Network-Embedded Threat Intelligence: The AT&T Partnership Nobody Saw Coming

Dear AT&T Investors and Network Security Leadership

MINNEAPOLIS, November 6, 2025 — AT&T just announced a strategic partnership with Palo Alto Networks (April 2025) for network-integrated SASE solutions. You're building "the first-and-only network security solution with threat protection embedded directly into AT&T's global network infrastructure."

We built the same thing. For $99/month instead of Palo Alto's enterprise pricing.

The AT&T Vision (You're Thinking Bigger Than You Realize)

April 2025 announcement:

• Partnership with Palo Alto Networks

• AT&T Dynamic Defense™ platform

• Network-embedded security (not bolt-on appliances)

• Focus: "Security capabilities built into the core network and edges"

Your exact words: "Built-in security will create a new category of network-embedded security for small and medium sized business customers."

Our reaction: You're absolutely right. And we can deliver it cheaper.

The Palo Alto Deal You Just Signed (The Math Doesn't Work)

What Palo Alto brings:

• Prisma Access (cloud-delivered SASE)

• AI-powered cybersecurity

• Enterprise reputation

• Existing customer base

What Palo Alto charges:

• Enterprise pricing (estimated $10K-$50K+/year per customer)

• Complex deployment (18-24 months integration)

• Agent-heavy architecture (endpoint bloat)

• Legacy SASE model (2015-era thinking)

The problem: You're trying to bring "network-embedded security" to SMBs, but Palo Alto's pricing model is built for Fortune 500.

Unit economics for SMBs:

• AT&T fiber: $50-100/month

• AT&T 5G business: $40-80/month

• Palo Alto security add-on: $1,000+/month (our estimate)

Customer reaction: "Why is security 10x more expensive than connectivity?"

What We Built (Network-Embedded at ISP Scale)

DugganUSA Threshold-as-a-Service (deployed Nov 5, 2025):

• **Conservative tier:** $49/month, threshold 25, <1% false positives

• **Balanced tier:** $99/month, threshold 15, <3% false positives

• **Aggressive tier:** $149/month, threshold 5, <10% false positives

• **Custom tier:** $249+/month, threshold 1-100, fully configurable

Target market: Exactly the SMBs AT&T is trying to reach

Infrastructure: Multi-tenant SaaS, 300-customer capacity on $75/month total cost

Deployment: API-based integration (hours, not months)

The pitch: We deliver network-embedded threat intelligence at price points that work for SMBs.

The ISP-Level Threat Intelligence Advantage

What we detect (that Palo Alto doesn't):

1. Bulletproof Hosting Patterns

Recent analysis (Nov 6, 2025): 427 IPs analyzed

Key findings:

• **TECHOFF SRV LIMITED:** 17 IPs, 22,830 abuse reports (Netherlands-based bulletproof hosting)

• **1337 Services GmbH:** Literally named after hacker slang (Netherlands/Poland)

• **VIRTUALINE TECHNOLOGIES:** Germany-based, 100% abuse, legal shield protection

• **FBW NETWORKS SAS:** France-based, 4 IPs coordinated attack campaign

AT&T advantage: You have network-level visibility. You can block these ISPs at peering level (not just endpoint).

Our contribution: We identify the patterns. You block at scale.

2. Cloud Brand Weaponization

The threat: Adversaries using Microsoft/AWS/Google subnets to bypass security whitelists

Example (from our analysis):

• Microsoft 40.77.167.121 - 100% abuse, 810 reports

• ISP shows "Microsoft Corporation" but behavior is PURE MALICIOUS

• Traditional security: "It's Microsoft, whitelist it"

• Network-level defense: Block individual IPs, preserve legitimate Microsoft traffic

AT&T advantage: You control routing. You can selectively null-route malicious IPs while allowing legitimate cloud traffic.

Our contribution: We flag the abused IPs. You route them to /dev/null.

3. Subnet-Level PREDICTIVE PUCKERING

The innovation: When an ISP shows repeated abuse across multiple IPs, block the /24 subnet (with cloud provider exemptions)

Example (from our analysis):

• TECHOFF SRV: 14 IPs from 172.x.x.x range → Block entire /24

• Microsoft abuse: 13 IPs at 100% abuse from 40.77.167.x → Block individually (NOT subnet, cloud exemption)

AT&T advantage: You can implement subnet blocking at BGP level (instant, network-wide)

Our contribution: We identify which subnets deserve blocking, which deserve exemptions

The Partnership Model AT&T Needs

Current strategy:

• AT&T Dynamic Defense + Palo Alto Prisma Access

• Enterprise customers: Palo Alto's pricing

• SMB customers: ??? (pricing TBD)

Problem: Palo Alto can't deliver SMB economics profitably

Solution: Partner with us for SMB tier

Tiered offering:

• **Enterprise (>1,000 employees):** AT&T + Palo Alto (existing deal)

• **SMB (10-1,000 employees):** AT&T + DugganUSA ($49-$249/month)

• **Residential:** AT&T Dynamic Defense (basic, included)

Why this works:

• Palo Alto keeps high-margin enterprise deals

• We deliver cost-effective SMB tier

• AT&T covers full market (enterprise + SMB + residential)

