Annual cybersecurity expenditures by global mobile network operators are projected to more than double within the next five years, soaring to a staggering $42 billion by 2030. This dramatic surge is being driven not only by the escalating complexity and frequency of cyberattacks but, critically, by the heavy financial burden imposed by fragmented and poorly designed government regulations across multiple jurisdictions.
The findings, detailed in a major new report by the GSM Association (GSMA), the global body representing the mobile ecosystem, reveal that the industry currently allocates a substantial $15 billion to $19 billion annually toward core security activities. However, the study, titled “The Impact of Cybersecurity Regulation on Mobile Operators” and developed in collaboration with Frontier Economics, warns that a disproportionate and growing share of future investment will be diverted to meeting bureaucratic compliance mandates rather than achieving genuine, real-world risk reduction.
Mobile networks are now universally recognized as the digital backbone of the global economy, carrying the majority of the world’s digital data and underpinning vital public services. As 5G technology rolls out, connecting billions of new devices and highly sensitive industrial applications, the potential attack surface expands exponentially, making robust network security a critical societal issue.
Michaela Angonius, the GSMA’s head of policy and regulation, underscored the challenge at the report’s launch. “Mobile networks now carry the world’s digital heartbeat. As cyber threats escalate, operators are investing heavily to keep societies safe, but regulation must help, not hinder, those efforts,” she stated.
The analysis, which drew on economic modelling and interviews with operators across Europe, North America, Asia Pacific, Africa, and Latin America, highlighted that companies operating across multiple national borders face the steepest compliance challenges. Inconsistent national policies and, in some cases, outright contradictory rules force operators to comply with overlapping requirements from various government agencies. This lack of harmonization not only drives up costs but also creates significant organizational inefficiencies.
A particularly acute pain point cited in the report is the escalating volume and complexity of reporting obligations. Operators are often required to report the same cybersecurity incident multiple times—in different formats and under varying deadlines—to different national authorities. This administrative drain places immense pressure on security teams whose resources should be dedicated to proactive threat hunting and incident response.
The GSMA warned that prescriptive, “box-ticking” regulatory approaches are especially counterproductive. These rules often mandate the use of specific, outdated technologies or processes rather than focusing on security outcomes. This rigid approach limits operators’ ability to innovate and rapidly deploy flexible, cutting-edge defenses capable of adapting to sophisticated new threat vectors. Alarmingly, one mobile operator cited in the report estimated that as much as 80 per cent of its core cybersecurity operations team’s time is consumed by internal audits and regulatory compliance tasks, starving the functions responsible for active threat detection and response.
To foster a more secure and economically sustainable environment, the GSMA called on governments to adopt six core principles in their regulatory design. These include promoting consistency and avoiding duplication by harmonizing national policies with international security standards, and transitioning away from prescriptive mandates towards risk- and outcome-based regulation. Other key recommendations focus on strengthening collaboration between regulators and the industry through secure threat-intelligence sharing and institutional capacity building within government security agencies to ensure coordinated, whole-of-government implementation.
The failure to create coherent, coordinated frameworks carries a significant risk: not only could it inflate costs for operators, but it could also inadvertently increase systemic vulnerabilities across the entire mobile network ecosystem. As Angonius concluded, “Cybersecurity is a shared responsibility. When policy is coherent and outcomes-focused, regulators and operators can work together to make the entire digital ecosystem safer.” The industry is urging policymakers to heed these warnings and build regulatory regimes that support long-term network resilience.
