Enterprise security controls work best when communications pass through infrastructure the organization can observe and govern. Firewalls inspect traffic crossing managed boundaries, network access control governs access to managed networks, proxies and secure web gateways apply policy to traffic that traverses them, and network monitoring tools analyze the traffic they can see.
An embedded modem, cellular gateway, hotspot, or vendor-installed LTE or 5G connection can create a separate communications path outside the organization’s normal network architecture. Devices using these connections can communicate directly through a mobile carrier without using the organization’s normal internet gateway.
An out-of-band cellular path is an LTE or 5G communications connection that operates independently of the organization’s normal wired or Wi-Fi network infrastructure. The issue is not simply another device to inventory. The cellular connection can create an independent communications path inside the enterprise while remaining outside much of the network security architecture designed to monitor and control external connectivity.
Cellular Connectivity Creates a Parallel Communications Path
Cellular connectivity serves legitimate operational purposes. Organizations use LTE and 5G for backup communications, remote management, telemetry, equipment commissioning, vendor support, IoT deployments, and systems located where wired connectivity is impractical.
The security issue arises when that connection is undocumented, unnecessary, poorly governed, or introduced outside normal security processes. A cellular modem connected to industrial or enterprise equipment can provide an external path that may not be governed by the same controls as the device’s primary network interface.
Consider an industrial controller connected to an LTE modem for vendor maintenance. The controller may sit behind carefully configured firewalls and network segmentation on the organization’s Ethernet network while the cellular modem provides a separate connection to an external carrier network.
From the managed network’s perspective, nothing necessarily looks wrong. The enterprise controls may be working exactly as designed while another communications path operates outside what they can see.
Embedded Cellular Can Be Easy to Miss
A smartphone or portable hotspot is easy to recognize as a cellular device. Embedded connectivity creates a harder asset-management problem because the radio may be only one component in a larger system.
LTE and 5G modules can appear inside industrial gateways, routers, security equipment, building systems, kiosks, appliances, telemetry devices, environmental monitoring systems, backup systems, and specialized operational equipment. A cellular modem can also connect to another system through Ethernet, USB, serial interfaces, or other local connections.
The equipment may appear in an asset inventory based on its primary function without clearly showing all of its communications capabilities. A security team may know a particular controller, appliance, or gateway exists without realizing the same equipment includes an active cellular interface. Knowing that a system exists does not necessarily reveal every communications interface or external path available to it.
How LTE and 5G Can Operate Outside Enterprise Security Controls
A direct cellular connection changes where traffic enters and leaves the environment. Enterprise network controls cannot govern communications that never traverse the network.
Firewalls control traffic crossing the interfaces and boundaries they monitor. A cellular modem communicating directly through a carrier network may create an external path that bypasses the organization’s perimeter firewall.
Network access control governs devices connecting to managed wired and wireless infrastructure. A device using LTE or 5G does not need to join the corporate Ethernet or Wi-Fi network simply to communicate externally.
Web proxies and secure web gateways apply policy when traffic passes through them. Direct cellular communications may reach external systems or services without traversing the organization’s enterprise proxy architecture.
Network detection and response systems analyze traffic available from monitored network infrastructure. Communications traveling over an independent cellular connection may never appear in those packet flows.
Network segmentation limits communications across controlled network boundaries. A cellular interface introduces another communications path that those segmentation rules may not govern.
This does not mean that the existing security controls have failed. They may be operating correctly, but they can only enforce policy and provide visibility for communications that pass through the infrastructure they monitor.
| Enterprise Control | What It Sees | What It Misses |
| Firewall | Traffic crossing managed network boundaries | Direct LTE/5G communications through a carrier |
| Network access control | Devices joining managed wired or Wi-Fi networks | Devices communicating externally without joining those networks |
| Proxy / secure web gateway | Traffic routed through enterprise web-security infrastructure | Direct cellular access to external systems or services |
| Network detection and response | Traffic visible on monitored network segments | Communications that never traverse those segments |
| Network segmentation | Communications across defined network boundaries | Cellular communications that do not traverse the segmented network path |
Device Risk and Path Risk Are Different Questions
The device itself may be approved, patched, and performing a legitimate operational function. The security concern may instead be the independent communications path that the device creates.
