Many of the alerts we see in private cellular environments aren’t unique to mobile networks — they’re common across OT systems as well. Enterprises want to monitor anomalous traffic patterns, whether they occur in the data plane or within the cellular signaling layer. That said, there are several cellular-specific threats that customers frequently ask us to detect.

One example is IMEI spoofing, where a malicious device impersonates another legitimate one. OneLayer can identify these events in real time by correlating multiple identifiers and behaviors that don’t align with a device’s normal profile.

Another common concern is SIM swapping — when a SIM card is removed from its intended device and placed into another. Some organizations lack the ability to lock a SIM to a specific device, so we provide real-time alerts when such mismatches occur, helping them respond immediately.

A third major threat involves unauthorized access through routers or gateways (CPEs). Even when the SIM inside a router is trusted, a rogue device might connect behind it, gaining unintended network access. OneLayer continuously monitors for these situations, detecting when a new or unexpected device appears behind a CPE. In those cases, we can automatically quarantine the device or restrict its communications — for example, blocking specific protocols or destinations until it’s verified.

These types of threats — spoofing, SIM misuse, and unauthorized downstream access — are among the most common challenges we help customers address in real time across their private LTE and 5G