A system, comprising: a processor configured to: monitor network traffic on a service provider network at a security platform (102a, 102b) to identify a new session, wherein the service provider network includes a 5G network or a converged 5G network, wherein the monitoring of the network traffic further comprises to; identify a create context request service operation or a create service operation in the network traffic; extract network slice information for user traffic associated with the new session at the security platform, wherein extracting the network slice information further comprises to: parse HTTP/2 messages to extract the network slice information from the create context request service operation or the create service operation in the network traffic, and wherein the network slice is identified by Single Network Slice Selection Assistance Information (S-NSSAI); and determine a security policy to apply at the security platform to the new session based on the network slice information; and a memory coupled to the processor and configured to provide the processor with instructions. a processor configured to: monitor network traffic on a service provider network at a security platform (102a, 102b) to identify a new session, wherein the service provider network includes a 5G network or a converged 5G network, wherein the monitoring of the network traffic further comprises to; identify a create context request service operation or a create service operation in the network traffic; extract network slice information for user traffic associated with the new session at the security platform, wherein extracting the network slice information further comprises to: parse HTTP/2 messages to extract the network slice information from the create context request service operation or the create service operation in the network traffic, and wherein the network slice is identified by Single Network Slice Selection Assistance Information (S-NSSAI); and determine a security policy to apply at the security platform to the new session based on the network slice information; and monitor network traffic on a service provider network at a security platform (102a, 102b) to identify a new session, wherein the service provider network includes a 5G network or a converged 5G network, wherein the monitoring of the network traffic further comprises to; identify a create context request service operation or a create service operation in the network traffic; extract network slice information for user traffic associated with the new session at the security platform, wherein extracting the network slice information further comprises to: parse HTTP/2 messages to extract the network slice information from the create context request service operation or the create service operation in the network traffic, and wherein the network slice is identified by Single Network Slice Selection Assistance Information (S-NSSAI); and determine a security policy to apply at the security platform to the new session based on the network slice information; and parse HTTP/2 messages to extract the network slice information from the create context request service operation or the create service operation in the network traffic, and wherein the network slice is identified by Single Network Slice Selection Assistance Information (S-NSSAI); and determine a security policy to apply at the security platform to the new session based on the network slice information; and a memory coupled to the processor and configured to provide the processor with instructions.