The HACC Group
Carrier-deployed · since 2023
TrafficIQ™·carrier-switch native

Pre-connection threat defense for voice traffic.

TrafficIQ runs inside the carrier signalling path. Every inbound call is inspected before it ever connects — and every outbound call leaves with its credentials intact.

layerSS7 / SIP signallingdecision< 80 ms pre-ringmodelBehavioral, continuously retraineddeployedTier-1 & Tier-2 carriers
< 3 ms· pre-ring signal ingest
02/How it works

Four checkpoints between the caller and the ring.

TrafficIQ inspects the SS7/SIP signalling envelope, runs it through the behavioral model, and returns one of three verdicts to the switch — all before the destination phone rings.

SOURCECallerCHECKPOINT 01Signal ingestCHECKPOINT 02Behavioral scoringCHECKPOINT 03VerdictCHECKPOINT 04Ground truthDETECTION ENGINEBehavioral model· multi-signal· pre-connectionDEST · OKconnectDEST · ××dropDEST · OKtriagedFEEDBACK · RETRAINFLOW · CALLER → CARRIER → TRAFFICIQ → DESTINATION
01

Signal ingest

< 3 ms

The carrier switch hands the call signalling envelope to TrafficIQ before the destination is notified. SS7 and SIP both terminate here.

02

Behavioral scoring

< 60 ms

The detection engine evaluates the signalling envelope against learned originator behavior. No static blocklist lookup.

03

Verdict

< 80 ms

One of three outcomes: pass · connect, intercept · drop, or monitor · triage (for outbound deliverability). Returned to the switch in-line.

04

Ground truth

pre-ring

The carrier switch executes the treatment — connect, drop, or triage — based on TrafficIQ's analysis and reason codes. Outcome and confidence are fed back for continuous retraining.

03/Two directions, one engine

Stop what shouldn't reach you. Land what should.

Inbound and outbound are the same detection engine seen from opposite sides of the switch. Both verdicts feed the same source of truth.

← inbound·threat identification

Detect and intercept malicious traffic before it reaches the destination.

Spoofed numbers, vishing, identity-theft campaigns, and synthetic ANI all surface in the signalling envelope long before the endpoint sees them. TrafficIQ drops them pre-ring.

  • Pre-ring decisioning on every inbound flowEndpoint never makes the call.
  • Behavioral fingerprinting of the originator, not the numberThe originator pattern persists across number changes.
  • Verdict feedback loop to the source-of-truthYesterday's intercept becomes today's higher-confidence signal.
malicious srcTRAFFICIQenterpriseintercept · drop
outbound →·call deliverability

Make sure legitimate enterprise traffic keeps its credentials and reaches its destination.

Legitimate outbound calls get marked down by aggressive carrier-side analytics as the spoof problem worsens. TrafficIQ analyzes outbound traffic so the carrier can protect legitimate dial pipelines.

  • Behavioral analysis of legitimate originators, complementing the carrier's STIR/SHAKEN infrastructureThorough envelope inspection, opposite verdict.
  • Call-completion rates protected against false-positive blockingOutbound dial pipelines stay above their SLA.
  • Branded calling and other carrier products remain intactTrafficIQ risk rating becomes visible and able to be passed along.
enterpriseTRAFFICIQdestinationmonitor · triage
04/Carrier results

What happened when carriers deployed TrafficIQ.

Aggregate numbers across deployed Tier-1 and Tier-2 carrier networks. Named-customer attribution available under NDA on the briefing call.

10B+
traffic instances analyzed
97%
incident reduction on average
25%
average revenue growth YoY with carriers
10%
average margin lift with carriers

TrafficIQ secured our network and maximized our efficiency. We shifted focus from managing daily risks and focused on growth.

CEO, Tier-2 North American CarrierAnonymous · NDA
05/Pricing model

Subscriptions suited to each customer's footprint.

TrafficIQ is sold as a subscription, sized to the customer's traffic profile, deployment topology, and required SLAs. We do not publish list pricing because no two carrier or enterprise deployments are the same shape.

A briefing call is the fastest way to a quote: 30 minutes with our team is enough to scope a starting deployment and a number you can take to procurement.

What we size against

Inputs we'll ask for on the briefing call.

  • Average inbound flows per secondPeak hour, not steady state.
    Flows / sec
  • Outbound dial volume requiring analysisContact center and notification traffic.
    Calls / month
  • Signalling topologySS7, SIP, hybrid; on-prem vs. cloud switch.
    Topology
  • Verdict-latency budgetPre-ring SLA the destination will tolerate.
    Milliseconds
  • Required regional coverageTermination geographies and regulatory scope.
    Regions

No public price list. We don't publish numbers because the right deployment shape — and price — falls out of those inputs. The briefing is the quote.

06/Product

What operators see, day to day.

window · 24h● live· illustrative
CPS · avg/min1,041
Port usage · /min17.4k
Endpoints by volumetop 6
node·a1node·b3node·c2node·d4node·e7node·f1
live · 06s

Live monitor

Per-switch flow with verdicts as they happen.

flow · 0x4f…b21SS7· illustrative● intercept
Analyzed status · 24h14.2M
passmonitorintercept
Verdict by result3 classes
pass · connectmonitor · triageintercept · drop
intercept · drop

Verdict drilldown

Behavioral signals + confidence that produced each call.

wk · 18▲ +4.1%· illustrative
Incidents avoided↓ 96.8%
Trunk groups by volumetop 6
tg · αtg · βtg · γtg · δtg · εtg · ζ
vs. pre-deploy

Carrier report

Weekly rollup — incidents avoided, revenue protected, margin lift.

07/Get a briefing

30 minutes is enough to scope a starting deployment.

Audience-type·Enterprise / CarrierResponse·Within 2 business daysNDA·Available on request