TECHNICAL BRIEFING · MARCH 2026

From Reactive
Event Correlation
to Autonomous
State Management.

A proprietary technical briefing on the AI-Centered Network paradigm — Bankhosa's architectural framework for embedding Tier-5 intelligence directly into the network control plane. Not a tool. Not a dashboard. An inlay.

BN

Bheki Ntando Ngwenya

FOUNDER & MANAGING DIRECTOR · BANKHOSA · SANDTON

Apply for 2026 Pilot →Contact Bheki
ACN COREBGPOSPFMPLSISISVLANQoSSNMPSYSLOGCONTROL PLANE INLAYSTATESTABLEJITTER0.18msTICKETS0

R58B+

SADC telecoms CAPEX

Annual addressable spend

5,847

Duplicate tickets

From a single BGP flap

99.999%

Target SLA uptime

Bankhosa ACN baseline

<1ms

Detection to action

Layer 1–2 Verifier + Reasoner

0

Consulting bill

Refinery SLM replaces your ontology team

01
EXECUTIVE SUMMARY

The AI Wall.
Why It Exists.
Why It Persists.

South African ICT infrastructure investment has accelerated dramatically over the past decade. Subsea cable capacity has expanded. Regional fibre density has increased. Enterprise WAN complexity has grown. And in response, a new category of tooling emerged — AIOps.

The promise was compelling: feed your network logs into an AI platform, and it would autonomously detect, diagnose, and resolve faults before they became outages. Vendors invested. IT teams integrated. And then — in production — the systems failed to deliver.

Not because the AI was wrong. Because the data it was trained on was rotten. Because the architecture it was layered onto was fundamentally unsuited to intelligence. The AI was being asked to reason from noise.

THE BANKHOSA THESIS

The problem is not the AI. The problem is the architecture. Fix the architecture — embed intelligence into the control plane rather than layering it on top — and the AI performs exactly as promised.

VISUALISATION · THE AI WALL PROBLEM

AI WALLINVESTMENTAIOps PlatformR millionsMonitoring ToolsR millionsConsulting FeesR millionsIntegration WorkR millionsOUTCOMESUnmet SLAsAlert fatigueMissed root causesManual firefightingMore investment...ROOT CAUSE: ARCHITECTUREBANKHOSA SOLVES THIS
Network infrastructure

SA INFRASTRUCTURE · THE CONTEXT

MARKET CONTEXT · SOUTH AFRICA

Primary targetsSeacom · Herotel · Liquid Telecom
Failure patternAlert Fatigue — 5,000+ tickets
Root causeData silos + overlay AI architecture
AIOps spendMillions per large provider, annually
Bankhosa answerArchitectural Inlay. Not a tool.
02
THE PROBLEM

Why Million-Rand
Automation Fails.
Three Fatal Flaws.

Through direct observation of large-scale infrastructure deployments across South Africa, Bankhosa has identified the three architectural failures that cause every major AIOps deployment to underperform or collapse entirely.

A
TIME →FAULTOCCURST+0OVERLAYDETECTST+14minSLA BREACHEDACN DETECTS+ ACTST+0.001sOVERLAYACN INLAYSLA ZONEOVERLAY TRAP · DETECTION LAG
FATAL FLAW A

The Overlay Trap

Traditional AIOps tools are architectural overlays. They sit entirely outside the network fabric, consuming logs and events that have already been generated — which means they are, by definition, always operating on historical data.

By the time an overlay system has ingested a log, correlated it with past events, classified the anomaly, and generated an alert — the failure has already propagated. The SLA is already breached. The engineer is already firefighting.

DETECTION LAG

Minutes

SLA STATUS

Breached

FATAL FLAW B

The Garbage In, Garbage Out Silo

In virtually every large South African infrastructure provider, Network Operations, Security Operations, and IT Support functions operate in complete data isolation. Each team uses different logging formats, different severity classifications, different ticketing systems.

