Telecom networks hold some of the most sensitive personal data on earth, and attackers know it. The April 2025 SK Telecom breach — 27 million subscribers exposed, a $97 million fine, and a $513 million security overhaul — made that painfully clear.
AI-powered tokenization replaces subscriber PII and identity data with non-sensitive tokens across billing, analytics, and AI training pipelines. Intercepted tokens are worthless without the vault key.
With the global tokenization market growing at 19.63% CAGR toward $24.13 billion by 2035, and telecom accounting for 21% of deployments, this is no longer a niche security measure — it is becoming the foundational data protection layer for AI-native network operations.
This article explains what is driving adoption, how the technology works at telecom scale, and what system integrators and network security teams should do right now.
In April 2025, SK Telecom, South Korea’s largest carrier, suffered a breach that exposed personal data from nearly 27 million subscribers. The attackers accessed Universal Subscriber Identity Module (USIM) data, and the fallout was swift: a $97 million fine, a 90.9% collapse in Q3 operating profit, and a five-year, $513 million security overhaul announced in response. It was not an anomaly. It was a preview.
Telecom networks carry some of the most sensitive personal data on earth – location, identity, call records, billing histories – at a scale and speed that’s outpacing the architectures built to protect it. That is where AI-powered tokenization enters the picture. Not as a silver bullet, but as a genuinely different approach that is gaining real traction with operators and system integrators right now.
Why Telecom Data Is Such a Hard Target to Defend
A single mobile operator may hold IMSI numbers, location data, payment credentials, voicemail content, and device fingerprints for tens of millions of users. Under US law, this falls under Customer Proprietary Network Information (CPNI) rules enforced by the FCC. In Europe, GDPR’s Article 32 requirements for encryption and pseudonymization apply directly. Both carry serious teeth.
The threat environment reflects the stakes. Ransomware attacks on the communications sector jumped 177% year-on-year in Q1 2024 – the highest increase of any sector tracked that quarter, per Check Point Research. The Salt Typhoon and Flax Typhoon campaigns in late 2024 exposed vulnerabilities across core US telecom infrastructure, prompting the FCC to issue a Declaratory Ruling in January 2025 clarifying carriers’ CALEA obligations. Meanwhile, the global AI in telecom market is forecast to grow from $2.66 billion in 2025 to $50.21 billion by 2034 – a 38.81% CAGR. More AI in the network means more data in motion, which means a wider breach surface.
What AI Tokenization Actually Does
Tokenization replaces sensitive data with a non-sensitive substitute – a token – that holds no exploitable value on its own. The original data sits in a separate, access-controlled vault. If an attacker intercepts a token, they have nothing useful.
In a telecom context, this covers MSISDN numbers, IMSI codes, subscriber PII (Personally Identifiable Information), billing data, and location records. Instead of flowing as plaintext through BSS/OSS systems, CRM platforms, and analytics pipelines, these values move as tokens. The hard part is making that work at telecom scale – billions of transactions, strict latency requirements, and architectures spanning legacy 4G alongside 5G core. This is where AI changes the equation. AI-driven tokenization platforms auto-classify data at ingestion, detect anomalies in access patterns, adapt policies in real time, and maintain referential integrity so tokenized data can still be joined across systems without re-exposing the underlying values. For a broader look at how network-aware applications are reshaping data flows across the enterprise edge, the dynamics are closely related.
Where the Market Is Right Now
The global tokenization market was valued at $4.02 billion in 2025 and is expected to reach $24.13 billion by 2035 at a 19.63% CAGR. Telecom accounts for 21% of the market by vertical – one of the largest non-financial adopters. API-based tokenization, the architecture most compatible with cloud-native telecom stacks, held 60% of the deployment market in 2025.
The timing is not accidental. Operators are migrating to cloud-native, software-defined architectures – Open RAN, 5G SA cores, multi-vendor edge deployments. Data now crosses more boundaries and is handled by more parties than ever before. IDC’s September 2025 C-Suite Tech Survey found 52% of telecom C-suite leaders have AI implementation as a top-three priority – nearly tied with technology modernization at 50%. For most operators, those are not separate investments. They are the same initiative.
A Note on the Word “Tokenization” in Telecom: Two Very Different Things
Worth a quick clarification before moving on. The tokenization covered throughout this article is data security tokenization – replacing subscriber PII with a non-sensitive surrogate to protect it as it flows through network systems and AI pipelines.
But “tokenization” is appearing in a second, distinct context in telecom: as a commercial billing unit for AI inference. Just as Claude or GPT-4 charge per token processed, carriers building AI factory services are adopting the same model – metering enterprise AI consumption by the token rather than selling fixed compute capacity. Operators, including Deutsche Telekom, SoftBank, and SK Telecom, are all piloting “AI factory” or “sovereign AI” infrastructure inside their networks, and tokenized billing is the emerging monetization layer on top.
The two meanings will increasingly appear in the same conversation as networks become AI-native. We’ll cover the commercial model – the economics, the vendor landscape, and the implications for system integrators – in a dedicated follow-on article.
The AI-Native Network Makes This Urgent
Telecom networks are not just using AI for security – they are building AI-native architectures for autonomous operations. The rise of agentic AI and programmable 5G networks means AI models are now directly consuming sensitive subscriber data to drive real-time network decisions. According to Ericsson’s November 2025 Mobility Report, mobile data traffic rose 20% year-on-year in Q3 2025 and is forecast to reach 482 exabytes per month by 2031, with 5G carrying 83% of that load.