Cellular risk therefore needs to be evaluated at two levels. Security teams need to determine whether the device belongs in the environment and whether its cellular path belongs in the approved architecture.
A known cellular gateway used for authorized backup communications presents a different condition from an undocumented modem connected to the same type of equipment. The radio technology may be the same, but the operational context, ownership, purpose, and policy status can be very different.
Vendor and Temporary Connectivity Can Become Permanent
Vendor and contractor installations deserve particular attention because cellular connectivity can simplify deployment and remote support. A systems integrator may install a gateway during commissioning, while a vendor may provide an LTE modem for diagnostics or use cellular connectivity before permanent network access becomes available.
A temporary connection can easily become long-term infrastructure. A modem installed for a short commissioning period may remain active after the project ends, or a vendor gateway may survive multiple support-team and ownership changes without appearing in current architecture documentation.
The pattern can be simple: equipment is installed, temporary cellular access is enabled, commissioning ends, and the modem remains connected. Months or years later, the organization may still have an external communications path with no clear operational owner.
These situations do not require malicious activity to create risk. They become security concerns when the organization no longer knows that the connection exists, why it remains necessary, or what systems it can reach.
Dual-Connected Systems Deserve Special Attention
The risk increases when the same system connects to both a protected enterprise or operational network and an independent cellular network.
A device might connect to a segmented OT network through Ethernet while also using LTE for maintenance. A gateway might collect information from an internal system and communicate externally over 5G, while a computer might remain attached to the corporate network while maintaining an independent cellular connection.
A dual-connected system does not automatically bridge the two networks. Its configuration, routing, applications, access controls, and operating state determine whether traffic or access can move between them.
That configuration deserves closer scrutiny because the same system connects to both a protected internal environment and an independent external communications path. Security teams therefore need to understand not only that two interfaces exist, but how they interact and whether those connections work as the organization intended.
The Risk Extends Beyond Remote Access
Remote administration is one concern, but out-of-band cellular connectivity can affect several parts of the security model. An independent cellular connection can provide a data exfiltration path that does not depend on the corporate internet connection.
It can also support remote administration or diagnostics outside established enterprise access workflows, or allow a compromised system to maintain external communications even when restrictions apply to its primary enterprise interface.
Cellular connectivity can also challenge assumptions about isolation and segmentation. A system that appears tightly controlled from the managed network’s perspective may still maintain external connectivity through an embedded modem or connected gateway.
The important security question is therefore not simply whether LTE or 5G is present. Security teams need to understand what the cellular device connects to locally, what systems or services it can reach externally, and whether that connection is expected and authorized.
Backup Connectivity Still Requires Security Context
Organizations may treat cellular links differently when they exist for redundancy or emergency communications. A backup LTE or 5G connection can be operationally important, particularly for remote facilities, industrial systems, and infrastructure that must remain connected during a primary network failure.
Backup status does not make the communications path irrelevant to security. Security teams still need to know where the modem operates, which equipment it supports, when it becomes active, and whether its behavior matches its intended purpose.
A backup connection that unexpectedly activates during normal operations may warrant investigation. The same is true when a familiar modem appears in an unauthorized location or begins operating outside its normal schedule.
The relevant question is not whether cellular communications should exist. It is whether the observed communications match the organization’s approved architecture and policy.
A Network Inventory Can Still Miss the Path
Traditional asset discovery usually begins with the network. Security teams enumerate IP addresses, scan network segments, query switches, examine endpoint telemetry, review authentication records, and correlate information from asset-management systems.
Those techniques can produce an accurate representation of the managed network without describing every communications path operating inside the facility. A cellular modem does not need to appear on the corporate network to communicate with a carrier, and a gateway can connect local equipment to LTE or 5G while remaining outside normal network discovery.
A vendor appliance can also contain an embedded cellular radio even though its primary enterprise interface appears correctly in the configuration management database. The asset record may therefore be accurate while the communications architecture remains incomplete.
This is why cellular security cannot be reduced to network inventory alone. Security teams need an independent way to determine whether wireless communications paths are operating inside the environment.