When an AI system attempts to correlate across these silos, it creates what Bankhosa calls "Alert Fatigue" — a cascade of thousands of similar-looking tickets from a single underlying fault, burying the root cause beneath thousands of duplicates.

OBSERVED PATTERN

One BGP session flap → 5,847 open tickets generated across three siloed systems. Root cause buried on page 47 of the ticket queue.

BGPFLAPNET OPS1,923TICKETSSEC OPS2,108TICKETSIT SUPPORT1,816TICKETS5,847 TICKETSONE ROOT CAUSEDATA SILO · ALERT FATIGUE
B
C
GENERIC GLOBALRULESETSATOPOLOGYMISMATCHLoad-shedding topologyIX peering SA-specificICASA constraintsRegional fibre economicsREQUIRES LOCALEXPERTISEFORCED AUTOMATION · WRONG RULES
FATAL FLAW C

Forced Automation vs. User Insight

Legacy AIOps deployments arrive with generic business rules developed for a global average customer — not for the specific topology, regulatory environment, and operational realities of South African infrastructure.

These systems ignore the institutional knowledge of the engineers who have managed the network for years. They override the "boots on the ground" insights that no generic ML model could ever replicate — and in doing so, they fail in exactly the edge cases that matter most.

03
THE ARCHITECTURE

The Bankhosa ACN
Architecture.
Four Layers. One Intelligence.

Where Palantir needs 6–18 months of forward-deployed consultants to build your data ontology, and Databricks needs a dedicated engineering team to stand up its medallion pipeline — Bankhosa's architecture builds itself. No consulting bill. No professional services ramp.

A dual-layer intelligence framework — Inlay embedded in the control plane, Overlay closing the loop for humans — unified across four autonomous layers from raw data to governed action.

No Consultants. No Ontology Team. Just Clean Data.
THE REFINERY · SLM-DRIVEN DATA UNIFICATION

QUICK SPEC

ReplacesPalantir FDE consultants + Databricks pipeline engineers
InputRaw silos: tickets, telemetry, logs, routing data
30 YEARS FIELD EXPERIENCEFAILURE PATTERN LIBRARYSA TOPOLOGY KNOWLEDGECODIFIED PROTOCOLSACN LOGICSPEED OF LIGHT30YEARSCODIFIED GOLDEN LOGIC
LAYER 0

No Consultants. No Ontology Team. Just Clean Data.

Palantir Foundry requires a team of forward-deployed engineers — often 6 to 18 months of professional services — to build your data ontology before a single insight is produced. Databricks demands dedicated medallion pipeline engineers to refine raw data through bronze, silver, and gold layers.

Bankhosa replaces both with a specialised Small Language Model trained to ingest scattered, corrupted silo data — legacy tickets, raw telemetry, unstructured logs, routing tables — and output a unified, structured, continuously refreshed data layer. No consulting bill. No ramp time. The Refinery builds your ontology automatically and keeps it current.

OUTCOME

The same SLM that structures data for the network also structures data for banking cores — legacy system unification without a consulting army.

REPLACES

Palantir FDE consultants + Databricks pipeline engineers

INPUT

Raw silos: tickets, telemetry, logs, routing data

OUTPUT

Unified, queryable, continuously refreshed data layer

COST DELTA

Zero professional services. Zero ongoing licence.

Hallucination-Proof Intelligence at the Network Edge.
THE VERIFIER + REASONER · EDGE SLM + LLM

QUICK SPEC

Layer 1 roleEdge SLM — ground-truth verification + security anomaly detection
Layer 2 roleLLM Reasoner — causal decision-making on verified data
MESSY INPUTSYSLOGunstructuredSNMP TRAPSvaried schemaNETFLOWraw bytesTICKETINGfree textAUDITBREAKUNIFYPURETRUTH100%ACCURATECLEAN DATA FIRST · FOUNDATIONAL OVERHAUL
LAYER 1–2

Hallucination-Proof Intelligence at the Network Edge.

A second, lightweight SLM sits at the network edge — inside the Inlay — cross-checking what the LLM Reasoner believes is happening against live ground-truth telemetry before any action is taken. This is the hallucination guard that cloud-based platforms structurally cannot provide: they don't have eyes inside the control plane.

