The European Commission has released a report on the cybersecurity of Open RAN, the architecture that breaks the traditional radio access network into interoperable components from different vendors. The document comes from the Commission's CIPR work and addresses a question that has shadowed the technology since operators began deploying it: whether openness buys resilience or adds risk.

Open RAN replaces the tightly integrated base-station platforms of Ericsson, Nokia and Huawei with standardized interfaces, virtualized software and, in many deployments, radio units, compute hardware and RAN software sourced from separate suppliers. Operators in the UK, Japan and elsewhere have used it to widen their vendor pool. Security agencies have spent the same period asking whether the extra interface points create new attack surfaces.

What does the report examine?

The Commission's study sits at the intersection of two European policy tracks. The first is the 5G Toolbox, the EU's 2020 framework for securing national networks, which pushed member states to assess suppliers and restrict high-risk vendors. The second is the bloc's interest in diversifying telecom equipment supply, an area where Open RAN is frequently presented as an alternative to the three-vendor market.

That dual framing is what makes the report significant. A technology cannot serve as a supplier-diversification tool if regulators conclude it weakens network security. The report therefore has to weigh the security posture of open interfaces and multivendor stacks against the resilience benefits of modularity and easier replacement of components.

Commercial reality versus vendor claims

Industry bodies and RAN software vendors have long argued that openness improves security because more parties can inspect standardized interfaces, and because operators are not locked into a single vendor's closed stack. Critics, including several European operators and vendors with legacy RAN businesses, counter that fragmentation of responsibility across suppliers complicates accountability when something fails.

The Commission's contribution matters here because it is a regulatory assessment rather than a vendor position paper. Its conclusions will inform how member states treat Open RAN deployments in national security reviews, and how the EU's cybersecurity agency, ENISA, frames future technical guidance.

Why the timing matters

European operators are mid-cycle on 5G investment, and several have run Open RAN trials or early commercial deployments. A negative security assessment would raise the compliance cost of those rollouts; a positive one would give operators a clearer path to multivendor networks under the existing 5G Toolbox regime.

The report also lands as the EU continues work on its connectivity and digital infrastructure agenda, where equipment supply chains remain a standing concern. Open RAN's role in that agenda depends heavily on whether Brussels judges the security question settled or still open.

Operators and vendors planning European deployments will now be reading the report's findings closely, since its assessment is likely to shape the pace at which Open RAN moves from trials to mainstream network builds across the bloc.