What Actually Happened, and Why It Matters Beyond the Headlines
When federal investigators and CISA confirmed in late 2024 that Chinese state-sponsored actors had maintained persistent access to at least nine major US telecommunications carriers for over a year, the immediate reaction was shock. AT&T, Verizon, and their peers are the backbone of American communications infrastructure. But shock fades. What remains is the harder question: how did this happen, and what does it tell us about the decisions we’ve been making in network architecture for the past decade?
The Salt Typhoon intrusion wasn’t sophisticated in the way that Hollywood imagines. It wasn’t a zero-day cascade or some unprecedented cryptographic break. What made it devastatingly effective was far more pedestrian: legacy SNMP configurations left running on production equipment, edge devices from Cisco and Fortinet that hadn’t seen patches in months or years, and network segmentation strategies that looked good on paper but failed under adversarial pressure. This is the kind of access that persists because it solves a problem that nobody wanted to be responsible for fixing.
The next eighteen months will separate organizations that truly learned from this breach from those that merely checked compliance boxes. The federal mandates coming in 2026 aren’t punitive exercises. They’re a structural reckoning with how we’ve been building network-adjacent systems, and they’re going to reshape engineering priorities in ways that many teams haven’t fully reckoned with yet.
The Specific Vectors, the Specific Failures
Let’s talk specifics, because specificity is where the real lessons live. CISA’s December 2024 advisory identified three primary attack surfaces that Salt Typhoon exploited: legacy SNMP implementations, unpatched edge devices, and inadequate network segmentation. None of these are novel vulnerabilities or architectural surprises. They’re failures of maintenance discipline, and they’re endemic across the industry.
Consider the Cisco vulnerability alone. CVE-2023-20198 in IOS XE carried a CVSS score of 10.0, the highest possible severity rating. A patch existed for over a year before Salt Typhoon operators actively exploited it. That gap between patch availability and actual exploitation isn’t a technical problem. It’s a management problem. It’s the result of patch management cycles that can’t keep pace with carrier-grade operations, testing protocols that create bottlenecks, and risk tolerance calculations that consistently underweight the possibility of state-sponsored intrusion. The CISA Salt Typhoon advisory walks through these vectors in detail, and if you haven’t read it as an engineer, you should. It’s uncomfortably specific about how thoroughly access persisted.
The network segmentation failures are equally instructive. When you design a carrier-grade network, segmentation isn’t theoretical. It’s supposed to be the primary control that contains lateral movement. But in practice, segmentation creates operational friction. It makes management harder. It requires coordination across teams that historically haven’t had strong incentives to cooperate. So shortcuts accumulate. A management interface stays on the main network because moving it requires vendor recertification. A legacy system gets exempted from segmentation because its traffic patterns don’t fit neatly into the segmentation scheme. And before long, you have a network where persistent access to a single edge device puts an attacker in position to access critical infrastructure.
The Regulatory Response: Mandates That Will Actually Change How You Build
In January 2025, the FCC issued new cybersecurity rules under Section 105 of the Communications Act. These aren’t advisory guidelines or best practice recommendations. They’re mandatory annual cybersecurity risk management plans, enforceable requirements with real compliance obligations. This is the first time the FCC has moved from voluntary cybersecurity frameworks to hard mandates. That’s significant, and it’s going to ripple through organizations in ways that go far beyond telecommunications carriers.
What makes these mandates different from previous compliance regimes is their specificity about architecture. They don’t just ask whether you have a cybersecurity program. They require documented risk assessment, incident reporting within specific timeframes, and explicit remediation timelines for identified vulnerabilities. For engineers, this translates into something concrete: the business case for architectural decisions is now tied to compliance risk in ways it wasn’t before. A design that made sense from an operational efficiency standpoint might no longer be defensible if it introduces compliance risk.
The FCC cybersecurity rulemaking proceeding is the official channel where these rules are being refined, and it’s worth following if you’re designing systems that touch telecom infrastructure or that might eventually be subject to similar mandates in other sectors. The agencies are learning in real time what’s enforceable and what creates perverse incentives, and the rules are still in refinement phases.
The Real Cost: What Remediation Actually Looks Like
A February 2025 Mandiant report analyzing post-Salt Typhoon remediation efforts found something sobering: 73% of affected organizations required complete architectural re-engineering of their carrier-grade network management interfaces. Average remediation costs exceeded $47 million per carrier. That’s not a typo. That’s the price of finding out that your network architecture doesn’t actually contain intrusions the way you thought it did.
These aren’t abstract numbers. They represent months of engineering effort, vendor certifications, testing cycles, and operational validation. They represent the discovery that legacy systems you thought were isolated are actually integrated into critical paths in ways that weren’t fully documented. They represent the painful process of designing segmentation strategies that work in theory, then discovering all the ways that operational reality pushes back against them.
I’m dwelling on these costs not to be discouraging, but to be clear-eyed about what preparation for 2026 actually requires. Organizations that wait until next year to address these issues will find themselves in the position of the carriers in 2024: reactive, expensive, and playing catch-up under deadline pressure. Organizations that start now have time to plan remediation thoughtfully, integrate it into existing modernization roadmaps, and spread costs and engineering effort across multiple budget cycles.
What This Means for How You Design Going Forward
If you’re building network-adjacent systems now, the regulatory landscape is changing the calculus for architectural decisions in several concrete ways. Legacy system integration is riskier. You need segmentation baked in from the start, not added as an afterthought. Patch management cycles need to be tighter and more formal. Network management interfaces need to be architected with the assumption that they’ll be under adversarial scrutiny, not just operational stress.
The shift here is generational. For the past ten years, network architecture has often optimized for operational simplicity and cost efficiency. The next five years will optimize for resilience and compliance. That means different tooling, different testing protocols, different trade-offs. SNMP configurations that would have seemed reasonable in 2020 are now indefensible. Edge devices require more aggressive patch cycles. Network segmentation moves from “best practice” to “non-negotiable requirement.”
None of this is surprising once you sit with the technical facts. The surprise is that it took a major state-sponsored intrusion to formalize mandates that were already implicit in security architecture principles. But that’s how the industry works. We learn through breach, we formalize through regulation, and we rebuild through engineering effort.
The mandates coming in 2026 aren’t punishment. They’re structure. They’re an opportunity to build network systems that are actually defensible against persistent adversaries, rather than just defensible against the threat models we were designing for five years ago. If you’re starting that work now, you’re ahead of the curve. If you haven’t started, the next eighteen months are going to be intense. What’s your organization’s current timeline for remediation?