The LLM Reasoner then operates on verified, clean context — making routing decisions, traffic shaping calls, and anomaly classifications with causal reasoning, not correlation. This dual-SLM architecture is also what powers our security offering: the Verifier SLM reading packet metadata for fault prediction uses the same anomaly-detection primitives for lateral movement and DDoS pattern recognition.

OUTCOME

Security monitoring is the same model, different training labels — near-zero marginal cost, real managed detection and response revenue.

LAYER 1 ROLE

Edge SLM — ground-truth verification + security anomaly detection

LAYER 2 ROLE

LLM Reasoner — causal decision-making on verified data

SECURITY OUTPUT

Real-time threat alerts, step-up auth triggers, session isolation

LATENCY

<1ms end-to-end detection-to-action

Full Autonomy for Routine Faults. Governed Escalation for High-Stakes Decisions.
THE GOVERNOR · AUTONOMOUS ACTION + AUDIT

QUICK SPEC

Default modeFully autonomous — no human in the loop
High-risk actionsPolicy-governed escalation, configurable per operator
NORMALSTATEJITTERDETECTEDPRE-FAULTPREDICTEDHEALINGACTIVERESOLVEDZERO-TOUCH<1msRESPONSE0 TICKETS · ZERO-TOUCHAUTONOMOUS STATE MANAGEMENT
LAYER 3

Full Autonomy for Routine Faults. Governed Escalation for High-Stakes Decisions.

Every ACN decision executes autonomously — rerouting, traffic shaping, configuration optimisation — preserving the sub-millisecond response that SLA protection demands. The Governor logs every action immutably, with a human-readable audit trail that satisfies regulatory and stakeholder requirements without slowing the system down.

For a defined class of high-blast-radius decisions — large-scale reroutes, financial settlement routing changes, cross-segment topology shifts — the Governor applies configurable approval policies. These can themselves be automated: approve if confidence exceeds 95% and blast radius is below threshold. This is governance without bureaucracy. The opposite of Palantir's human-heavy operational review model.

OUTCOME

Full autonomy where it matters for speed. Human-policy governance where it matters for trust. Never a meeting in the loop.

DEFAULT MODE

Fully autonomous — no human in the loop

HIGH-RISK ACTIONS

Policy-governed escalation, configurable per operator

AUDIT TRAIL

Immutable, human-readable, regulatorily compliant

OVERLAY ROLE

Closes the loop — auto-resolves tickets, updates NOC dashboard

04
STRATEGIC ADVANTAGES

Built for Infrastructure
Leaders.
Not Followers.

For Seacom, Herotel, and the infrastructure leaders who move South Africa's data — the Bankhosa ACN offers three competitive edges that no conventional AIOps platform can structurally deliver.

CAPABILITY COMPARISON · RADAR

LOCK-INOPEXSLASADATADETECTIONACN INLAYCONVENTIONALSTRATEGIC ADVANTAGES · RADAR

The radar chart above compares Bankhosa ACN against conventional AIOps across six critical dimensions. Every axis represents a capability that infrastructure leaders require — and where conventional tools structurally cannot compete.

