Secure proprietary and open source

The telecommunications industry is navigating one of its most consequential security debates in decades. A resurgent narrative argues that proprietary software environments are inherently more secure than open source counterparts because their source code is not publicly accessible. In the era of AI, that argument is not only outdated; it is operationally dangerous.

AI has fundamentally altered the economics of vulnerability discovery. Resilience in telecommunications no longer depends on keeping code hidden. Service providers that can quickly detect, understand, validate, and fix weaknesses across layers within their network will be the ones that stand out.

This overview synthesizes the strategic case for a hybrid security approach—one that treats security as an engineering discipline rather than a licensing debate, and that builds resilience from the Linux foundation upward while applying AI-driven analysis uniformly across the entire architecture.

For decades, proprietary telecommunications software was shielded less by cryptography than by friction. Finding a vulnerability in a proprietary radio access network (RAN) or core software implementation required a rare mix of skill and patience. The obstacles were real and substantial:

• Sparse or nonexistent external documentation
• Specialized and sometimes obscure programming languages
• A small global pool of genuine domain experts
• Dense, standards-heavy telecommunications protocols
• Highly customized, vendor-specific implementations

The marketing claim behind proprietary telecommunications software runs like this: the implementation is private, so malicious hackers will not be able to map the attack surface. In an AI-enabled world, that logic no longer holds. Source code is only one representation of how a system behaves, and increasingly it is the one an attacker needs least. Modern AI systems can analyze a deployed solution through everything it exposes to the world around it:

• Compiled binaries and firmware images
• Application programming interfaces (APIs) and their observable contracts
• Protocol behavior on the wire
• Memory structures and runtime state
• Network traffic patterns and timing
• Live execution paths under varied inputs

None of these require access to the source repository. Widely available tools and AI-augmented platforms can extract behavioral intelligence from proprietary software at unprecedented speed. The Cloud Security Alliance has shown that large language models (LLMs) can autonomously discover exploitable vulnerabilities and generate working exploit code.¹ Opacity has become a short-lived advantage rather than a long-term security strategy.

Calling proprietary software inherently unsafe would be both unfair and wrong. Well-run network equipment providers (NEPs) and independent software vendors (ISVs) ship disciplined, high-quality, carefully validated products. The more useful point is that closed development carries a different risk profile—one that tends to stretch out the response cycle once a vulnerability surfaces.

These risks map directly to the 3 metrics that define modern security posture, as outlined in Table 1.

Table 1: Metrics that define modern security posture

Together, MTTD, MTTU, and MTTR add up to an organization's exposure window, the stretch of time when a known but unpatched weakness can be exploited. Secrecy does nothing to shorten that window. Because AI accelerates the discovery clock in the attacker's favor, the most durable answer is to work to accelerate the understanding and remediation clocks as well.

No serious telecommunications network of the next decade will be purely open or purely closed. Tomorrow's networks will combine proprietary applications, commercial software, open source technologies, AI platforms, and cloud-native infrastructure, often inside a single service chain. Telecommunications service providers managing hybrid environments face a particular challenge: fragmented tooling that treats open and proprietary software differently creates blind spots at precisely the integration boundaries where sophisticated attackers focus. In a competitive market that places a high value on sovereignty, fast-reacting and effective security will set telecommunications service providers apart.

Step back from the application layer and a clear pattern emerges across modern networks. However proprietary the visible management consoles and vendor-specific network functions may be, the infrastructure underneath is overwhelmingly based on Linux®. Enterprise Linux is the operational foundation for container platforms, Kubernetes orchestration, virtualization layers, service orchestration and automation, networking and storage subsystems, edge computing nodes, and AI and accelerated-compute infrastructure.

As the same foundational layer repeats across RAN, core, edge, and AI deployments, an unmanaged operating foundation drags down even the most carefully engineered application above it. Many telecommunications service providers invest heavily in securing application-layer network functions while leaving the shared Linux foundation underassessed—a source of increasingly dangerous exposure.

Open source offers broad peer review, transparent development, and collaborative remediation. Proprietary software offers controlled engineering, vendor accountability, and predictable release governance. AI is changing the equation as it erodes the historical advantage of secrecy. What separates resilient telecommunications service providers from vulnerable ones is the speed and effectiveness of their security work.

If discovery is getting cheap and licensing no longer affects it, the sensible response is to take the same AI tools deployed by attackers and use them on defense—applying them across each component of the network, whether open or closed. AI-assisted security capabilities such as Mythos apply a single analytical framework across the whole software architecture, treating security as an engineering problem rather than an ideological question of proprietary versus open source.

Applied across a telecommunications service provider’s estate, this unified approach helps security and platform teams identify vulnerable components wherever they live, map plausible attack paths through the environment, correlate dependencies and transitive exposure, prioritize remediation by real-world risk rather than raw common vulnerabilities and exposures (CVE) counts, and accelerate overall security response. AI automation reduces the burden that manual investigation places on security experts.

AI tools do not ask whether code is open source or proprietary—they ask what the software does, how it can fail, and what depends on it. Fragmented security tooling that treats open and proprietary software differently creates blind spots at integration boundaries where sophisticated attackers focus.

By pairing a trusted enterprise Linux platform with AI-driven vulnerability analysis, telecommunications service providers and NEPs can build security into the operating layer itself—reducing baseline infrastructure risk, automating security validation, supporting regulatory compliance requirements, accelerating patch readiness, simplifying lifecycle management across distributed fleets, and continuously assessing platform health.

A continuously assessed platform will constantly surface and validate security vulnerabilities, rather than waiting for an adversary to discover them and start using them in the wild. This foundation-first approach does not force a choice between open source and proprietary software; it provides a reliable platform on which both can operate.

Red Hat's vision for telecommunications service provider security is explicitly hybrid, applying security capabilities consistently across an environment that is hybrid by design.

Three principles define this approach:

• AI has changed the rules of discovery. Vulnerabilities can now be found without source access by analyzing binaries, firmware, APIs, and runtime behavior. Code secrecy is an increasingly unreliable security strategy.
• Resilience is about speed, not visibility. Long-term cyber resilience depends on detection, automation, rapid remediation, and a secure platform foundation—not on whether software is open or proprietary.
• Invest in AI-driven security and Linux hardened for security. Telecommunications service providers and NEPs should strengthen hybrid environments powering modern RAN, core, and edge networks at the foundation, with AI applied uniformly across each layer. Hardening Linux delivers compounding security benefits across the entire platform.

Going back to proprietary software is not a return to safety. It is a retreat behind a barrier that AI has already learned to walk through.

The telecommunications industry stands at an inflection point. AI has made code secrecy an unreliable defense, and the telecommunications service providers that will thrive are those that invest in speed, automation, and a secure foundation rather than opacity.

For NEPs and platform engineering leaders, the path forward is concrete:

• Adopt AI-assisted vulnerability management that applies a unified analytical framework across the entire hybrid architecture—proprietary RAN software, open source core functions, commercial middleware, and cloud-native workloads.
• Harden the Linux foundation for security with a trusted enterprise Linux platform that supports automated security validation, accelerated patch readiness, and continuous platform health assessment.
• Reject the false choice between open source and proprietary software; instead, build resilience through speed, automation, and foundation-first security.
• Close the exposure window by reducing MTTD, MTTU, and MTTR with the same intensity that AI is using to increase attacker discovery speed.

The aim is not to win an open-versus-closed argument. It is to make the foundational layer of telecommunications service provider infrastructure as secure as possible, easy to observe, and quick to remediate, so the hybrid networks of the next decade stay resilient no matter how much proprietary software they carry. Telecommunications service providers that adopt AI-assisted vulnerability management will be well positioned to harden proprietary and open source environments for security at the same time.

To learn more, visit the Red Hat® telecommunications page, or engage with Red Hat about a foundation-first security assessment to identify exposure windows, integration-boundary blind spots, and opportunities to compress the detect-understand-remediate cycle.