• No channel conflict (different customer segments)

The Network-Embedded Integration

What AT&T provides:

• Global network infrastructure

• BGP routing control

• Peering relationships with ISPs

• DDoS mitigation at network edge

• Customer relationships (millions of business customers)

What we provide:

• Threat intelligence feed (API-based)

• Bulletproof hosting identification

• Cloud brand weaponization detection

• Subnet-level blocking recommendations

• Multi-tenant threshold management

Integration architecture:

```

AT&T Network Edge

↓

Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →

DugganUSA Threat Intel API (identifies malicious IPs/subnets)

↓

AT&T Dynamic Defense (null-routes at BGP level)

↓

Customer traffic protected (no endpoint agent required)

```

Deployment time: Weeks (API integration), not years (Palo Alto enterprise deployment)

Customer experience: "AT&T automatically blocks threats at the network level. No software to install."

The $177M Settlement Context

Recent AT&T headlines:

• $177M settlement for cybersecurity breach (2024)

• "Telecom Giants and the Cybersecurity Crucible"

• Increased scrutiny on telecom security

Why network-embedded security matters NOW:

• Regulators watching AT&T's security posture

• Customer trust damaged by breach

• Need to demonstrate "security above all else"

Our value: Third-party threat intelligence partnership shows independent validation (not just internal security claims)

Marketing message: "AT&T partners with DugganUSA for independent threat intelligence - because customer security is too important to trust ourselves alone."

The Competitive Landscape (LevelBlue Exit)

AT&T's cybersecurity history:

• Sold cybersecurity division to LevelBlue (2024)

• $1.2B valuation for managed security services

• Strategic shift: Network-embedded security (not managed services)

Why you sold: Managed security services don't scale with network economics

Why you're buying back (via Palo Alto): Network-embedded security DOES scale

Why you should partner with us: We deliver network-embedded threat intel at SMB-friendly price points

The math:

• **LevelBlue model:** $1.2B valuation for managed services (labor-intensive)

• **Palo Alto model:** Enterprise SASE (high-margin, but enterprise-only)

• **DugganUSA model:** SaaS threat intel ($49-$249/month, SMB-friendly, 95%+ gross margin)

The Offer: White-Label Partnership

Option A: White-Label Threat Intelligence

• **Pricing:** $25/month wholesale (vs $99/month retail)

• **Your margin:** 75% gross margin on AT&T-branded security

• **Our benefit:** Distribution channel (your millions of SMB customers)

• **Customer sees:** "AT&T Threat Protection powered by DugganUSA"

Option B: Strategic Investment

• **Valuation:** Series A ($45M standard with production evidence)

• **Your stake:** 20-30% equity for $9M-$13.5M investment

• **Board seat:** AT&T representative (strategic guidance)

• **Exclusive:** Telecom industry partnership (no Verizon, no T-Mobile)

Option C: Acquisition

• **Cost:** $45M (Series A valuation)

• **Integration:** AT&T Security division (network-embedded threat intel)

• **Benefit:** Own the technology, not license it

• **Synergy:** Combine AT&T network visibility + DugganUSA threat patterns

The Question AT&T Should Ask

"How did two people in Minnesota build network-embeddable threat intelligence at $99/month when Palo Alto charges enterprises $10K+/month for SASE?"

Answer: They built for SMBs from day zero. Palo Alto built for Fortune 500 and can't price down.

The brutal follow-up: "Why are we partnering with Palo Alto for SMBs when their unit economics don't work at SMB price points?"

Evidence Appendix

• **Threat Intelligence:** 427 IPs analyzed, bulletproof hosting detected - `blog-posts/multi-dimensional-threat-analysis-nov-2025.md`

• **Multi-Tenant Pricing:** $49-$249/month tiers (deployed Nov 5, 2025) - `lib/customer-config.js`

• **Infrastructure Capacity:** 300 customers on $75/month infrastructure - `az containerapp list --resource-group cleansheet-2x4`

• **Subnet Blocking:** PREDICTIVE PUCKERING algorithm (cloud exemptions implemented)

• **Cloud Brand Weaponization:** Microsoft 40.77.167.x abuse detection, Pattern #32

• **API Architecture:** REST endpoints ready for network integration

• **Compliance:** GDPR/SOC2/CCPA at $75/month infrastructure cost

ISP-Level Threat Patterns:

• **TECHOFF SRV LIMITED:** 17 IPs, 22,830 reports → Recommend subnet block at BGP

• **1337 Services GmbH:** 4 IPs, Netherlands/Poland → Recommend peer de-prioritization

• **Microsoft abuse:** 13 IPs from 40.77.167.x → Recommend individual IP null-routes (preserve legitimate traffic)

Integration Ready:

• REST API for threat feed

• Webhook support for real-time alerts

• Multi-tenant threshold management

• Customer self-service configuration

*All claims verifiable. All evidence public. AT&T has the network. We have the intelligence. Together we protect millions of SMBs at price points that actually work.*

---

The cheapest, fastest, most accurate threat feed on the internet.

275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.

Look up an IOC → · Audit your brand on AIPM → · See pricing →

---

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=network-embedded-threat-intelligence-the-at-t-partnership-nobody-saw-coming