit-learn. For a defence organisation with classified training data or an industrial operator with peculiar protocols, that openness is more than developer friendliness. It avoids sending the data away and avoids waiting for the vendor's model roadmap.
Security teams can buy the technology, integrate it into an existing SOC, or use Telesoft's 24/7 UK managed detection and response service. The managed offer monitors on-premise, cloud and hybrid environments, hunts for anomalous behaviour and escalates by severity. Telesoft says the most urgent escalation window can be as short as 15 minutes. Its own advertised IntSOC results are striking: a 66 percent reduction in SOC cost and a 99.37 percent reduction in analyst time spent on repetitive triage per shift. Those numbers come from Telesoft's own SOC, not an independent comparative trial, so buyers should ask for workload definitions and test the result in a proof of concept.
Pricing is quote-based. There is no public sticker price to compare with a per-endpoint subscription. That is partly because the bill changes with link capacity, interface count, retention, integrations, support and managed service coverage. FlowProbe's architecture does offer a concrete cost lever: customers can license additional 100GbE interfaces without adding another server or chassis. Even so, a fair comparison must include rack space, power, storage, deployment engineering and people - not simply the software licence.
The moment the old approach cracks
What failed first was visibility
A Telesoft case study of a large British leisure company offers the clearest small-scale picture of the work. A security audit found that existing monitoring could not adequately cover a mixed environment spanning local systems, data centres and cloud infrastructure. It also exposed outdated configurations and traffic bound for servers in hostile countries and on the dark web. The first failure was not a dramatic breach appliance flashing red. It was the quieter assumption that the tools already installed could see enough.
Telesoft deployed flexible sensors across those environments and wrapped the technology in continuous managed detection and response. The public account does not disclose price, deployment time or quantified loss avoided. It does show what changed the customer's mind: the audit converted an abstract cyber risk into visible gaps, suspicious destinations and specific legacy remediation. That sequence is copyable. Map the evidence you receive, test it against the real topology, identify what disappears between tools, and only then automate investigation.
The encrypted-traffic work is another example. Rather than decrypt payloads, FlowProbe records characteristics of TLS, TCP and QUIC handshakes using the JA4 family of fingerprints. In Telesoft's scenario, a command-and-control operator rotated IP addresses and adjusted TLS details every 48 hours. The behavioural fingerprint persisted, allowing an analyst to search TDAC's history and reconstruct the affected endpoints. The trick is not magic attribution. It is recognising a tool by how it speaks before the encrypted conversation begins.
Where the company sits
Too substantial for the lightweight end of security
Telesoft overlaps several markets at once. Darktrace, Vectra AI, ExtraHop and Corelight are reference points in network detection and response. Gigamon, NETSCOUT and VIAVI occupy parts of the packet, observability and performance terrain. Elastic and open stacks can absorb and analyse telemetry. Managed security providers sell the analysts. Telesoft's distinction is the decision to own more of that chain, from UK-made capture hardware to detection software and the people watching the alerts.
The public customer picture is selective, as one would expect from a supplier to sensitive networks. GSMA's head of information and cyber security has endorsed the company, and the Ericsson-Optus IVR deployment is documented. Telesoft's website displays Iridium, Verizon, AT&T and EE in its partner strip, while the company says its equipment operates on six continents, carries more than 10Tbps of aggregate throughput and serves more than 30 organisations with multibillion-dollar revenue. The scale figures are the company's own. They still help define the intended room: this is infrastructure sold to institutions, not a browser extension sold by the seat.
That is attractive when the network is fast, the data must remain sovereign, or the customer wants one vendor accountable for the sensor and the investigation. The ATCO partnership in Saudi Arabia makes the logic explicit. The two companies opened a Cybersecurity Centre of Excellence for hands-on simulation, threat intelligence and local delivery, with the initiative accredited by Saudi Arabia's National Cybersecurity Authority. It is a route into regulated national infrastructure where a remote login and a monthly software invoice are not enough.
The fit
Carrier-scale links, critical infrastructure, long retention, local processing, encrypted-traffic analysis and teams that want to run proprietary models.
The friction
Small networks, minimal rack capacity, cloud-first buying, short evidence windows or teams without the engineering appetite to operate high-throughput appliances.
There are conditions where this approach is excessive. A small company protecting laptops and a few cloud applications may get more value from endpoint controls and a simpler managed service. Unsampled telemetry also creates a storage and governance obligation: collecting more evidence helps only if retention, access and deletion are designed properly. Bring-your-own-model freedom demands model testing and ownership. A local appliance avoids cloud dependence, but it must still be patched, powered and integrated.
The commercial model follows the machinery. Telesoft is privately held and discloses no venture rounds or valuation. It earns through appliances, capacity licences, software, integration and custom development, support, and managed monitoring. That mix can suit a buyer who prefers a capital asset and a controlled support relationship, but procurement needs discipline. Ask which features require recurring licences, whether storage expansion changes the support bill, who owns custom detection logic, how upgrades affect packet loss, and what happens when an appliance reaches capacity. A persuasive demo shows detections. A useful contract explains the unglamorous operating years after the demo.
For the right buyer, however, the transferable lesson is crisp. Start with the fidelity of the evidence. Keep capture separate from the whims of a router's sampling policy. Use open exports so one sensor can feed more than one workflow. Join network operations and security around the same flow record. Automate repetitive triage only after the record is complete enough to support the decision. And make a proof of concept reproduce the ugliest hour of the real network, not a tidy laboratory average.
There is a human continuity behind the technical one. Downham describes the company's philosophy as mutual respect, freedom to create and diversity. That sounds broad until it is paired with the catalogue: engineers are still maintaining telecom protocols while building data stores, FPGA pipelines and machine-learning workflows. The culture Telesoft advertises is therefore less about office theatre than permission to solve a customer's peculiar network problem. In this corner of infrastructure, peculiar is often where the contract begins.
Telesoft's evolution is not a clean pivot away from telecoms. It is an accumulation. Voice platforms led to protocol fluency; carrier work led to high-rate hardware; visibility led to security analytics; the SOC produced repetitive work worth automating. Thirty-seven years after the shed, the company is still selling a familiar engineering promise: the complicated machinery should work, at full speed, when somebody important needs an answer.