IDC’s March 2026 telecom outlook introduced the concept of ‘kinetic tokens’ – AI inference moving out of the data center and into the network fabric. Network slicing, edge AI, and real-time spectrum management all require models to ingest sensitive subscriber data. Tokenization is the layer that lets those models operate without retaining or exposing that information. The same logic extends to CAMARA and Quality-on-Demand APIs: as operators expose network capabilities to enterprise developers, subscriber identity tokens become the currency of those transactions – the developer never sees the underlying MSISDN. You cannot build a privacy-compliant AI-native network without a tokenization layer beneath it.
| PRO TIP: Token Before You Train If your organization is feeding subscriber data into AI models for network optimization, churn prediction, or fraud detection, audit your data pipeline first. AI models trained on raw PII create compliance liabilities that outlast the model’s useful life. Apply deterministic tokenization at the ingestion layer so that what enters the model is a token, not a subscriber identity. The model still learns what it needs to. You just don’t carry the exposure. |
The Regulatory Floor Is Rising
The FCC’s January 2025 CALEA clarification and GDPR’s Article 32 pseudonymization requirements are not going away – they are getting stricter. Tokenization is specifically cited in the GDPR guidance as a valid pseudonymization method, and under Article 17 (Right to Erasure), it dramatically simplifies deletion compliance: remove the token mapping, and the underlying values become unreachable across the entire data estate. Approximately 40% of organizations now report experiencing an AI-related privacy incident – most of them quiet leaks through prompts, logs, and APIs. In telecom, where AI runs inside billing platforms, customer service chatbots, and predictive maintenance systems, those leaks carry direct CPNI and GDPR liability. Tokenization at the data layer is the most direct mitigation available. The security vulnerabilities of enterprise private networks follow the same pattern: perimeter defenses alone are not enough when the data itself is the exposure.
Who Needs to Act, and How
If you are a system integrator working on 5G core deployments, Open RAN rollouts, or cloud migration projects, tokenization should be part of every architecture review. The expanding role of the system integrator now includes data protection architecture – not just connectivity. The window between ‘best practice’ and ‘regulatory requirement’ is closing faster than most integration timelines allow. Build it into your reference architectures now, evaluate vendors like against your clients’ OSS/BSS stacks, and position the data protection case alongside the operational efficiency case – they are the same conversation.
If you are in IT or network security at a carrier, start with a data flow audit. Map where subscriber PII and CPNI actually travel across your systems. In most operators, that map is longer and more surprising than anyone expects. Then prioritize the highest-risk flows – billing data, AI training pipelines, third-party API integrations – and apply tokenization there first. The SK Telecom breach did not happen because the operator lacked a security budget. It happened because basic data protection was missing in the wrong places. Tokenization, when applied correctly, systematically closes those gaps rather than one incident at a time.
Frequently Asked Questions
What is AI tokenization in the context of telecom networks?
AI tokenization replaces sensitive subscriber data – such as MSISDN numbers, IMSI codes, location records, and billing information – with non-sensitive tokens that hold no exploitable value on their own. The original data sits in a separate, access-controlled vault. AI enhances this by auto-classifying data at ingestion, detecting anomalous access patterns, and adapting protection policies in real time – making tokenization practical at the billions-of-transactions scale that telecom networks demand.
Why is subscriber data in telecom networks particularly at risk?
Telecom operators hold an unusually broad range of sensitive data types – IMSI identifiers, device fingerprints, payment credentials, call metadata, and real-time location data – for tens of millions of users simultaneously. This combination makes a single breach highly damaging, as the SK Telecom incident demonstrated in April 2025. Ransomware attacks on the communications sector also jumped 177% year-on-year in Q1 2024, the highest increase of any tracked sector.
How does tokenization help with GDPR and CPNI compliance?
Tokenization is explicitly cited in GDPR guidance as a valid pseudonymization technique under Article 32. It also simplifies compliance with Article 17 (Right to Erasure): deleting the token mapping makes the underlying personal data unreachable across all connected systems in one step, rather than requiring a hunt through multiple databases. For US carriers, tokenizing CPNI data reduces the blast radius of any breach and demonstrates active compliance with the FCC.
What is the difference between tokenization and encryption?
Encryption mathematically scrambles data and can be reversed with the right key – meaning the sensitive value still exists and can be exposed if the key is compromised. Tokenization substitutes the data entirely with a random token; the original value is stored separately in a vault with its own access controls. If an attacker intercepts tokenized data, there is nothing to decrypt. In practice, many telecom deployments use both encryption for data in transit and tokenization for data at rest in analytics and AI systems.
Where should telecom organizations start when implementing tokenization?
Start with a data flow audit. Map every system that touches subscriber PII or CPNI – billing platforms, CRM tools, AI training pipelines, and third-party API integrations. In most operators, this map is longer than expected. Then prioritize the highest-risk flows for tokenization first. For system integrators, the guidance in building the enterprise case for private network ROI applies equally here: frame tokenization as an operational and compliance investment in the same conversation, not a standalone security cost. Vendors worth evaluating include Thales, Protecto, and TokenEx for telecom-grade API integrations.
Where can I go deeper on the intersection of private wireless, sovereign AI, and enterprise connectivity?
The PrivateLTEand5G.com Connected AI Edge Virtual Bootcamp Series runs from May through December 2026 – nine focused sessions designed specifically for enterprise IT/OT leaders, systems integrators, and MSPs navigating exactly these decisions. Sessions cover private 5G architecture, IT/OT convergence, AIoT device ecosystems, programmable networks, and vertical-specific deployments across manufacturing, logistics, agriculture, and higher education. Every bootcamp ends with a Pro Tips segment – practitioner-sourced, immediately actionable, and compiled into a downloadable reference card after each session. The series is built for people making real deployment decisions, not vendor roadmap watchers. Sessions are recorded and available on demand to registered attendees. If the compliance and infrastructure questions raised in this article are live issues for your organization or your clients, this is the community and the curriculum to work through them with. View the full program and register at PrivateLTEand5G.com.
