vodafone

Harnessing Automation for Cybersecurity

How Vodafone transformed threat intelligence with n8n and achieved £2.2M in savings.

Challenge

Telecommunications companies are among the top three industries most at risk of cyberattacks, trailing only finance and healthcare. Attack volumes are not only increasing but also becoming more complex. According to Gartner, the average breach in the telco sector costs $5.72M, underscoring the pressure on security operations.

The Telecom Security Act (TSA), introduced in 2024, brought stricter requirements: wider logging and monitoring, longer data retention (from 90 days to 13 months), and centralized storage of logs.

“This means more assets, more types of data, and significantly more alerts,” explained Claire Van Hinsbergh, Engineering Manager at Vodafone.

At the time, Vodafone was already processing 3–5 billion events per month and thousands of alerts. Expanding monitoring without automation would have created unsustainable strain on engineering and CSOC teams.

Vodafone set two clear goals:

Expand monitoring and retention to comply with TSA requirements.
Absorb the additional workload without adding headcount or overburdening existing teams.

Solution

Vodafone initially tested traditional SOAR tools such as IBM Resilient and Tines. While powerful, they didn’t address broader workflow and integration needs.

That changed with n8n Enterprise.

A flexible platform combining SOAR capabilities with workflow automation.
Low-code for rapid adoption, with full-code extensions for complex use cases.
Modular workflow design enabling reuse across teams.

“n8n gave us exactly what we were looking for — automation for security and workflow management, all in one tool,” said Claire.

To accelerate adoption, Vodafone partnered with Bounteous, who helped establish CI/CD practices in n8n. Together, they designed modular workflows that could be versioned, tested, and securely deployed across the organization.

Bounteous also created reusable workflow templates like a fraud detection module leveraging IP geolocation that Vodafone teams can adapt for different use cases.

Impact

Since rolling out n8n in August 2024, Vodafone has launched 33 new workflows, covering security operations, onboarding, engineering, and even content creation.

The results:

5,000+ person-days saved
£2.2M in avoided costs
Ongoing savings of ~£300k per month in 2025

Automation has enabled the CSOC to scale monitoring and meet TSA obligations without increasing staffing. For example, Vodafone now has a workflow that checks critical data feeds every five minutes, instantly raising tickets if issues occur.

“Doing this manually every five minutes would be impossible without pulling people off higher-value work. n8n allows us to be more effective, not just busier,” said Claire.