T-Mobile has published Advancing Cybersecurity at T-Mobile, a report detailing changes to its cybersecurity program, the company's response to evolving threats and its plans to address emerging security challenges.

The report describes a broad modernization effort that included changes to employee authentication, network access, threat detection and incident response. According to T-Mobile, the initiatives were implemented while maintaining wireless service and normal retail operations.

The company cited increasing activity from nation-state actors and financially motivated cybercriminals as key drivers behind the changes. Over a recent 12-month period, T-Mobile reported a 37% increase in attempted intrusions, while credential-based attempts declined 35%.

The report also addresses consumer-facing threats. T-Mobile said it continues to identify hundreds of millions of scam and spam calls weekly and recorded nearly 50% more scam and spam messages in 2025 than in 2024.

Key Cybersecurity Developments

Among the initiatives detailed in the report are improvements to workforce authentication and customer account security.

T-Mobile reported a reduction of more than 99% in phishing-related credential compromises among employees. The company has replaced passwords with phishing-resistant FIDO2 hardware security keys and implemented identity verification using selfies and government-issued identification before issuing credentials. According to the report, nearly 100% of its workforce is now operating without passwords.

The company also reported a reduction of more than 99% in successful SIM swap attacks since 2022. Security measures supporting this effort include biometric identity verification, SIM Protection and Port-Out Protection.

Another major initiative involved deploying a hybrid zero-trust security architecture across its workforce in six months. The approach requires users, devices and applications to verify their access rather than relying on implicit trust. T-Mobile said the platform has blocked more than 6 million online threats since deployment.

Response to Telecommunications Cyber Threats

The report describes T-Mobile's response to the Salt Typhoon cyber campaign, which targeted U.S. telecommunications providers in late 2024.

According to the company, the threat actor accessed its network through a third-party wireline provider and impersonated a trusted router at the network edge. T-Mobile characterized the technique as previously unseen in its environment.

The company said its layered security controls contained the activity before the attackers accessed sensitive customer information, including calls, voicemails and text messages. T-Mobile also shared information about the incident with federal agencies and industry partners.

Network and Customer Protection Measures

T-Mobile's report highlights security investments in its 5G infrastructure, including its nationwide 5G standalone network. The company said security considerations were incorporated into the network's design, with 5G Advanced expected to introduce additional capabilities for protecting sensitive information and reducing potential attack surfaces.

The company also detailed its network-level protections for consumer customers. T-Mobile said all customers receive core network-level security protections covering calls, text messages and web browsing.

Since March 2017, its Scam ID and Scam Block services have helped protect customers from more than 160 billion unwanted calls, according to the report. In 2025, the company said it blocked nearly 3 billion scam and spam text messages before they reached customers.

Security Operations and Workforce Training

T-Mobile also outlined changes to its security operations, including the establishment of a Cyber Defense Center that consolidates monitoring, threat hunting, digital forensics and incident response functions.

The company said it has expanded the use of AI-driven threat detection to help identify and respond to threats in real time. Employee education remains another component of the program, with T-Mobile reporting more than 200,000 cybersecurity training completions in 2025.

The report also highlights the company's Bug Bounty program, which has received more than 1,400 valid submissions from members of the global security community.

In addition to internal initiatives, T-Mobile identified partnerships with the Cybersecurity and Infrastructure Security Agency (CISA), the Communications Information Sharing and Analysis Center (C2 ISAC) and the CTIA 5G Security Test Bed as components of its broader industry collaboration efforts.

Cybersecurity Services for Business Customers

The report also addresses security offerings for business and enterprise customers. These include Risk-Based Vulnerability Management, Patch Management, secure access service edge (SASE) with zero-trust access, secure SIM authentication and mobile threat defense solutions.

The services are intended to help organizations assess vulnerabilities, manage access and protect employees and devices operating across distributed work environments.

Jason Leigh, Senior Research Manager at IDC, noted the level of detail provided in the report, observing that many companies disclose limited information about specific cybersecurity practices.

Preparing for Emerging Threats

Looking ahead, T-Mobile identified AI-enabled fraud, non-human identities such as AI agents and bots, and quantum computing as areas requiring continued attention.

The company said it is conducting adversarial testing of AI systems and operating a honeypot program to study attacker techniques. These efforts are intended to help security teams better understand and prepare for evolving attack methods.

Mark Clancy, T-Mobile's Senior Vice President and Information Security Officer, emphasized the importance of continued collaboration and adaptation in a message to employees accompanying the report.

The company said its cybersecurity strategy will continue to evolve as threats change, with an emphasis on integrating security into network operations, technology development and business processes.

The report provides an overview of the company's reported security initiatives and performance measures. The findings also reflect broader challenges facing telecommunications providers as they work to protect increasingly complex networks, customer information and connected services against evolving cyber threats.

Source: T-Mobile

Stay Connected with ISE Magazine 

Subscribe to our newsletters and magazine for the latest telecom insights, explore the current issue for in-depth features and strategies, and register for upcoming webinars to learn directly from industry leaders.