In our prior blog, we shared the strategic journey of how Cisco IT modernized our voice security posture by shifting from reactive, manual processes to a proactive, AI-driven defense. In this blog, we’ll dive deeper into the technical architecture that made this transformation possible.
AI detection alone isn’t enough
As the team responsible for managing Cisco’s global voice environment, we are tasked with protecting millions of calls from the growing threat of toll fraud, robocalls, and spam.
To combat this, we developed an AI/ML-driven nuisance call detection engine. This was a critical initiative for Cisco IT, as the rising volume of toll fraud and spam had become a significant risk and a major drain on employee productivity. This engine uses behavioral analytics and machine learning to flag suspicious call patterns in real time.
While our AI-driven detection engine was a major step forward, we quickly realized that simply identifying these threats was only half the battle. Detection alone does not solve the problem. We needed a way to operationalize the insights provided by this engine and enable IT and security teams to visualize threats, investigate root causes, and take immediate action.
To make these insights actionable at enterprise scale, we needed a platform that could ingest millions of Call Detail Records (CDRs), enrich and correlate data across multiple sources, provide intuitive dashboards for IT and SOC teams, and trigger alerts and automate response workflows.
Splunk Cloud Platform ingests, correlates, visualizes, alerts on, and helps automate response to AI/ML detection outputs in real-time voice security.
The data foundation: Building a scalable voice security pipeline
To turn raw data into actionable intelligence, we first had to build a robust pipeline capable of handling massive volumes of telemetry. Every call produces a CDR containing signals such as calling and called numbers, duration, gateway information, geographic destination, and device identifiers.
We use Splunk for centralized ingestion and normalization. CDRs from Cisco Unified Communications Manager (CUCM), Session Border Controllers (SBCs), and cloud calling platforms, where they are:
- Normalized into a consistent schema
- Enriched with geographic and threat intelligence data
- Correlated with AI/ML risk scores and detection outputs
- Indexed for real-time search and historical analysis
This creates a unified, queryable data layer for voice security. Instead of siloed datasets and manual analysis, we now have a single operational view across millions of calls.
Transforming detection into visibility: Operational dashboards
Once the data was unified, we focused on creating intuitive views that provide an operational narrative. By designing dashboard that support decision-making across operating levels of the enterprise, we ensured that the right information reaches the right person at the right time. Key dashboards include:
- Executive voice security overview: Provides leadership with immediate visibility into enterprise voice security posture, total calls analyzed, high-risk and critical threat volume, fraud trends over time, and detection accuracy.
- Threat trend and behavioral analysis: Visualizes threat patterns across time dimensions, including hourly and daily fraud spikes, off-hours and weekend anomalies, sudden call volume bursts, and behavioral deviations from baseline patterns.
- Geographic threat intelligence view: Maps call destinations to high-risk regions, enabling teams to identify high-risk countries, detect unusual geographic activity, and correlate geographic risk with threat scores.
- Risk-Stratified Threat Investigation Dashboard: Categorizes calls by risk level into critical, high, medium, or low—allowing teams to drill down into high-risk calls, investigate specific numbers or destinations, view contributing risk factors, and analyze historical patterns.
Enabling real-time security operations
Beyond visualization, Splunk enables real-time security operations through automated alerts and workflows:
- Automated alerting and incident response: When high-risk or critical calls are detected, Splunk can automatically trigger alerts to IT and SOC teams, open incident tickets, notify administrators, and initiate automated blocking workflows.
- Cross-domain security correlation: Voice security threats rarely occur in isolation. Splunk enables correlation across voice infrastructure, identity systems, network telemetry, and security events. Now SOC teams are able to detect broader compromise patterns. For example, voice fraud activity correlated with unusual login patterns may indicate credential compromise.
Bridging the gap between AI and operations
By integrating these layers, we created a complete voice security lifecycle that transforms intelligence into action. AI/ML detection provides intelligence—but Splunk provides operational context. Together, they create a complete voice security lifecycle:
- Detection layer (AI/ML): Behavioral anomaly detection, risk scoring, fraud classification
- Operational layer (Splunk): Visualization, investigation, alerting, incident response, and historical analysis
Unlike other point solutions, our integrated Cisco portfolio is uniquely able to combine voice infrastructure telemetry, network insights, and security analytics within the Splunk Cloud Platform—delivering unique cross-domain visibility and automated threat response. This integrated approach has transformed voice security from reactive investigation into proactive defense.
Operational impact: Real outcomes from integration
Our transition from a reactive, manual security model to this proactive, automated framework has delivered measurable business value. By integrating AI/ML detection with Splunk, we improved business resilience, accelerated value realization, and scaled operation while reducing manual investigation effort and achieving a 70% reduction in potential total fraud losses. Key measurable results we’ve seen include:
- Faster threat response: Reduced detection and mitigation time from hours to minutes.
- Proactive Threat Management: Gained a comprehensive, real-time view of our global voice security posture.
- Risk-Based Prioritization: Leveraged automated risk-stratification to focus analyst efforts on the most critical threats, driving a 60% reduction in manual investigation effort.
- Enterprise-Scale Performance: Successfully operationalized the analysis of millions of calls while maintaining system responsiveness.
Beyond the numbers, this integration provided our IT and SOC teams with a comprehensive, real-time view of our voice security posture. Now we don’t just see the call—we see the entire digital context surrounding it, enabling proactive threat management at a scale that supports our growing enterprise environment and strengthens our overall digital resilience.
Voice security modernization as part of enterprise resilience
Modernizing voice security is a part of broader enterprise resilience and infrastructure modernization. Cisco integration of AI/ML-driven nuisance call detection with Splunk shows how operationalizing detection can strengthen visibility, speed response, and reduce fraud exposure.
As you look to modernize your own infrastructure, keep these key technical takeaways in mind:
- Detection alone is not enough—operational visibility is critical
- Centralized data pipelines enable scalable analysis
- Visualization accelerates investigation and decision-making
- Automation reduces response time and operational burden
- Integration with SOC workflows enhances enterprise security posture
The result is faster response, less manual investigation, and lower fraud exposure.
Resources:
- Discover how we identified the core enterprise risks and designed the foundational AI/ML framework that started this security journey. Read Part 1 of this blog series.
- Explore more ways Cisco uses its own technology: Visit Cisco on Cisco