The security question has moved beyond the radio network
5G cybersecurity is no longer just a telecom operator issue, and it is not limited to the radio access network. As standalone 5G, private wireless, network slicing and edge computing mature, the main security questions increasingly sit in cloud-native core networks, APIs, identity systems, virtualized infrastructure, supplier risk and operational monitoring. The attack surface is broader than in earlier mobile generations. At the same time, 5G offers stronger built-in security options when they are correctly deployed, configured and governed.
For enterprises, the practical point is straightforward: 5G should be assessed as critical digital infrastructure, not as a faster version of Wi-Fi or 4G. NIST, CISA, NSA, ENISA, 3GPP and industry mobility reports all point in the same direction. Secure deployment depends on standards-based 5G features, but also on disciplined cloud security, zero trust, supply chain oversight and incident response controls. More coverage of related risk areas is available in the RoadsNews Cybersecurity section.
What changed as 5G adoption moved into standalone networks
Early 5G deployments often used non-standalone architecture. In that model, 5G radio access added capacity while important control functions still depended on 4G infrastructure. Standalone 5G is different. It uses a 5G core, service-based architecture and cloud-native network functions. This shift enables capabilities such as network slicing, more granular quality of service and new enterprise use cases, but it also moves more security dependency into software, orchestration, APIs and cloud operations.
The scale of deployment makes the issue urgent. Ericsson’s June 2026 Mobility Report said global 5G mobile subscriptions passed 3.1 billion in the first quarter of 2026 after 162 million additions in that quarter. The same report said more than 390 service providers had launched commercial 5G services, with more than 90 offering 5G standalone. It also reported that 5G networks carried 48% of all mobile data traffic at the end of 2025 and forecast that share to rise to 85% by the end of 2031.
Those figures matter for security because 5G is becoming the default network layer for consumer traffic, fixed wireless access, industrial IoT, public safety use cases and enterprise connectivity. A vulnerability in a 5G environment may affect not only mobile subscribers, but also connected factories, transportation systems, healthcare devices, energy sites, retail operations and cloud-connected edge workloads.
The main 5G cybersecurity risks to watch
Cloud-native core risk
Modern 5G cores rely heavily on virtualized and containerized network functions. This brings telecom systems closer to enterprise cloud and DevOps environments, where familiar weaknesses can become network-impacting issues. Insecure images, excessive privileges, weak secrets management, vulnerable APIs and incomplete logging are not just IT concerns when they sit inside the core network environment. NIST’s NCCoE 5G Cybersecurity project specifically focuses on securing the full hardware-to-software stack and on combining 5G standards-based capabilities with cloud infrastructure controls.
Service-based architecture and API exposure
The 5G core uses service-based architecture, allowing network functions to communicate through service interfaces. That design creates flexibility, but it also raises the importance of API discovery, authentication, authorization, encryption, rate limiting and anomaly detection. A poorly governed API can become a control-plane risk, especially where telecom systems integrate with enterprise applications, roaming partners, edge services or third-party management platforms.
Network slicing isolation
Network slicing allows operators to create logical network segments for different users, services or performance needs. In principle, this can improve isolation. In practice, CISA and NSA guidance has warned that slice security depends on correct design, deployment, monitoring and lifecycle management. Misconfigured shared infrastructure, weak slice management controls or insufficient monitoring can undermine the confidentiality, integrity or availability expected from a slice.
Supply chain and vendor dependency
5G systems include radio equipment, core software, cloud platforms, orchestration tools, endpoint modules, SIM or eSIM provisioning systems and management interfaces. CISA’s 5G materials have consistently highlighted supply chain risk, including the possibility of malicious or inadvertent vulnerabilities in hardware, software, components, manufacturing processes and maintenance procedures. For buyers, supplier trust is not a slogan. It is a technical control area covering update integrity, vulnerability handling, secure development, access governance and contractual accountability.
Private 5G operational gaps
Private 5G networks can give enterprises dedicated coverage, predictable performance and stronger control over operational technology connectivity. They also move some telecom-like responsibilities into enterprise environments. Organizations adopting private 5G need to manage identities, SIM lifecycle, device onboarding, radio planning, local core infrastructure, edge applications, monitoring, patching and incident response. Security teams that treat private 5G as a black box may miss critical dependencies.
Security improvements are real, but they are not automatic
5G includes important security and privacy improvements compared with earlier mobile generations. NIST’s 5G cybersecurity white paper series covers capabilities such as protecting subscriber identifiers with SUCI, hardware-enabled platform integrity, reallocation of temporary identities, network security design principles and initial Non-Access Stratum message security. These features can reduce exposure to some historic mobile-network weaknesses, but they do not remove operational risk.
The main limitation is implementation. A network may support strong 5G features while still being exposed through weak cloud hardening, legacy interworking, roaming dependencies, device misconfiguration or insufficient monitoring. 3GPP Release 18, the first 5G-Advanced release, included security and privacy work such as enhancements related to verticals, the 5G core and mission-critical services. The 3GPP portal listed Release 18 as frozen with a June 21, 2024 closure date and Release 19 as frozen with a December 12, 2025 closure date. Standards progress provides a foundation, but operators and enterprises still have to configure, test and govern the deployed system.
