Whoever runs the network’s control plane owns the customer. With Cisco, the moat sits in the vendor’s hardware, software and licensing. With Graphiant, the telco runs the moat: the control plane runs in the telco’s cloud, and every service, from SD-WAN to security to private AI connectivity, is sold under the telco’s brand. Hyperscalers built their networks this way: services defined in a software control layer. Graphiant gives telcos the same model, so they can offer cloud-like network services on their own MPLS/IP network, at 30–40% service margins, with about 60% lower CapEx and 70% lower OpEx, on a fabric ready for large-scale, peer-to-peer AI agents.
Architecture: hardware-centric vendors vs. a telco-run cloud control plane
Cisco and traditional vendors | Graphiant | |
|---|---|---|
Where the service lives | In hardware: routers, firewalls and appliances at each site, with features tied to platform and licence | In software: a cloud control plane; a stateless core for traffic; edges are thin and transport-agnostic |
Who runs the control plane | The vendor (or the enterprise) runs controllers; the telco resells or manages them | The telco, in its own cloud: Network as a Service, under its own brand |
SD-WAN and the carrier network | An overlay over the top of MPLS and Internet; the overlay cannot see or use the carrier’s underlay | SD-WAN runs inside the telco’s MPLS/IP network; the overlay integrated into the underlay and becomes peer to peer |
SLA | Best effort across the overlay; the carrier guarantees only its circuit | End-to-end guaranteed SLA, because the telco controls overlay and underlay together |
Data sovereignty | Traffic paths decided by tunnels and hubs; hard to prove where data went | Path control and proof: data stays in-country or on approved paths (Data Assurance) |
Visibility and security | Separate consoles per product; flow data sampled or partial | Every flow leaving the enterprise edge monitored; telco threat intelligence, governance and threat monitoring delivered as part of the service |
Scale | Tunnels per site pair per transport: 4,950 for 100 sites, 19,800 with two links | Two connections per site; adding a site touches no other site |
Speed of change | Hardware refresh and release cycles of years | Software releases in weeks; a PoP in hours, a 10-PoP network in a day |
Security foundation | Network operating systems with decades-old C/C++ code bases | New network OS written in Rust (memory-safe), post-quantum keys (ML-KEM) carried in BGP |
Why the integration matters. When SD-WAN rides over the top, the telco sells pipes and the vendor owns the intelligence. When SD-WAN runs inside the telco network, the telco sees and controls every path, can guarantee SLAs end to end, and can turn its own threat intelligence into a managed security and governance service for every enterprise it connects. The network becomes the telco’s platform, not the vendor’s.
Economics: higher margins, lower cost, and every service under the telco’s brand
Moving services from vendor hardware into a software cloud control plane changes the telco’s cost structure and its position in the value chain. Graphiant estimates telco service margins of 30–40%, with about 60% lower CapEx (no appliance per site, no hardware refresh) and 70% lower OpEx (one policy and one console, automated provisioning, no per-device change management).
Telco-branded service | What the enterprise buys | Traditional model | Graphiant model |
|---|---|---|---|
Cloud Connect | Private, high-performance access to Azure, AWS, Google Cloud and Oracle | Vendor gateways per cloud; telco resells circuits | Telco PoPs in each cloud; telco-owned policy and billing |
Multi-Cloud | One network across clouds and regions | Separate multi-cloud vendor overlay | Same fabric, same policy, telco brand |
SD-WAN | Branch connectivity with application steering | Vendor appliances plus SD-WAN license at every site | Software service inside the telco’s MPLS/IP network |
SASE / security | Secure access, threat protection, governance | Separate SASE license; vendor PoPs outside the telco | Telco threat intelligence on every flow at the edge |
Private Connectivity | Private site-to-site, partner and B2B networks | Per-site VRFs, tunnels and NAT | Segments and federation by policy, created in minutes |
Data Assurance | Proof of where data travels; sovereignty | Separate monitoring license; synthetic probes, not real flows | Path visibility and path control for every flow |
Private AI Network | Private fabric to frontier and open-weight models | Not available | One sovereign fabric from enterprise to model |
One platform instead of stack of vendor licenses
Capability | Cisco: separate products and licenses | Graphiant: one telco-run platform |
|---|---|---|
SD-WAN | Catalyst SD-WAN: hardware plus subscription license tiers per device | Included: software service inside the telco network |
Security (SSE / SASE) | Secure Access / Umbrella: separate per-user subscription, traffic sent to Cisco PoPs | Telco threat intelligence applied at the edge, telco-branded |
Visibility and assurance | ThousandEyes: separate license; synthetic test agents probe sample paths, not the real traffic | Every real flow recorded end to end: path, jurisdiction, volume and policy |
Analytics and SIEM | Splunk: separate license, priced by data volume | Flow evidence streamed to the telco’s or customer’s SIEM |
Who keeps the margin | The vendor, license by license; the telco resells | The telco: one platform, its own pricing, bundling and margin |
Each Cisco license is a separate line on the bill, a separate console and a separate renewal, and the margin on each flows to the vendor. Graphiant gives the margin and the control back to the telco.
The telco owns the customer, the brand and the roadmap. Services are telco-branded, not vendor-branded; Graphiant is white-label. Pricing, bundling and billing stay with the telco.
Cloud-like service model. Self-service ordering, consumption billing and new sites, segments or clouds in minutes, the way hyperscalers sell networking, delivered from the telco’s own cloud and central offices.
Revenue moves up the stack. Connectivity becomes a bundle of networking, security, sovereignty and AI services with recurring revenue per site, per segment and per flow, instead of a commodity circuit.
The future: an inference and agent Internet, run by the telco
Agents are becoming the new workforce, and inference the dominant distributed workload. Business customers already build multi-step agent workflows, and inference is moving to edge sites and carrier central offices. The Internet was built for content: clients call servers on fixed ports. The agent Internet is peer to peer: every agent is both client and server, across sites, clouds, partners and countries, at machine speed.
What the telco can offer with Graphiant
A private AI network as a service. One sovereign fabric connecting the enterprise’s sites, data centers, clouds, GPU clusters and models: frontier models alongside open-weight and open-source models running on-premises, in a GPU cloud or in the telco’s central office, with no Internet path. No single model becomes the sole dependency.
Inference at the carrier edge. Graphiant PoPs run as software in central offices, carrying each customer’s identity into shared GPU compute and steering each request to the best site.
Protection when an agent goes rogue. Models cannot police themselves; the network is the control point an agent cannot override. Graphiant enforces where each agent may connect, records every flow outside the AI stack, and provides a kill switch that isolates an agent, site, swarm, cloud or partner without the compromised system’s cooperation.
Federated and sovereign. Each enterprise, swarm and partner has its own segment, keys and policy; agents cross company boundaries only where both sides approve, and data stays in country.
The one line: Cisco says control is the moat. With Graphiant, the telco owns the moat, and turns its network into a cloud-like platform for enterprise, multi-cloud and the agentic Internet.