How 5G Networks Actually Get Built — and Secured

Carriers worldwide will spend an estimated $1.2 trillion on network capital expenditure between 2025 and 2030, much of it on 5G, according to the GSMA's Mobile Economy 2025 report. That money does not buy a simple upgrade. It buys tens of thousands of new small cells, miles of fiber trenched under city streets, a rebuilt software core running in data centers instead of phone-company switching rooms, and a fight over which vendors are allowed to touch any of it. This is the story of what it actually takes to put 5G in the ground, and why the network's new architecture opens security problems 4G never had.

Why "just add towers" doesn't work anymore

Every previous cellular generation mostly reused the same tower grid: swap the radios, upgrade the software, done. 5G breaks that pattern because its highest-value spectrum, mid-band and millimeter wave, has a much shorter range than the low-band frequencies 4G leaned on. A single low-band tower can cover several kilometers. A mid-band or mmWave site often covers a few hundred meters to about a kilometer before signal quality drops off.

The fix is densification: instead of one big tower, carriers deploy many small cells, low-power base stations about the size of a pizza box, mounted on light poles, traffic signals, and building facades every few blocks. ABI Research projects 5G small cell deployments will reach roughly 13 million units by 2027. Each one needs three things a legacy macro tower rarely did at this scale: fiber running to it, electrical power, and a permit from whoever owns the pole.

Fiber backhaul, the physical cable connecting a cell site to the core network, runs around $70,000 per kilometer to install according to GSMA estimates, and accounts for 15 to 30 percent of total 5G deployment cost. In a dense city, that's the line item that decides whether a neighborhood gets real 5G or gets left on 4G.

Think of the old cellular network like a handful of floodlights lighting a parking lot from the corners. 5G densification is like replacing those with hundreds of desk lamps, each one bright but short-ranged, and each one needing its own power cord run to it. The floodlights were simpler to install. The desk lamps give you far better light where you actually stand, but only if someone wires every single one.

The fiber and permitting bottleneck

Fiber is the hidden constraint on 5G rollout speed. A small cell without a wired backhaul connection has to fall back on wireless links, which add latency and cap capacity, undermining the entire point of building it. Ciena's network engineers have described the buildout bluntly: 5G wireless needs fiber, and lots of it, because every promise 5G makes about speed and latency depends on a wired path from the antenna back to the internet.

Where trenching new fiber isn't feasible, in an already-dense downtown, under a protected sidewalk, along a route with existing utility conflicts, carriers turn to Integrated Access and Backhaul (IAB). IAB uses a 5G radio link itself to carry backhaul traffic to a nearby fiber-connected site, letting a small cell "borrow" a neighbor's wired connection wirelessly. It's slower to deploy than trenched fiber but far faster to install, a genuine engineering compromise rather than a stopgap.

Why does 5G rollout vary so much between neighborhoods?

Coverage gaps mostly trace back to permitting and fiber access, not radio physics. A carrier can get spectrum lit up on a tower in weeks, but negotiating pole attachment rights with a city, a utility, and sometimes a private landlord, then trenching or leasing fiber to that pole, can take months to years. Wealthier, denser commercial corridors get prioritized because the fiber and revenue case are already there.

Open RAN: breaking the single-vendor lock-in

For decades, a cell site's radio hardware and software came from one vendor as a sealed package, Ericsson, Nokia, or Huawei, with no other company's gear able to plug into it. Open RAN (O-RAN) standardizes the interfaces between radio units, distributed units, and centralized units so operators can mix vendors, running, say, a radio from one company against baseband software from another.

The O-RAN Alliance was founded in 2018, and the model has since moved from pilot projects to real deployments; the Open RAN market was valued at roughly $3.98 billion in 2025 and is projected to grow toward $25 billion by 2031 according to Mordor Intelligence. The pitch is straightforward: more vendor competition should push down equipment costs and let smaller carriers avoid depending on a single supplier.

The catch is that openness has a price. Industry analysis cited by 5G World Pro estimates Open RAN currently costs 10 to 20 percent more than a traditional single-vendor deployment over five years, once integration complexity and multi-vendor support contracts are factored in. Getting radios, software, and orchestration layers from different companies to work together reliably is a genuinely hard systems-integration problem, and it introduces new points where security has to be re-verified rather than inherited from one trusted vendor.

