"Mastering Security in 5G and 6G: Challenges and Solutions"

5G is now a mature, mainstream technology, and 6G is being standardized for commercial launch around 2030. According to Ericsson's June 2026 Mobility Report, global 5G subscriptions passed three billion in Q1 2026 and are forecast to more than double to 6.4 billion by 2031, with 5G networks carrying an estimated 48% of all mobile data traffic at the end of 2025. 5G's architecture, combining new radio frequencies, small cells, beamforming, and network slicing, supports everything from smart cities to autonomous vehicles and massive IoT deployments. 6G, now under active standardization in 3GPP Release 20 and 21, will go further. It is expected to be AI-native and agentic by design, with integrated sensing and communication (ISAC), terahertz-frequency bands, and seamless integration of terrestrial and satellite networks. The first implementable 6G specifications are targeted for completion by the end of 2028 or early 2029, with commercial services expected around 2030. As with earlier generations, the progression from 5G to 6G is driven by the pursuit of higher performance, energy efficiency, and user-centric services, but each step also widens the security surface that operators and users must protect.

5G delivers three defining capabilities: ultra-low latency, high throughput, and massive connectivity. Latency can drop below one millisecond, enabling real-time applications like remote surgery and critical infrastructure control, while capacity supports millions of connected devices simultaneously, which is essential for IoT. 5G now underpins commercial differentiated-connectivity services built on network slicing, with Ericsson counting 84 commercial network-slicing service offerings by mid-2026, up from 65 in late 2025. 6G will extend these features further. Expect data rates and capacity well beyond 5G, an AI-native air interface, integrated sensing, and support for immersive and holographic communications. Critically, 6G is designed to be quantum-safe and AI-native from the ground up, incorporating enhanced security as a first-class feature rather than an afterthought. The shift toward AI-native networks also means security must address not just data and infrastructure, but the AI models and agents that increasingly manage the network itself.

5G is already transforming industries. In healthcare it enables remote patient monitoring, telemedicine, and robotic-assisted surgery where latency is life-critical. In transportation it powers V2X (Vehicle-to-Everything) communication that is bringing autonomous vehicles closer to reality. In manufacturing and industry, 5G private networks and network slicing deliver the reliable, low-latency connectivity that industrial automation and IoT require. Looking to 6G, the applications become even more ambitious. Holographic communication could make remote meetings feel physically present, integrated sensing and communication will let networks perceive their environment, and AI-native design will support distributed autonomous agents across devices, vehicles, and cities, a shift Ericsson's CTO calls the transition to physical AI. Cloud gaming, immersive mixed reality, and hyper-connected smart infrastructure all stand to benefit. As these applications multiply, so too does the security burden: each new use case brings new data flows, new trust boundaries, and new attack surfaces that operators and enterprises must defend.

The ecosystem around 5G has blossomed into a web of operators, technology vendors, device makers, and vertical-industry partners. More than 390 operators have launched commercial 5G, with over 90 running standalone (SA) cores, and Ericsson reports that commercial network-slicing offerings are moving from early adoption to mainstream commercialization. 6G is attracting an even larger ecosystem integrating AI, edge computing, and integrated sensing, with coordination across standards bodies including 3GPP, ETSI, and the ITU. The European Commission's 5G Observatory notes that EU 5G coverage is close to full at 96.8% of households, though standalone deployment lags other regions, with 5G SA at only 20.9% of EU base stations versus 36.2% in the US and 34.8% in China. As 6G approaches, this ecosystem will need coordinated security standards, supply-chain resilience, and investment to protect innovation. The dynamics of this evolving landscape will shape not just connectivity but the security of everything that runs on these networks.

5G and 6G networks face security challenges that go beyond those of earlier generations. The core enabler of 5G, network slicing, lets operators segment a physical network into many logical networks with distinct service-level agreements, but it also introduces cross-slice risks: a breach in one slice can spill into another, and side-channel attacks can cross isolation boundaries. CISA's guidance on 5G network slicing highlights these concerns, including denial-of-service within a slice and the need for strong isolation between slices. As 6G arrives, the challenges deepen. The move toward virtualized, cloud-native, and AI-native architectures means anything inside the system is no longer automatically trustworthy, which is why the FCC's CSRIC IX report on 6G security risks and international forums such as the GCOT Security and Resilience Principles for 6G emphasize a transition from perimeter security to granular, function-level Zero Trust. 6G also inherits vulnerabilities from 4G and 5G, particularly where legacy protocols and interworking expose traffic to weaker protections. The result is a security landscape more complex than any single generation in isolation.

The distributed architecture of 5G and 6G creates unique vulnerabilities. Multi-access edge computing and billions of connected IoT devices, many with weak or default security, provide entry points for attackers. This connectivity enables large-scale DDoS attacks, and researchers have documented the risk that compromised devices can be leveraged to build massive botnets. The rise of Aisuru, a botnet of hundreds of thousands of hijacked routers and cameras, illustrates how vulnerable connected infrastructure can power record-breaking attacks. Two threats deserve special attention. First, quantum risk: the FCC's CSRIC IX report and Ericsson highlight the threat of harvest-now, decrypt-later attacks, where adversaries collect encrypted traffic today to decrypt once quantum computers mature. Post-quantum cryptography (PQC) is the primary mitigation, with NIST-standardized algorithms now available and US Executive Order 14412 setting migration deadlines of December 31, 2030 for key establishment and December 31, 2031 for digital signatures. Second, AI-native 6G introduces new risks around the AI models and agents that manage networks, which can be attacked through data poisoning, prompt injection, and compromised training data. As networks grow more complex, human error and social engineering remain persistent, underlining that 5G and 6G security is a technical, operational, and human challenge combined.

A multi-layered approach is essential to secure 5G and 6G. End-to-end encryption protects data in transit against eavesdropping and man-in-the-middle attacks, while robust authentication and identity management, including strong device credentials, reduce the risk of unauthorized access. Network-slicing security should follow the CISA guidance on design, deployment, and maintenance to ensure strong isolation between slices. Zero Trust is becoming the governing framework. The GCOT Security and Resilience Principles for 6G explicitly call for moving away from the assumption that anything inside the network is trustworthy, toward continuous verification, observability, and monitoring across isolation boundaries. AI and machine learning also support continuous monitoring and adaptive threat detection, identifying unusual traffic patterns in real time and enabling faster response. Finally, post-quantum readiness is no longer optional. With NIST PQC standards published and regulatory deadlines approaching, telecom operators should plan crypto-agility now, migrating high-priority systems before 2031 and completing the transition by 2035, as Ericsson advises. Education and workforce training, plus collaborative threat-intelligence sharing across the telecom and technology sectors, round out the strategy, because cooperation yields defenses stronger than any single organization can build alone.