From RF Detection to Architecture Validation
Direct RF observation provides a different perspective because it observes the wireless communications themselves rather than depending on the device to participate in enterprise infrastructure.
For LTE and 5G, this can help security teams determine whether cellular communications are occurring inside the facility, where the associated device is operating, whether its presence is expected, and whether its behavior aligns with policy.
That changes the purpose of cellular detection. The objective is not simply to count radios but to compare observed wireless communications against the organization’s approved architecture.
A cellular transmission in an approved equipment room may be consistent with a known backup design. The same type of communication from a restricted control room, data hall, or sensitive operational area may require a different investigation.
Bastille Adds Cellular Intelligence Outside Enterprise Telemetry
Bastille provides an independent RF perspective by passively observing cellular communications rather than requiring devices to connect to enterprise infrastructure.
Bastille monitors LTE and 5G communications within the area under observation and provides RF-derived intelligence that helps security teams determine where cellular devices are operating. Using patented algorithms and analysis, Bastille can locate wireless devices and add spatial context to cellular detections.
The Advanced Detection Analytics Module (ADAM) adds behavioral analysis, pattern-of-life intelligence, policy rules, threat prioritization, and zone-aware context. This lets organizations evaluate cellular communications based on where devices operate, when they appear, how their behavior changes, and whether those conditions align with established policy.
The goal is not to treat every cellular transmission as a threat. It is to give security teams enough independent intelligence to distinguish expected cellular communications from conditions that warrant investigation.
From Detection to Investigation
Detecting cellular communications should start an investigation, not end it. Security teams can determine whether the associated device belongs in the facility, locate the equipment, identify its operational owner, and establish why cellular connectivity exists.
They can then determine what the device connects to locally, whether the connection appears in the approved architecture, whether the cellular service remains necessary, and whether the connection is still properly managed and authorized.
That investigation can uncover authorized backup communications, forgotten commissioning equipment, undocumented vendor gateways, unauthorized hotspots, embedded cellular modules, or other communications paths that require additional review.
The value comes from turning an otherwise difficult-to-observe external path into something security teams can find, locate, evaluate, and investigate.
The Network Perimeter Is Not the Only Egress Point
Organizations have invested heavily in controlling communications at the enterprise perimeter. Those controls remain essential, but they govern communications that pass through the infrastructure where those controls operate.
LTE and 5G can place an independent external communications path directly inside a data center, industrial facility, research environment, government facility, or other protected space. Security teams therefore need to understand not only which systems are connected to the managed network, but also where cellular paths exist and what those paths connect to.
A network map describes the infrastructure an organization manages. The wireless environment can reveal communication paths that a map does not show.
Frequently Asked Questions About Cellular Security
What is an out-of-band cellular connection?
An out-of-band cellular connection uses LTE or 5G independently of an organization’s normal wired or Wi-Fi network infrastructure. Embedded modems, cellular gateways, hotspots, and vendor-installed connections can provide this type of connectivity. Because the traffic travels through a mobile carrier, it may not pass through the enterprise network controls that govern the organization’s normal external communications.
Can LTE or 5G bypass enterprise firewalls?
A cellular device does not need to traverse the enterprise perimeter firewall when it communicates directly through a mobile carrier. The firewall may be operating correctly while the cellular connection exists outside its enforcement path. The same principle can apply to other network-based controls such as proxies, network access control, and network detection systems.
Why are embedded LTE and 5G modems difficult to detect?
Embedded cellular radios may exist inside equipment whose primary function has little to do with telecommunications, including industrial systems, building controls, gateways, appliances, and security equipment. The primary asset may appear in an inventory without clearly documenting every communications interface.
What is the risk of a dual-connected system?
A dual-connected system has access to both a protected enterprise or operational network and a separate cellular network. That does not automatically mean the system bridges those networks. However, its configuration deserves closer review because the same device participates in both an internal environment and an independent external communications path.
How can organizations detect unauthorized cellular connectivity?
Organizations can combine asset inventories and network architecture documentation with direct RF observation. RF-derived intelligence can help identify LTE and 5G communications occurring within a facility, determine where associated devices are operating, and compare those observations with approved equipment, locations, schedules, and security policies.