The Huawei problem: national security meets network engineering

5G deployment decisions haven't been purely technical. In 2019, the US Secure and Trusted Communications Networks Act barred federal subsidy dollars from being used to buy or maintain equipment from vendors flagged as national security risks, chiefly Huawei and ZTE, and funded a program to physically remove already-installed gear from smaller US carriers.

That "rip-and-replace" program is a case study in how expensive security-driven infrastructure decisions get. Congress initially appropriated $1.9 billion in 2021, but carrier reimbursement requests came in around $4.9 billion, roughly two and a half times the funded amount. A $3.08 billion Treasury loan authorized in the December 2024 National Defense Authorization Act closed most of that gap, bringing total program funding to roughly $5 billion. As of June 2026, 73 of 126 carrier removal projects remained unfinished, according to reporting from Tech Times, held up largely by supply chain delays in sourcing replacement equipment.

The lesson generalizes beyond one vendor dispute: ripping trusted-or-untrusted hardware out of a live network that customers depend on every day is far slower and costlier than installing it was in the first place. Security-motivated infrastructure changes rarely come cheap, and they rarely come fast.

Why virtualizing the network core creates new attack surface

Here's the architectural shift that matters most for security, and it has nothing to do with radios or towers. In 4G, the network core, the part that authenticates devices, routes calls, and manages billing, ran on dedicated, purpose-built hardware in a phone company's own facilities. In 5G, the core is largely software, running as virtualized functions on commodity servers, often in cloud data centers shared across multiple purposes.

This is what makes network slicing possible: 5G can carve one physical network into multiple virtual networks, one tuned for consumer video streaming, another for a factory's robots that need guaranteed low latency, another for a fleet of low-power IoT sensors, all running on the same underlying hardware. It's a genuinely useful capability. It's also, according to CISA and NSA's joint "Security Guidance for 5G Cloud Infrastructures" series published in 2021 and 2022, a fundamentally different threat model than a hardware-isolated 4G core ever had to defend against.

The most surprising fact for anyone used to thinking of 4G security as "solved": 5G's virtualized, software-defined core means a vulnerability in the orchestration layer that manages network slices, not a bug in any single slice, can potentially let an attacker move laterally between slices that were supposed to be walled off from each other.

What actually goes wrong in a virtualized 5G core?

Researchers publishing in peer-reviewed and industry venues, including a 2024 conceptual framework in MDPI Telecom and a 2025 survey in ScienceDirect, point to the same recurring weak points: insecure orchestration APIs that manage how slices are created and torn down, misconfigured resource isolation that lets one tenant's traffic leak into another's, and authentication gaps between the many software components that used to be a single sealed hardware box. Software Defined Networking (SDN) and Network Functions Virtualization (NFV), the two technologies that make slicing possible, expand the attack surface precisely because they replace fixed hardware boundaries with configurable software ones.

Compare it to an old apartment building versus a modern open-plan office retrofitted with movable partition walls. The apartment building has load-bearing walls between units; breaking into one unit tells you nothing about the others. The open-plan office can be reconfigured into as many "rooms" as needed by moving partitions, which is efficient and flexible, but a partition is not a load-bearing wall. If the system that manages where the partitions go gets compromised, the whole floor's separation logic can fail at once. 5G network slicing is the movable-partition office; 4G's dedicated core was the apartment building.

CISA's guidance responds to this with recommendations rather than a single fix: continuous monitoring of the orchestration layer, mutual authentication between every microservice, encrypted data in transit and at rest across the cloud infrastructure, and strict identity and access controls so no single compromised credential can reconfigure a slice boundary. The agencies stop short of saying the problem is solved. Their own framing is that 5G's security model has to be "adaptable and cross-layered" because a single static perimeter, the model 4G relied on, no longer matches how the network is actually built.

Is 5G less secure than 4G overall?

