A platform (300) is disclosed that enables security monitoring and protection across a plurality of related telecommunications devices. The self-operating security platform of the present invention is based on a collection of security adapters (304) that are tied together and are coupled with an orchestration engine (303) that loads and executes workflow scripts. Workflow scripts have been used for business applications, but their usage in real-time telecommunications devices is relatively new. Each security adapter monitors a different aspect of the system for intrusions or other security threats. The specific security protection rules are taught to the security platform in a basic profile; as the security platform runs, it builds up the actual profile of how the telecommunications device performs in a normal state. In other words, the security platform "composes" new workflow scripts from basic workflow scripts. The self-expanding nature of the workflow enables the telecommunications device to learn the behavioral patterns of its users.