September 20, 2026
What is edge security and why do attackers target edge devices first?
Edge security is the protection of the appliances that bridge your managed network and the internet: VPN gateways, firewalls, routers, and…
By Edge Watch
5 min read
Edge security is the protection of the appliances that bridge your managed network and the internet: VPN gateways, firewalls, routers, and load balancers. Attackers target them first because they hold a public address, sit on the path into the network, and run no endpoint agent. Verizon's 2025 DBIR puts edge devices and VPNs at 22% of exploited initial access, up from 3%.
What counts as an edge device
The Five Eyes guidance on edge devices, published by the Canadian Centre for Cyber Security as ITSM.80.101, defines an edge device as a hardware or software component that bridges an internally managed network and an external, untrusted network such as the internet. That definition is deliberately about position rather than product category. A VPN gateway that terminates encrypted tunnels for remote staff qualifies. So does a firewall enforcing a default-deny rule set, a router that keeps network segments apart, a load balancer with a public listener, and an SD-WAN appliance at a branch site.
Edge security, then, is the discipline of protecting those boundary devices: keeping them patched, reachable only by the people who manage them, observable from somewhere the device itself cannot silence, and retired before their vendor stops supporting them.
Take one concrete case and carry it through the rest of this piece. A regional office runs a VPN concentrator so that field staff can reach file shares and an internal ticketing system. The device has a public IP address, a web login page on port 443, and an administrative interface that the IT team reaches from their desks. It was installed four years ago, it works, and nobody has looked at its firmware version since the last outage. Every property that makes it useful is also a property an attacker can use.
Why the edge is the first door attackers try
The guidance lists the reasons threat actors prioritise boundary devices, and they compound. The first is direct exposure. An edge device typically has a public address reachable from anywhere, so reconnaissance is trivial: internet-wide scanners index its login page and management port without any phishing or foothold. The second is position. A compromised boundary device is a pathway into the protected network behind it, which is exactly the path the regional office's VPN concentrator exists to provide.
The third reason is that unpatched devices are common. The guidance is blunt that exploitation of known vulnerabilities means attackers leveraging flaws that have patches available but not applied. Appliances get patched on maintenance windows, and maintenance windows slip. The fourth is administrative value: a successful compromise yields privileged accounts and control over configuration, including the rules that decide what traffic passes.
The fifth reason is the one defenders most often underestimate. Vulnerabilities in the device's web interface enable persistence mechanisms that survive restarts, and the appliance runs no endpoint detection agent of yours. On a laptop an attacker fights EDR. On a sealed firewall image there is nothing to fight. As the guidance puts it, threat actors will spend time and resources looking at all possible vectors to bypass the boundary controls in place. Even small office and home routers are recruited, dormant, for later denial-of-service campaigns.
Put those together for the running example: a public login page anyone can reach, a path to internal shares once inside, a firmware version nobody tracks, administrative credentials worth stealing, and no telemetry from the box itself.
What the 2025 numbers say
The mechanism shows up plainly in the incident data. In the Verizon 2025 Data Breach Investigations Report, edge devices and VPNs accounted for 22% of exploitation-of-vulnerability initial-access actions, up from 3% the year before. That is close to an eightfold rise in a single reporting period. The same report measured a median of 32 days for organisations to fully remediate edge-device vulnerabilities, and found only about 54% were fully remediated during the year. Roughly half of the known edge flaws stayed open past the reporting window.
Mandiant's M-Trends 2025 tells the same story from the incident-response side. Exploits were the most common initial infection vector for the fifth consecutive year, at 33% of the intrusions the firm investigated in 2024. The four most exploited vulnerabilities that year were all in edge products: Palo Alto PAN-OS, Ivanti Connect Secure, and Fortinet FortiOS.
Read together, the numbers describe a gap. Attackers move to a new edge flaw within days, sometimes before the advisory. Defenders take a month on median to close it, and half never finish. For the regional-office concentrator, the honest question is not whether a vulnerability will be published for it, but how many days it will sit exposed after that happens.
One chain end to end: the Cisco ASA directive
In September 2025 CISA issued Emergency Directive 25–03 after confirmed exploitation of two flaws in Cisco ASA and Firepower firewalls, CVE-2025–20333 and CVE-2025–20362. The directive is a useful specimen because it shows every stage of an edge compromise in one document.
The entry point was crafted requests to the appliance's exposed service. What followed is the part that matters for defenders: the actor demonstrated the ability to modify the ASA's ROM, giving persistence through reboots and even through system upgrades. CISA's wording is that the threat actor has demonstrated a capability to successfully modify ASA ROM at least as early as 2024, linking the activity to the ArcaneDoor campaign. A device that has been patched can still be owned, and a reboot is not sufficient to expunge the malware.
So the directive did not simply say patch. It ordered agencies to identify every in-scope device immediately, to collect a core dump from each ASA and submit it for analysis before touching it, to disconnect any compromised unit while keeping it powered on so the evidence survived, and to apply updates within days with subsequent fixes inside 48 hours. Firepower and Secure Firewall units later received a hard-reset requirement. Devices whose support ended on or before 30 September 2025 were to be permanently disconnected, on the grounds that legacy platforms cannot meet current vendor support and update requirements.
That sequence, inventory, forensics, then patch, then retire, is edge security compressed into one week. It also explains why the regional office's four-year-old concentrator is a bigger problem than its CVE count suggests: if its support window has closed, no patch is coming.
Six edge security controls, in payoff order
The Five Eyes guidance gives defenders a long list. Ordered by how fast each one reduces risk, it collapses to six actions.
Inventory comes first because every other control depends on it. List each internet-facing appliance with its firmware version, its owner, and its support end date. The guidance asks for exactly this, alongside subscribing to vendor notifications so that an advisory maps to a device on the list within minutes.
Reduce exposure second. Management interfaces should never face the internet; put them on an out-of-band network, reach them from a dedicated administration workstation, and require phishing-resistant multi-factor authentication for every administrative log-on. For the regional office, that means the VPN login page stays public because it must, but the admin page disappears from the internet today.
Third, patch by exploitation status rather than by severity score. A flaw listed in CISA's Known Exploited Vulnerabilities catalog outranks a higher-scored flaw nobody is using. The guidance's push for a mandatory update window exists to shrink that 32-day median.
Fourth, log off the device. Centralised, off-device logging with alerts on administrative log-ons and configuration changes is the only telemetry that survives an attacker who owns the box. Treat a log stream that stops as an alert in its own right.
Fifth, after any confirmed exploitation, rotate what the device held: credentials, certificates, and sessions. CitrixBleed showed why, when session tokens read from NetScaler memory bypassed multi-factor authentication entirely. Sixth, retire end-of-life units on a schedule, with compensating controls only for the rare box that cannot go.
For the regional office, the plan writes itself. Record the concentrator's model and support date this week. Move its admin interface off the internet. Check it against the KEV catalog and patch or, if support has lapsed, order its replacement. Point its logs at a collector and alert on silence. Then evaluate whether a zero-trust access model, which the guidance names as a way to reduce reliance on boundary devices, lets the next site skip the public address altogether.
This article expands on our video "What is edge security and why do attackers target edge devices first?" — watch it here.