Not in every respect. 5G mandates stronger subscriber authentication, better protection against fake base station ("IMSI catcher") attacks, and improved encryption of identifiers compared with 4G. The tradeoff is that its cloud-native, sliced architecture introduces categories of risk, orchestration compromise, inter-slice lateral movement, that a hardware-isolated 4G core structurally couldn't have.

Rakuten Mobile and Dish: the real-world Open RAN test cases

Open RAN moved from theory to proof of concept largely because two carriers bet their entire network on it rather than bolting it onto an existing one. Rakuten Mobile launched in Japan as the world's first fully cloud-native, virtualized mobile network, and has since grown into what Rakuten describes as the largest heterogeneous-network Open RAN deployment anywhere, with more than 345,000 cells running radio equipment from multiple different vendors rather than one sealed supplier.

In the United States, Dish Network built what it calls the nation's first virtualized, O-RAN-based 5G broadband network, using Rakuten Symphony's observability platform to monitor telemetry across every network function in real time, a necessity when the network is assembled from multiple vendors instead of one company's integrated stack. Dish's build has not been without setbacks; industry coverage has documented schedule slips and integration friction consistent with the broader pattern of Open RAN costing more up front in exchange for long-term vendor flexibility.

These two carriers matter because they show Open RAN works at national scale, not just in a lab pilot, while also showing why most established carriers with a working single-vendor network have been slower to switch. Ripping out a functioning system to gain future flexibility is a much harder sell than building multi-vendor from day one. That is a recurring theme in 5G infrastructure decisions generally: the network you already have is expensive to change, even when the case for changing it is sound.

The energy bill nobody mentions in the marketing

Densification and virtualization both carry an operating cost that rarely comes up outside industry trade press: electricity. A typical 5G macro base station consumes roughly four kilowatts, three to four times what an equivalent 4G base station draws, according to analysis compiled by fiber-optic industry publication YD Fiber Optic. Multiply that by the sheer number of additional small cells 5G densification requires, and total network power draw for a fully built-out 5G deployment can run many times higher than the 4G network it replaces.

That matters financially as much as environmentally. Energy already accounts for roughly 15 to 20 percent of a mobile network operator's operating expenses on average, according to GSMA Intelligence, and more than 70 percent of that energy is consumed by radio access network equipment, the antennas, radio units, and base stations, rather than the core network or data centers. A carrier deciding how aggressively to densify a neighborhood with small cells isn't just weighing fiber and permitting costs; every new cell site becomes a recurring monthly power bill for the life of the deployment.

This is a big part of why "sleep mode" and AI-driven radio power management have become priorities for equipment vendors rather than a nice-to-have. A base station that can power down unused antenna elements during low-traffic overnight hours directly offsets the multiyear cost of running a denser 5G grid. It's an unglamorous engineering detail, but it's one of the reasons a fully mature 5G build costs materially more to operate than the 4G network sitting next to it, even after the initial construction bill is paid off.

Who pays, and who decides where 5G shows up first

Spectrum itself is a major line item before a single cell site gets built. The GSMA's 2025 Mobile Economy report specifically urges governments to price 5G spectrum auctions to support connectivity goals rather than to maximize state revenue, warning that aggressive reserve prices push carriers toward slower rollout and higher consumer prices to recoup the auction cost. That advice exists because it's regularly ignored: several major markets have run spectrum auctions that raised many billions of dollars for national treasuries, money that didn't go toward laying fiber or paying for small cell permits.

The downstream effect is a coverage map that tracks the business case as much as the technology. Areas with existing fiber, high population density, and cooperative permitting move to mid-band 5G first. Rural and lower-income areas, where the fiber backhaul cost per potential subscriber is much higher, get low-band 5G that behaves close to good 4G, or wait years longer for anything better. This is an economic pattern, not a technical limitation of 5G itself; the radio technology works the same everywhere. The infrastructure to feed it does not get built the same everywhere.

