  5G cellular systems are slowly being deployed worldwide delivering the
promised unprecedented levels of throughput and latency to hundreds of millions
of users. At such scale security is crucial, and consequently, the 5G standard
includes a new series of features to improve the security of its predecessors
(i.e., 3G and 4G). In this work, we evaluate the actual deployment in practice
of the promised 5G security features by analysing current commercial 5G
networks from several European operators. By collecting 5G signalling traffic
in the wild in several cities in Spain, we i) fact-check which 5G security
enhancements are actually implemented in current deployments, ii) provide a
rich overview of the implementation status of each 5G security feature in a
wide range of 5G commercial networks in Europe and compare it with previous
results in China, iii) analyse the implications of optional features not being
deployed, and iv) discuss on the still remaining 4G-inherited vulnerabilities.
Our results show that in European 5G commercial networks, the deployment of the
5G security features is still on the works. This is well aligned with results
previously reported from China [16] and keeps these networks vulnerable to some
4G attacks, during their migration period from 4G to 5G.
