Network-Scale AI Threat Detection for ISPs, Routers, and Mobile Apps

BlackDice Cyber is a UK cybersecurity company headquartered in Leeds that sells to telecommunications operators, ISPs, MVNOs, and financial institutions rather than directly to end users. Its customers resell or embed the protection for their own subscribers, covering residential broadband households, their connected and IoT devices, and retail banking customers. The company has expanded into Malaga, Spain and signed regional partnerships, including a 2026 agreement with Mercurius covering telecoms and financial institutions in Chile and Brazil.

All three product tiers run on the same federated AI engine, BlackDice IQ, so a customer can move up a tier without re-platforming. The Mobile SDK embeds behavioral intelligence into an operator's or bank's existing app, producing session risk scores, device integrity and rooted-device signals, malware detection, and scam call and SMS phishing flags. DNS Protect blocks malicious domains across a full subscriber base with no hardware dependency. Halo CPE embeds a firmware agent in existing routers via TR-069/369 or containers.

Halo CPE is the deepest tier: full deep packet inspection, protection for unmanaged IoT devices that cannot run an agent, and zero-day behavioral detection, delivered without replacing router hardware. Operators get the Retina analytics console and a white-label subscriber app called Angel. The fraud use cases are specific to how attacks now work: authorized push payment fraud, where authentication passes because the customer initiates the payment, is caught from surrounding behavior such as an active remote access session.