A system, comprising: a processor configured to: monitor network traffic on a service provider network at a security platform to identify a new session, wherein the service provider network includes a 5G network, wherein the monitoring of the network traffic comprises to: identify a create context request service operation or a create service operation in the network traffic; extract subscription and/or equipment identifier information for user traffic associated with the new session at the security platform, comprising to: parse HTTP/2 messages to extract the subscription and/or equipment identifier information from the create context request service operation or the create service operation in the network traffic, and wherein the subscription and/or equipment identifier information is identified by a Subscription Permanent Identifier, SUPI, a General Public Subscription Identifier, GPSI, and/or a Permanent Equipment Identifier, PEI; and determine a security policy to apply at the security platform to the new session based on the subscription and/or equipment identifier information; and a memory (304, 310) coupled to the processor and configured to provide the processor with instructions. a processor configured to: monitor network traffic on a service provider network at a security platform to identify a new session, wherein the service provider network includes a 5G network, wherein the monitoring of the network traffic comprises to: identify a create context request service operation or a create service operation in the network traffic; extract subscription and/or equipment identifier information for user traffic associated with the new session at the security platform, comprising to: parse HTTP/2 messages to extract the subscription and/or equipment identifier information from the create context request service operation or the create service operation in the network traffic, and wherein the subscription and/or equipment identifier information is identified by a Subscription Permanent Identifier, SUPI, a General Public Subscription Identifier, GPSI, and/or a Permanent Equipment Identifier, PEI; and determine a security policy to apply at the security platform to the new session based on the subscription and/or equipment identifier information; and monitor network traffic on a service provider network at a security platform to identify a new session, wherein the service provider network includes a 5G network, wherein the monitoring of the network traffic comprises to: identify a create context request service operation or a create service operation in the network traffic; extract subscription and/or equipment identifier information for user traffic associated with the new session at the security platform, comprising to: parse HTTP/2 messages to extract the subscription and/or equipment identifier information from the create context request service operation or the create service operation in the network traffic, and wherein the subscription and/or equipment identifier information is identified by a Subscription Permanent Identifier, SUPI, a General Public Subscription Identifier, GPSI, and/or a Permanent Equipment Identifier, PEI; and determine a security policy to apply at the security platform to the new session based on the subscription and/or equipment identifier information; and a memory (304, 310) coupled to the processor and configured to provide the processor with instructions.