Report Highlights

5G Security in the United States: Market Overview

The United States 5G security market is distinctive because it is shaped less by commercial telecom spending than by national security policy. Federal restrictions on Chinese vendors have turned supply-chain assurance into a procurement criterion, and the market was valued at USD 2.9 billion in 2024. Three national carriers, Verizon, AT&T and T-Mobile, carry most mobile 5G traffic, which concentrates buying power and standardizes security requirements across the country.

Structurally, the market is split between hardware-embedded security from RAN vendors such as Ericsson and Nokia and software security layers from firms including Palo Alto Networks and Fortinet. Unlike the global norm, where operators procure security bundled with network equipment, U.S. buyers increasingly purchase it separately to satisfy FCC Covered List restrictions and federal audit requirements. This separation creates a distinct layer for independent security vendors and systems integrators.

Growth Drivers for 5G Security in the United States

The first driver is the Secure and Trusted Communications Networks Act of 2019, which created a reimbursement program funded at USD 1.9 billion by Congress. The FCC has reimbursed carriers for removing Huawei and ZTE equipment, and that replacement work requires new security architecture in rebuilt core and radio networks. The second driver is the Secure 5G and Beyond Act of 2020, which authorized a USD 1.5 billion Public Wireless Supply Chain Innovation Fund administered by NTIA to back Open RAN deployments with security testing.

The third driver is federal cybersecurity mandates. Executive Order 14028, issued in May 2021, required agencies to adopt zero-trust architecture, and NIST's Cybersecurity Framework 2.0, released in February 2024, extends those expectations to private operators. Demand is also rising from the Department of Defense, where CMMC 2.0 certification is phasing in and private 5G networks at bases and installations are expanding. Together these programs create recurring compliance spending rather than one-time equipment purchases.

Market Restraints and Entry Barriers in the United States

Entry is constrained first by the FCC Covered List, which bars federal subsidies and equipment authorizations for listed vendors, and by the FCC equipment authorization process, which adds testing time before products reach market. Foreign-owned security vendors also face scrutiny from the Committee on Foreign Investment in the United States (CFIUS) when acquiring domestic cybersecurity firms with telecom network access. Federal cloud procurement requires FedRAMP authorization, a process that commonly takes 12 to 18 months.

Incumbent advantage is the second barrier. Ericsson, Nokia and Cisco hold multi-year managed-services relationships with the national carriers, which limits openings for specialist vendors. Distribution is also complex: carriers run procurement cycles averaging nine to twelve months, and government buyers usually require a GSA Schedule listing before awarding contracts. Pricing pressure from bundled security offered alongside radio access equipment compresses margins for standalone suppliers.

Market Opportunities in the United States

The most immediate opportunity is private 5G security for critical infrastructure. Private cellular networks at ports, ammunition plants and energy facilities are scaling, and addressable spending on security layers for those networks is estimated at USD 650 million in 2025. Vendors that certify to NIST CSF 2.0 and provide operational technology monitoring for industrial control systems can capture this segment before carriers consolidate their suppliers.

A second opportunity lies in Open RAN security testing. NTIA-backed interoperability programs have funded test laboratories, and independent security testing services for Open RAN could address roughly USD 300 million annually by 2028. Regional carriers in Texas, Oklahoma and Kansas that completed rip-and-replace swaps still need managed detection services, creating a service contract pipeline for integrators.

Market at a Glance

Leading Market Participants

• Ericsson
• Nokia
• Cisco Systems
• Palo Alto Networks
• Fortinet
• Check Point Software Technologies
• Zscaler
• Hewlett Packard Enterprise
• Booz Allen Hamilton
• Trellix

Regulatory and Policy Environment for 5G Security in the United States

The Secure and Trusted Communications Networks Act of 2019 empowers the FCC to prohibit subsidies for covered equipment, and the FCC Office of Engineering and Technology manages the Covered List. The Secure Equipment Act of 2021 directed the FCC to stop approving equipment from covered vendors, reinforcing that framework. NTIA administers the Public Wireless Supply Chain Innovation Fund, while CISA publishes 5G security guidance under its cybersecurity authorities. Reimbursement awards carry removal deadlines that vary by recipient.

Federal procurement is governed by FedRAMP, managed by the General Services Administration, and by CMMC 2.0 under the Department of Defense, whose 32 CFR Part 170 rule took effect December 16, 2024. The NIST Cybersecurity Framework 2.0, released February 26, 2024, is the reference standard for critical infrastructure operators. Vendors selling to federal buyers should expect certification cycles of roughly 12 to 18 months before revenue begins.

Long-Term Outlook for 5G Security in the United States

By 2032, the United States 5G security market is forecast to reach USD 11.6 billion, growing at a 19.0% CAGR from the 2025 base year. Growth will shift from carrier replacement programs toward recurring managed security services, with software and cloud-native controls holding a larger share of spending than hardware. Private 5G deployments in manufacturing, logistics and defense will account for a growing portion of demand as RAN vendors embed protections by default.

Key uncertainties include further Covered List expansion, changes to rip-and-replace funding, and the pace of Open RAN adoption by Verizon and AT&T. Vendors that build U.S.-based security operations and secure federal certifications early will hold the strongest positions. Established leaders such as Cisco, Palo Alto Networks and Ericsson will face consolidation pressure from specialist vendors and integrators, keeping price competition intense through the forecast period.