Deployment factor	What it requires	Typical cost driver	Effect on rollout speed
Fiber backhaul	Trenched or leased fiber to each cell site	~$70,000/km, 15–30% of total deployment cost	Slowest-moving constraint; often the true bottleneck
Small cell siting	Permits from cities, utilities, or landlords	Months to years of negotiation per pole	Highly variable by jurisdiction
Spectrum acquisition	Government auction participation	Multi-billion-dollar national auctions	High reserve prices slow carrier rollout budgets
Vendor security compliance	Removing flagged equipment (e.g., Huawei/ZTE)	~$5B U.S. federal reimbursement program alone	Multi-year remediation even with funding secured
Open RAN integration	Multi-vendor radio/software interoperability	10–20% cost premium over 5-year TCO	Slower initial deployment, long-term vendor flexibility

5G deployment cost and speed factors, compiled from GSMA, Mordor Intelligence, and FCC program data (2025–2026).

What people get wrong about 5G rollout

The most common misconception is that a "5G" icon on a phone means the fast, low-latency network the marketing promised. In practice, most subscribers connect to low-band 5G, which behaves close to strong 4G, precisely because low-band requires far less new infrastructure to deploy widely. The dramatic multi-gigabit demos come from mmWave sites that remain concentrated in stadiums, airports, and a handful of dense urban blocks, because mmWave's short range makes it the most infrastructure-hungry band of all.

A second misconception is that Open RAN is primarily a cost-cutting move. It can lower long-term equipment costs through vendor competition, but the near-term integration premium and the added security verification burden of a multi-vendor stack mean it's better understood as a strategic bet on flexibility and supply chain resilience than a guaranteed near-term discount.

A third misconception, understandable given how the "rip-and-replace" saga has played out, is that swapping network vendors for security reasons is a quick fix once funding is approved. Physical equipment removal from a live network serving paying customers, sourcing compliant replacement hardware amid supply constraints, and reconfiguring the network without service interruption is a multi-year undertaking even with money in hand.

FAQs

Q: Why does 5G need so many more cell sites than 4G? A: 5G's highest-value spectrum, mid-band and millimeter wave, has a much shorter range than the low-band frequencies 4G relied on most heavily. Carriers compensate by deploying many small, low-power cells instead of fewer large towers, which multiplies the fiber, power, and permitting work needed per unit of coverage.

Q: What is Open RAN and why does it matter for security? A: Open RAN (O-RAN) standardizes the interfaces between a cell site's radio and software components so operators can mix hardware and software from different vendors instead of buying a sealed single-vendor system. It reduces vendor lock-in but adds integration and security-verification complexity, since every new interface between vendors is a new point that has to be independently secured.

Q: Why did removing Huawei and ZTE equipment from US networks cost so much more than planned? A: Congress initially funded the FCC's rip-and-replace program at $1.9 billion in 2021, but actual carrier reimbursement requests reached about $4.9 billion, mainly because sourcing compliant replacement hardware amid global supply chain constraints and reconfiguring live networks without service interruption proved far more expensive and slower than the initial estimate assumed.

Q: Is 5G's virtualized network core actually less secure than 4G's hardware core? A: It isn't universally less secure. 5G improves subscriber authentication and encryption compared with 4G. But its software-defined, cloud-native core introduces attack surfaces, like orchestration-layer compromise and inter-slice lateral movement, that a physically isolated 4G core structurally could not have.

Q: Why do rural areas get 5G later than cities? A: Fiber backhaul cost, roughly $70,000 per kilometer according to GSMA estimates, scales poorly against a smaller potential subscriber base in low-density areas. Carriers prioritize sites where the fiber and revenue case pencils out fastest, which is almost always dense urban and commercial areas first.

The takeaway

5G's real story isn't the radio technology, it's the infrastructure and architecture decisions layered underneath it: who pays for the fiber, who gets a permit first, which vendors are trusted with the hardware, and how a software-defined core gets defended once the network stops being a sealed box. The virtualized, sliced architecture that makes 5G flexible is the same architecture that gives it a security model 4G never had to reckon with. Coverage maps and headline speeds are downstream of these deployment and security tradeoffs, not the other way around.

---

Read next:

• What Is 5G — and How Is It Really Different from 4G?
• Why Undersea Cables Carry Most Internet Traffic
• How Satellite Internet Reduces Latency
• How Digital Signatures Prove A File Is Authentic