| Security shift | Why it matters | Control priority |
|---|---|---|
| Standalone 5G core | More functions run as software on cloud-native infrastructure. | Harden containers, hosts, orchestration, secrets and management planes. |
| Network slicing | Logical segmentation depends on shared resources and correct lifecycle controls. | Validate slice isolation, logging, policy enforcement and change management. |
| Open APIs and service interfaces | Network functions and partners communicate through more programmable interfaces. | Apply strong authentication, authorization, encryption and API monitoring. |
| Private 5G | Enterprises inherit telecom-style operational duties. | Define ownership for device identity, patching, monitoring and incident response. |
| Supply chain concentration | Equipment, software and managed services may create hidden dependency risk. | Assess vendor security, update integrity, access controls and vulnerability disclosure. |
Recent telecom intrusions changed the risk conversation
The broad telecommunications espionage campaign publicly discussed by CISA, NSA, FBI and partner agencies in December 2024 reinforced a hard lesson: attackers do not need to defeat the theoretical security model of 5G if they can persist in routers, management systems, lawful access environments, legacy infrastructure or poorly monitored network segments. The joint guidance urged communications providers to improve visibility, hardening and traffic protection across infrastructure.
That episode was not simply a 5G story, but it is highly relevant to 5G cybersecurity. Modern telecom networks are interconnected systems. 5G cores, transport networks, management platforms, enterprise integrations and legacy systems can all become part of the path an attacker uses. For security leaders, the lesson is to avoid treating 5G as an isolated domain. Controls should extend across the whole communications environment, including identity, privileged access, configuration management, logging, network detection and third-party access. See also: AI.
The policy response has also remained unsettled. In January 2025, the U.S. Federal Communications Commission adopted a declaratory ruling and proposed rulemaking related to telecom cybersecurity obligations following Salt Typhoon-related concerns. Later in 2025, the FCC moved away from that broad approach and emphasized more targeted measures and government-industry collaboration. The details matter for carriers, but the enterprise lesson is simpler: regulatory expectations may shift, while the technical need for resilient communications security remains constant.
How enterprises should assess 5G cybersecurity before deployment
Organizations evaluating private 5G, edge-connected 5G applications or carrier-managed 5G services should ask more specific questions than whether the network is 5G. The security posture depends on architecture, operating model and accountability.
- Clarify the architecture. Determine whether the service uses standalone 5G, non-standalone 5G, a private core, a shared carrier core or hybrid arrangements.
- Map sensitive data flows. Identify what data travels over the 5G network, where it is processed, where it is logged and which systems can access it.
- Validate identity controls. Review SIM or eSIM lifecycle management, device onboarding, certificate use, privileged access and administrative authentication.
- Examine cloud hardening. For private or managed cores, check container security, host integrity, secure boot, image provenance, secrets handling and patch processes.
- Test segmentation claims. If network slicing or dedicated APNs are used, validate isolation through technical testing, not only diagrams or service descriptions.
- Review monitoring coverage. Ensure logs and alerts cover radio, core, transport, edge, management and enterprise integration points.
- Set incident roles in advance. Define who investigates, who can isolate devices, who contacts the carrier and how evidence is preserved.
NIST’s March 18, 2025 initial public draft of SP 1800-33A is useful because it frames 5G cybersecurity as a combination of standards-based 5G capabilities and supporting cybersecurity practices. ENISA’s 5G Security Controls Matrix, published in May 2023, is also useful for mapping controls to network domains and policy objectives. Neither should be read as a one-click checklist. They are better used as reference models for building a risk assessment that matches the organization’s architecture.
What security teams should prioritize next
The near-term priority is not to wait for perfect 5G maturity. It is to bring 5G into existing cyber risk management with enough telecom-specific detail to avoid blind spots. Boards and security leaders should know which business processes depend on 5G, whether those connections are carrier-managed or privately operated, and what happens if a core function, management interface or edge site is compromised.
Security teams should also track standards and guidance changes. As of September 6, 2026, the NCCoE 5G Cybersecurity project page listed NIST CSWP 36F on initial Non-Access Stratum message security as available for public comment through September 7, 2026, while several related CSWP 36 papers were listed as final. That timing shows that 5G security guidance is still evolving even as deployments scale.
For most enterprises, the most valuable action is to integrate 5G into three existing programs: cloud security, third-party risk management and operational resilience. Cloud security covers the virtualized core and edge workloads. Third-party risk covers carriers, integrators, equipment vendors and managed service providers. Operational resilience covers incident response, backup connectivity, failover, monitoring and recovery. When those programs include telecom-specific controls, 5G becomes easier to govern.
Frequently asked questions
Is 5G more secure than 4G?
5G includes stronger security and privacy capabilities, including better support for subscriber identity protection and more modern core-network design. However, it is not automatically safer in every deployment. Security depends on whether standalone features are used, how cloud infrastructure is hardened, how devices are managed and how well the network is monitored.
What is the biggest 5G cybersecurity risk for enterprises?
The biggest practical risk is unclear ownership. In private or hybrid 5G deployments, enterprises may assume the carrier or integrator handles security, while the provider may assume the customer manages endpoints, applications and local access. Clear responsibility for identity, patching, logging, segmentation and incident response is essential.
Does network slicing guarantee isolation?
No. Network slicing can support isolation, but it does not guarantee it by default. Security depends on correct slice design, policy enforcement, shared infrastructure controls, monitoring and lifecycle management. CISA and NSA guidance treats slicing as a capability that must be secured, not as a substitute for security architecture.
Should private 5G be managed by the network team or the security team?
It should be jointly governed. Network teams understand coverage, performance and radio operations. Security teams understand identity, access, logging, vulnerability management and incident response. Private 5G touches both domains, so governance should include IT, security, operations, legal, procurement and the business owner of the connected process.