Subex Signaling Risk Intelligence

Name: Subex Signaling Risk Intelligence
Brand: Subex

Subex Signaling Risk Intelligence is a telecom signaling-layer fraud and security solution that analyzes SS7, Diameter and SIP signaling traffic using signature matching, heuristics/rules and machine-learning to detect and interrupt protocol attacks and fraud in near real time.

Est 1992|Valuation $119.9M|Raised $703.7M

LinkedIn 70K|Website|FTEs 632

MarketsNetwork Detection & Response (NDR)Fraud Detection

Published Oct 7, 2026

01Common complaints

- If the buyer requires publicly documented security certifications (for example, SOC 2 Type II or ISO 27001) to be present in public vendor material prior to shortlisting - Security and compliance certificates for the signaling product were not clearly published on the product pages reviewed; buyers may prefer vendors that publish compliance attestations publicly. - If the buyer requires abundant independent, product-specific reviews - Public review platforms in this research pass showed Subex reviews concentrated on other products rather than Signaling Risk Intelligence specifically. - If the buyer requires transparent list pricing and self-serve procurement - Signaling Risk Intelligence engagements appear to be demo/RFP led; buyers seeking standardized subscription tiers may find these products are typically negotiated rather than self-serve. - If the buyer’s primary need is a pure signaling firewall with an explicitly published cross-protocol scope and protocol list - Competitors that publish explicit protocol coverage and firewall-first messaging may map more directly to firewall-centric RFPs. - Current limitations acknowledged by the vendor - No explicit public list of known issues was found on the product pages reviewed. - Roadmap / future features - Future-feature roadmaps were not publicly detailed in the sources reviewed. - Scale limitations - Throughput, latency impact, and maximum signaling transactions-per-second (TPS) were not documented publicly; procurement teams should request sizing guides, reference architectures, and benchmark methodologies. - Security/compliance gaps - Security certifications and compliance commitments were not clearly documented publicly for this product; procurement should request security documentation and certification evidence under NDA. - API/integration constraints - Public documentation of API or event-export capabilities was not found; procurement teams should confirm SIEM/SOAR exports, webhook/event streaming, and integration with existing fraud case management systems.

Deal disqualifiers (poor fit)

Operators that cannot perform inline blocking actions or cannot access signaling traffic for organizational or technical reasons.
Buyers that require publicly posted SOC 2 or ISO 27001 certificates before engagement, in cases where the vendor does not provide those documents publicly (they may still be available under NDA).

Why some customers left for competitors (churn reasons)

No direct evidence was located in public product-specific reviews for this product.

02Why they buy

- Vendor-stated differentiators (require validation) - The vendor reports a large set of threat intelligence signatures (vendor-provided figure: 58,400 unique threat intelligence signatures according to vendor materials). - The vendor reports 3,000+ preconfigured rules/heuristics. - The product uses supervised and unsupervised machine-learning models for detection. - The vendor positions signaling-layer detection as providing earlier detection than CDR-based approaches and the ability to interrupt or block attacks in near real time. - What is validated by independent customer feedback? - There was limited product-specific independent review content available to validate these unique selling points for Signaling Risk Intelligence in this research pass. - Areas where competitors may have advantages - Some competitors explicitly publish cross-protocol firewall capabilities and protocol coverage, which can simplify requirements mapping to 4G/5G security needs. - Some interconnect-focused vendors emphasize managed 24/7 protection and a presence within roaming pathways that can be advantageous for certain operator use cases.

03Field reports

Review-platform availability reality check

- Public review coverage for Subex on platforms such as G2 is largely at the vendor level and focuses on other Subex products (for example, analytics products) rather than Signaling Risk Intelligence specifically. This limits direct, product-specific sentiment data. - TrustRadius includes Subex comparative/buyer data pages, but direct end-user reviews specific to the signaling product were not identified in the sources reviewed. - Gartner Peer Insights general pages were accessible, but product-specific Peer Insights reviews for Signaling Risk Intelligence were not confirmed in this research pass.

