Private Cellular Growth Moved Wide Area. The Security Model Has to Move With It

Stand at the base of a distribution pole forty miles from the control center. There is a recloser near the top and a steel cabinet below it, and inside the cabinet sits a cellular router with a SIM in it. Nobody has opened that cabinet in eight months. The router holds a tunnel back to the core, the recloser is passing SCADA through it, and during a storm restoration last winter a contractor hung a second device off the same switch port. Does anyone at the utility know that second device is there?

That pole is where private cellular is growing now. Dell’Oro Group’s first-half 2026 Private Wireless RAN report, published October 20, found revenue grew at a mid-single-digit rate in 1H26, down from double-digit growth in 2025, and cut the five-year outlook to a 10 to 13 percent CAGR. The headline number is less interesting than the reason behind it. Campus deployments came in softer than expected. What carried the market was wide-area private networks in public safety, utilities and transportation. Wide area means a network that covers territory rather than a site: feeders, substations, pipelines, haul roads, pump stations, crews and vehicles, usually stitched together from private LTE and one or more carrier APNs. That shift moves the security problem to ground most teams have not architected for, and this post walks through what changes.

Where the Growth Actually Went

The demand signal is consistent across three independent sources.

Dell’Oro’s Stefan Pongratz put it plainly in the October 20 release: “Private wireless continues to grow, but the market is developing more slowly than initially anticipated,” with “demand for larger and more demanding wide-area networks providing an important source of growth.” GSMA Intelligence’s October 21 read of recent vendor moves points the same way from the supply side: the campus-oriented portfolio changed hands at roughly 900 customers and about 170 million euros in annual revenue, while the mission-critical private wireless business, at roughly 1.4 billion euros, stayed where it was. GSMA Intelligence calls this a new phase rather than a retreat, and that is the right reading.

GSA’s private network data, current as of September 22, 2026, counts 2,031 organisations across 88 countries running at least one private LTE or 5G network, with 146 in mining and 119 among power utilities. Neither is a campus environment. A haul road is twelve kilometers long. A distribution feeder runs past a few thousand assets nobody drives out to inspect.

Wide area is not a bigger campus network. It is a different one.

A Campus Network and a Field Network Are Not the Same Network

Four things change the moment coverage leaves the site, and each one breaks an assumption that worked fine indoors.

1. The perimeter stops doing any work. A campus network has a gate, a badge reader and a known set of doors. A feeder network has a padlock on a roadside cabinet and a device population spread across territory the operator does not control physically.
2. The device population changes without anyone filing a ticket. Field devices get swapped during restoration, replaced by contractors and re-provisioned under schedule pressure. The asset database reflects the plan, not the pole.
3. Access paths get mixed. Very few wide-area deployments are purely private. Most blend private LTE with carrier APNs across two or three carriers, often across several operating companies, which means no single console holds the whole picture.
4. Most of what matters sits behind a router, not on it. The cellular core sees the router’s SIM. The PLCs, RTUs, meters and relays behind that router are invisible to it.

The campus had a fence. The feeder does not.

Three Exposures That Only Show Up Wide Area

Each fails differently and is found and stopped differently. Naming them apart matters, because a control that handles one does nothing for the other two.

Flat reachability inside the APN is the first one, and it is no longer theoretical. In its follow-up report on the December 2025 energy sector incident, published August 8, 2026, CERT Polska described what it believes to be the first observed case of a private APN being used to reach an OT network in a real attack. The technical cause was a misconfiguration that allowed devices inside the private APN to communicate with one another. CERT Polska went further and noted that surveys of organisations running similar setups suggest this configuration is common in Poland and likely elsewhere. Finding it means testing device-to-device reachability inside the APN rather than trusting the design document. Stopping it means denying peer traffic by default and permitting only the flows a device’s role requires. We covered the operational side of that incident in OT network visibility lessons from the Poland grid attack.

The second exposure is everything behind the cellular router. The core authenticates the SIM in the router and stops there. Whatever is wired behind it, a PLC, an RTU, a laptop a technician left plugged in, inherits that connection without presenting an identity of its own. Finding it means building device-level identity below the router, not above it. Stopping it means enforcing policy per device instead of per tunnel, which we cover in visibility behind the cellular router and CPE.

The third is the seam between private LTE and the carrier APN. A wide-area network almost always spans both, and the two sides do not share an identity model. A device governed well inside the private network becomes a line item in a carrier portal the moment it moves onto the APN, where the available facts are a SIM, an IMEI and an ICCID with no device name and no location context. Finding it means reconciling the two inventories against each other. Stopping it means carrying one identity and one policy across both paths, the argument we made in private cellular network segmentation: APNs are not enough.

A fence can be inspected. A seam has to be instrumented.

Owning the Infrastructure Does Not Mean Owning the Picture

I spend most of my weeks in front of utility and mining teams who built these networks themselves, and the pattern repeats almost word for word. They own the spectrum or the CBRS band. They own the core. They run the radios. And they still cannot answer, with confidence, what is connected right now.

Part of it is tooling. The observability and security stacks these teams already run were built for IP networks and do not see the cellular layer, so when something degrades they cannot rule devices in or out and every investigation starts from zero. Part of it is provisioning. Getting automated SIM provisioning working against a production core routinely means SSH tunnels, a WSDL negotiation and a SOAP integration that takes months to stand up, which is a long way from what the phrase suggests. The result is a team that knows its SIMs and does not know its devices.

That is survivable at pilot scale, where a substation with a handful of RTUs can be managed by someone who remembers each one. It stops being survivable at the scale these same teams are planning, where distribution automation, telemetry and AMI push the endpoint count into the hundreds of thousands.

The campus had a fence. The feeder has a spreadsheet.

What Scale Breaks First

The failure is rarely dramatic. It is the manual process that worked at seven reclosers and stops working at seven hundred.

• A pilot of twenty to fifty devices breaks on inventory accuracy. The ask is a reconciled list of what is actually attached, device by device, before the next phase is approved.
• A regional rollout of a few thousand breaks on provisioning and change control. The ask is onboarding that records device identity when the SIM is issued, so the record is created by the process rather than after it.
• A full territory deployment breaks on policy. At that size nobody audits device-to-device reachability by hand. The ask is default-deny between devices, with role-based exceptions applied as devices come online.

Six Checks Worth Running This Quarter

1. Can you list every device behind each cellular router, by device, not by SIM?
2. If you put two field devices on the same APN today, can they reach each other?
3. When a SIM moves into a different piece of hardware, how long before anyone knows?
4. Does a device keep the same identity and the same policy when it moves between your private network and a carrier APN?
5. Which of your existing monitoring tools receives anything at all from the cellular layer?
6. If an incident happened last night, could you say what was connected at the time, or only that nothing was detected?

If more than two produce a pause, the gap is architectural rather than operational.

The Part That Does Not Scale On Its Own

Every network grows past the point where someone can hold it in their head. Campus deployments hid that for a while because the fence did some of the work. Wide area removes the fence and leaves the operator accountable for territory, which means identity has to be carried by the device rather than inferred from where it sits.

The control that makes this work is identity and policy enforced at the operational layer, below the SIM and behind the router, so that every device is known and what it can reach is decided before traffic moves. Platforms such as OneLayer apply that enforcement across private LTE and carrier APNs together, which keeps one device record and one policy in place as a network grows past the campus.

If you are planning a wide-area build, start with private cellular network segmentation: APNs are not enough, then book a walkthrough of your own environment.