LOCK-IN FREEDOM

ACN: Complete — you own the IP permanently

Conv: Zero — data and logic locked to vendor

OPEX REDUCTION

ACN: Expert layer automated — engineers freed

Conv: Partial — still requires manual oversight

SLA PROTECTION

ACN: Predictive — before failure is visible

Conv: Reactive — after SLA already breached

CAPABILITY
CONV. AIOPPS
PALANTIR / DATABRICKS
BANKHOSA ACN
Architecture
Overlay — outside network
Cloud platform — not on-device
Inlay — embedded in control plane
Data unification
Works on any data (poorly)
6–18 months FDE consultants to build ontology
SLM Refinery builds it automatically, continuously
Setup cost
Subscription + integration
Millions in professional services before value
Zero consulting bill. Zero ramp time.
Fault detection
Reactive — after failure
Near-real-time analytics, not sub-ms
Predictive — before failure, <1ms
Security
Separate SOC tooling required
Separate security product / module
Native — same Verifier SLM, different labels
Banking / legacy core
Not applicable
Expensive lift-and-shift consultancy
Sidecar Refinery — no rip-and-replace needed
Vendor lock-in
High — vendor owns logic + data
High — platform and ontology dependency
Zero — client owns 100% permanently
Recurring cost
Subscription scales with growth
Licence + support + FDE ongoing
Zero on delivered IP
SA / SADC fit
Generic global ruleset
Generic — no SADC-native training
SADC-native SLMs, localised topology logic
A. Zero Vendor Lock-In

A. Zero Vendor Lock-In

Most SaaS providers keep your data, your logic, and your institutional knowledge locked inside their platform. Bankhosa operates on a fundamentally different principle: People are Kings. Everything we build becomes your property permanently. No recurring subscription. No exit tax.

B. Radical OPEX Reduction

B. Radical OPEX Reduction

By automating the Expert Layer — high-skill tasks that currently require your best engineers on call — and eliminating the Palantir-style consulting engagement, ACN delivers operational savings from day one. Your engineers refocus on architecture and growth.

C. Predictive SLA Protection

C. Predictive SLA Protection

In the high-stakes world of subsea cables and regional fibre, downtime is debt, reputational damage, and contractual penalty. ACN provides a Predictive Shield — identifying micro-patterns that precede core failure and acting before any visible impact reaches your customers.

D. Native Security Intelligence

D. Native Security Intelligence

The same Verifier SLM reading packet metadata for fault prediction uses identical anomaly-detection primitives to identify DDoS patterns, lateral movement, and intrusion signatures. Security monitoring is not a separate product — it is a native output of the Inlay. AI-augmented detection with human escalation for novel threat patterns.

E. Banking & Legacy Core Modernisation

E. Banking & Legacy Core Modernisation

Banks spend 78% of IT budgets maintaining legacy cores. The Refinery SLM is designed for exactly this environment — ingesting fragmented legacy data and unifying it without rip-and-replace. Bankhosa enters banking as a sidecar intelligence layer, not a core migration project. Telecoms is the beachhead. Banking is the expansion.

05
THE 2026 PILOT

One Strategic Partner.
Architectural Truth.

Bankhosa is identifying one infrastructure organisation for a 2026 Pilot Deployment. Not a trial. Not a proof of concept with synthetic data. A live deployment on a sub-section of a real production network.

We are looking for an organisation that is tired of AI hype, has experienced the limitations of conventional AIOps, and is ready for ground-truth architectural change.

01

Silo Diagnostic

Deep-dive audit of current data ingestion and fault-logging bottlenecks. We map where data rots before the AI ever sees it.

02

Logic Inlay

Deployment of our proprietary ACN Control Plane on a sub-section of the core network — live data, real conditions.

03

Silent Architect Oversight

24/7 monitoring by our Tier-5 engineering board throughout the pilot. Zero-risk integration guaranteed.

DEPLOYMENT TIMELINE · VISUALISATION

KICKOFFWk 1SILO DIAGNOSTICWks 2–4LOGIC INLAY + OVERSIGHTWks 5–10Wk 11DATA MAPSILO REPORTACN LIVEFULL IPONE PARTNER · 2026 COHORTPILOT DEPLOYMENT · 11 WEEKS
Infrastructure deployment

PRODUCTION-GRADE DEPLOYMENT · NOT SYNTHETIC

PILOT SCOPE

Sub-section of core network. Live production data. Real conditions.

PARTNERS

1

Exclusive. 2026 cohort only.

IDEAL PARTNER PROFILE

Large SA infrastructure provider — ISP, subsea, fibre, or enterprise WAN

Financial institution running legacy core systems with fragmented data architecture

Currently experiencing AIOps underperformance, alert fatigue, or security blind spots

Leadership committed to architectural change — not another dashboard fix or consulting engagement