What goes wrong with company SIMs
Four kinds of misuse that are easy to miss on a monthly bill.
Ghost usage
A SIM that should be idle keeps using data.
Example signal: Night data on an idle SIM
Unauthorized sharing
One SIM is used by more people or devices than it should be.
Example signal: Several devices in one day
Data reselling
Heavy data use that looks like the bundle is being sold on.
Example signal: Hotspot use far above peers
Inactive billing
The company keeps paying for a SIM that nobody uses.
Example signal: Billed every month, never used
How detection works
Four checks run on every SIM, from its own usage to similar past cases.
Behaviour check
Usage patterns that stand out from normal use are picked up.
Isolation Forest
Peer comparison
Each SIM is compared with other SIMs on the same tier.
Cohort Z-score
Risk triage
Each case is flagged, sent for review or cleared by its risk score.
XGBoost
Similar cases
Past cases that look alike are shown to help the reviewer decide.
Case based reasoning
Why it fired
Every alert lists its top reasons, so you can check it before acting.
Why it fired
Results from testing
How well the detection models performed in our tests.
Auto flag precision
98%
Of the SIMs flagged automatically, about this share were real misuse.
Recall by misuse type
89 to 94%
The share of each misuse type that was caught, from lowest to highest.
Misuse types
4
Ghost usage, sharing, reselling and inactive billing.
Measured on synthetic test data.
A look inside the app
Three screens from SimGuard, shown with sample data.
See flagged SIMs, unused data and tier changes across the whole fleet.
Open any SIM to see its user, plan, usage and risk.
Work through alerts by risk, with the type of misuse for each one.
Who it is for
The teams that pay for, manage and secure company SIMs.
Fleet manager
- See which SIMs are idle, shared or over their plan.
- Move SIMs to the tier that fits their use.
Finance
- Find SIMs that are billed but never used.
- Check data spend by department in KES.
IT and security
- Review flagged SIMs with their top reasons.
- Trace every change in the audit log.
People stay in control
Alerts guide the work, and a person makes every decision.
Human review before action
No SIM is suspended on a score alone.
Audit log of every change
Who changed what, and when.
Roles and access control
People see only what their role allows.
Kenyan formats
+254 numbers, KES amounts and Nairobi time.
Frequently asked questions
Short answers about data, alerts and accuracy.
What data is needed?
A list of SIMs with their users, departments and tiers, plus usage records for data, voice and SMS.
How are alerts decided?
Each SIM is checked against normal use and against SIMs on the same tier. A risk model then flags it, sends it for review or clears it.
Can it be wrong?
Yes. Some alerts will be false and some misuse will be missed. That is why a person reviews alerts before any action.
Who reviews alerts?
A fleet manager or security reviewer opens the alert, checks its top reasons and similar past cases, then decides what to do.
Is data kept private?
SIM, employee and usage records stay in the SimGuard database. Access depends on each user's role, and every change is logged.
What is the accuracy based on?
Tests on synthetic data built to look like real SIM usage, with known misuse cases. Results on real company data may differ.
Take control of your SIMs.
Register and see it on your own SIMs.