How Türk Telekom's SOC Team Eliminated Tool Fragmentation and Boosted Productivity by 40% with Mattermost

As Türkiye’s largest integrated telecommunications company, Türk Telekom is at the forefront of the country’s digital transformation initiatives. Guided by the principle of “accessible communication for everyone,” the company aims to bring fiber connectivity to every city in Türkiye and already has a fiber network exceeding 550,000 kilometers.

Tracing its roots back to 1840, Türk Telekom serves nearly 57 million customers today, counting both individuals and institutions as subscribers. The company, which has nearly 32,000 employees, holds over 900 patents and is currently focused on innovation across 5G/6G communication technologies, artificial intelligence, and non-terrestrial networks.

Mitigating threats and preventing cyberattacks

At Türk Telekom, the Department of Cyber Attack & Defence performs security operations center (SOC) operations and is responsible for identifying and mitigating threats across cyberspace.

“As an incident response and SOC team, our mission is to proactively detect, respond to, investigate, and prevent cyberattacks,” explains Ömer Berk, incident response specialist at Türk Telekom. “Within the MSSP [managed security service provider] environment, the SOC team provides 24/7 analysis of alerts and detects cyberthreats.”

To fulfil its mission and keep internal and customer networks secure, the department requires tight-knit coordination. Since the team operates on a hybrid, shift-based model, they also need a private searchable knowledge base that enables employees to stay informed about what their colleagues did during the previous shift, keeping the team aligned.

“In cybersecurity operations, tracking tasks and sharing details of each case are crucial,” Berk says. “Each team member must report on and collaborate with colleagues regarding cyber incidents. Team members must also track all tasks against SLA timeframes. Missing those windows is not an option because it directly impacts our clients and puts contracts at risk.”

Finding an enterprise-grade collaboration platform built for security

In 2021, the department was relying on WeKan for kanban-style project management and BookStack for internal wikis, but the tools weren’t built for the security and scale demands of an MSSP environment. To streamline collaboration while strengthening security, the team began evaluating enterprise-grade alternatives.

“We evaluated several collaboration platforms, compared the features of each, and ultimately decided to use Mattermost,” Berk continues, adding that the team opted to self-host Mattermost in their on-premises environment.

Key factors in the decision included Mattermost’s task tracking, kanban-style Boards, secure file-sharing, and extensive integration capabilities — features that mapped directly to the team’s operational requirements, Berk explains.

“Every task and its severity level is documented directly in Mattermost, where colleagues share updates across Channels and Boards so that other team members can acknowledge them,” Berk says.

Türk Telekom ultimately deployed two separate Mattermost servers — one for the in-house team and another for the MSSP team — to maintain clear operational boundaries between internal and client-facing operations.

Accelerating SOC workflows, increasing productivity 40%, and improving operational resilience

For the last five years, Türk Telekom has been using Mattermost to power day-to-day work. Team members use Mattermost to track tasks via Boards and Channels, securely share files and reports, collaborate with team members via real-time audio and screen sharing through Mattermost Calls, and manage projects by creating channels for related tasks.

“Mattermost gives teams a single place to share important information, which saves time, accelerates business processes, and boosts workplace productivity,” Berk says.

Since adopting Mattermost, the department has cut duplicate communications and redundant email threads by 30%. All operational details are stored securely in Mattermost and are instantly searchable — giving SOC professionals the full context they need at the start of every shift.

“Daily tasks are easily tracked via Mattermost,” he adds. “Every day, team members add details about the actions they take on cases. It makes it much easier to communicate with colleagues.”

In addition to productivity gains, Mattermost also keeps the team’s work in one place, eliminating the constant context switching between disconnected tools that fragments focus and slows response times. The company has also been able to increase control over their sensitive collaboration data while speeding up crisis management — improving operational resilience.

“Mattermost has become central to how our department handles incident response and security workflows,” Berk says. “Critical reports, case details, and investigative findings all flow through Mattermost, and our department also has private conversations there, too. Having a single, shared channel for incident response and security workflows has driven productivity gains of 40% or more.”

Looking ahead, AI integration is next on the roadmap.

“We plan to integrate Mattermost with security tools and AI frameworks to enable autonomous, intelligent response actions,” he says. “Our future plans also include leveraging AI for incident triage, alert prioritisation, and automated response mechanisms to reduce response times and improve operational efficiency. We also aim to integrate AI-supported knowledge management to better utilise historical incident data and strengthen decision-making across teams.”

“We definitely recommend Mattermost to other organisations,” Berk concludes. “It’s the only platform that enables secure collaboration via channels and real-time audio in an on-premises environment.”