According to certain embodiments, a method is performed by a network node for secure handling of early data transmission (EDT) during Random Access (RA) procedure before Radio Resource Control (RRC) setup is complete. The method includes receiving, from a wireless device, a RRC message comprising a resume connection request and data. Based on stored security information, the network node determines that the RRC message is suspicious. In response to determining that the RRC message is suspicious, the network node takes an action.