A system, comprising: a processor configured to: monitor network traffic on a service provider network at a security platform to identify a new session, wherein the security platform monitors wireless interfaces including a plurality of interfaces for a control protocol and user data traffic in a mobile core network for a 5G network to provide multi-access distributed edge security for the 5G network, and wherein the service provider network includes the 5G network or a converged 5G network, wherein the monitoring of the network traffic comprises to: identify data type SmContextCreateData and/or data type PduSessionCreateData in the network traffic; extract subscription and/or equipment identifier information for user traffic associated with the new session at the security platform, wherein the subscription and/or equipment identifier information is identified by a Subscription Permanent Identifier, SUPI, a General Public Subscription Identifier, GPSI, and/or a Permanent Equipment Identifier, PEI, wherein the extracting of the subscription and/or equipment identifier information comprises to: extract the subscription and/or equipment identifier information from the data type SmContextCreateData and/or data type PduSessionCreateData; determine a security policy to apply at the security platform to the new session based on the subscription and/or equipment identifier information; and block the new session from accessing a resource based on the security policy; and a memory coupled to the processor and configured to provide the processor with instructions. a processor configured to: monitor network traffic on a service provider network at a security platform to identify a new session, wherein the security platform monitors wireless interfaces including a plurality of interfaces for a control protocol and user data traffic in a mobile core network for a 5G network to provide multi-access distributed edge security for the 5G network, and wherein the service provider network includes the 5G network or a converged 5G network, wherein the monitoring of the network traffic comprises to: identify data type SmContextCreateData and/or data type PduSessionCreateData in the network traffic; extract subscription and/or equipment identifier information for user traffic associated with the new session at the security platform, wherein the subscription and/or equipment identifier information is identified by a Subscription Permanent Identifier, SUPI, a General Public Subscription Identifier, GPSI, and/or a Permanent Equipment Identifier, PEI, wherein the extracting of the subscription and/or monitor network traffic on a service provider network at a security platform to identify a new session, wherein the security platform monitors wireless interfaces including a plurality of interfaces for a control protocol and user data traffic in a mobile core network for a 5G network to provide multi-access distributed edge security for the 5G network, and wherein the service provider network includes the 5G network or a converged 5G network, wherein the monitoring of the network traffic comprises to: identify data type SmContextCreateData and/or data type PduSessionCreateData in the network traffic; extract subscription and/or equipment identifier information for user traffic associated with the new session at the security platform, wherein the subscription and/or equipment identifier information is identified by a Subscription Permanent Identifier, SUPI, a General Public Subscription Identifier, GPSI, and/or a Permanent Equipment Identifier, PEI, wherein the extracting of the subscription and/or equipment identifier information comprises to: extract the subscription and/or equipment identifier information from the data type SmContextCreateData and/or data type PduSessionCreateData; determine a security policy to apply at the security platform to the new session based on the subscription and/or equipment identifier information; and block the new session from accessing a resource based on the security policy; extract the subscription and/or equipment identifier information from the data type SmContextCreateData and/or data type PduSessionCreateData; determine a security policy to apply at the security platform to the new session based on the subscription and/or equipment identifier information; and block the new session from accessing a resource based on the security policy; and a memory coupled to the processor and configured to provide the processor with instructions.