The technology includes a method performed by a security system of a 5G network. The system can instantiate an agent that monitors and control incoming network traffic at a perimeter of the 5G network in accordance with a security model. The agent can process the incoming network traffic with the security model to output a vulnerability-risk-threat (VRT) score that characterizes the incoming network traffic in relation to a vulnerability parameter, a risk parameter, and a threat parameter. The agent compares the VRT score with a threshold value to determine a likelihood that the incoming network traffic includes VRT traffic. The agent communicates at least an indication of the VRT score and incoming network traffic to a central component, which collects VRT information from multiple agents to generate an update for the security model.