Positive feedback (proxy signals; not necessarily about Signaling Risk Intelligence)

Some G2 reviews for Subex analytics products reference actionable insights and usability (reviewers noted the product highlights trends and makes recommendations), which may indicate strengths in analytics/visualization elsewhere in the vendor portfolio.

Negative / critical feedback (limitations)

- No directly accessible low-star reviews were found that specifically address Signaling Risk Intelligence. - A procurement risk is the limited publicly visible, product-specific independent review volume for signaling security. Recommended compensating actions for buyers include: - Reference calls with operators using the signaling solution - Proofs of concept (POCs) with realistic traffic and attack simulations - Third-party validation testing where feasible

Stated reasons customers report choosing the vendor (vendor claims)

The vendor positions signaling-layer detection as providing earlier detection than CDR-based approaches and the ability to block or interrupt attacks in near real time by operating at lower layers of the network stack.
The vendor also reports an extensive signature set, preconfigured rules, and ML-based detection capabilities.

Vendor-published case study (signaling)

- The vendor published a case study titled "Tier-1 Operator Tackles SMS GT Fraud." Reported outcomes included: - Significant annual fraud loss savings (vendor-stated) - Very high fraud detection accuracy (vendor-stated) - Single-digit reduction in revenue loss (vendor-stated) - Critical evaluation: - The operator is unnamed (described as a tier-1 operator), which limits independent verification. - Methodology details were not provided in the case-study landing text (for example, baseline period, how detection accuracy was measured, false positive/false negative rates, and any operational cost offsets). - These metrics should be treated as vendor-published and validated via reference checks, POC measurement, or request-for-evidence during procurement.

Additional vendor collateral availability

The vendor provides a flyers repository that includes a Signaling Risk Intelligence flyer; procurement teams should obtain and scrutinize that flyer for protocol coverage, deployment architecture, and operational requirements.

04Best fit

Company sizes

Best fit is typically mid-to-large telecom operators — for example, national or large regional operators — and operator groups that maintain dedicated fraud and security operations.
Smaller operators may be a fit if the product is offered as a managed service, but complexity and cost could be a barrier.

Industries and verticals

Telecom and mobile network operators, particularly those with significant roaming and interconnect activity.

Roles and personas

Decision makers:
- Head of Fraud Management / Revenue Assurance
- Chief Information Security Officer (CISO) / Head of Network Security
- VP Network Engineering / Core network teams
End users:
- Fraud analysts
- Security operations and telecom security engineers

Pain points addressed

Signaling-based fraud, spoofing, PBX/SIP abuse, SMS signaling manipulation, and other protocol-level attacks that are difficult to detect using CDR-only techniques.

Qualification criteria (good fit)

The operator can provide access to relevant signaling streams and has the authority and operational capability to interrupt or block suspicious sessions.
The organization can staff continuous monitoring and maintain incident-response processes.

05The pitch

What the product does (core value proposition in objective terms)

- Subex Signaling Risk Intelligence is a telecom signaling-layer fraud and security solution that detects and prevents protocol attacks and fraud attempts in near real time by analyzing network signaling traffic. The product uses signature matching, heuristic rules, and machine learning models to identify anomalous signaling activity and to support mitigation actions earlier in the session lifecycle than post-event records (for example, CDR-based approaches). - The vendor states the product can interrupt or block fraudulent calls/messages while sessions are being established using a combination of threat signatures, heuristics/rules, and ML models.

Target market and market positioning

Primary buyers are telecom operators / Communication Service Providers (CSPs) and their fraud management and security teams seeking SS7, Diameter, SIP and broader signaling-layer risk controls.
The vendor presents the product as part of Subex’s broader portfolio that the vendor describes using an "AI-first" label.

Get a comprehensive analysis of Subex Signaling Risk Intelligence including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →