Simetric Chief Revenue Officer Matt Coleman has a new article in IoT Now, The AI Worm Your Security Stack Can’t See: Why cellular IoT is the blind spot. It starts from research most security teams would file under “someday” and asks the question that decides whether an enterprise can respond to it at all: who can actually see the devices it targets?
A threat that no longer needs a data center
On October 12, Anthropic’s Frontier Red Team published research suggesting small AI models may soon be able to copy themselves across inexpensive IoT devices and run on them, with no GPUs involved. A scripted botnet like Mirai is built around one device type, whereas an AI worm can work out unfamiliar hardware on its own and pass what it learns to each new copy. Matt sets that research alongside an attack the night before it was published, when refrigeration controllers in hundreds of French supermarkets were taken over, as a reminder that connected equipment is already a target.
Why cellular devices fall outside the security stack
The article’s central point is architectural. Traffic from a cellular device runs from the radio to the carrier’s core and out to the internet, so it never reaches the firewall, switch, or network access controls an enterprise depends on. Most of these devices, from smart meters and industrial gateways to EV chargers, signage, and fleet telematics, can’t run an endpoint agent either. Established security platforms are built for networks the enterprise owns, and cellular is a network it rents. As Matt puts it, those platforms “just weren’t designed for this.”
For cellular IoT, the carrier is the ISP
Anthropic’s paper expects an AI worm to leave a network signature an ISP could detect, and points to how ISP-led quarantine cleared most Mirai infections within two weeks. For a cellular device, the carrier plays that ISP role, which means the warning signs exist but are split across every operator’s portal, data format, and API. On a SIM, they show up as a meter that normally sends a few megabytes a month suddenly pulling gigabytes, round-the-clock sessions on a device that should report twice a day, or session churn that looks like scanning for the next host. Any single carrier sees too little of the fleet to separate that from noise. Carrier portals see activity on their own network; Simetric is the platform that governs all of them, and normalized across every carrier, the same pattern becomes an alert.
Where Simetric fits
Simetric is the enterprise orchestration layer above those carriers, already proven across roughly 80 million SIMs, 300+ mobile network operator integrations, and 1,200+ normalized APIs. Matt describes three things that give a security team: an inventory of every cellular-connected device on every carrier, including the ones that will never appear on an IT or OT network; anomaly detection that baselines normal behavior for each device and flags deviations as they happen; and workflows that alert the SOC, open an incident in ServiceNow, or restrict or suspend a SIM, which is the cellular equivalent of the ISP quarantine Anthropic describes.
He is equally clear about the boundaries. Simetric doesn’t patch devices, and it doesn’t replace the firewall, endpoint, or SOAR tools an enterprise already runs. It supplies the cellular data those tools are missing, feeding device inventory into the CMDB, anomalies into the SIEM, and quarantine into the playbooks security teams already use.
The article closes with three questions every security team should be able to answer this week, beginning with how many cellular-connected devices the enterprise has and on how many carriers. If that number lives in a spreadsheet, the gap is already visible.
Read the full article on IoT Now, then schedule a demo to see which cellular devices in your own estate sit outside your security stack today.