Business Article: Who’s Guarding the Gateway?

September - October 2026

Who’s guarding the gateway? When your cyber defences become the threats

For years, organisations have been told to protect their computers. Keep software updated. Install security tools. Use strong passwords and multi-factor authentication. Replace unsupported systems. Train staff to recognise phishing emails.

Today, a business laptop is likely to be significantly better protected than its equivalent from a decade ago. It may receive automatic operating system and application updates, use encryption, and be centrally managed and protected by endpoint detection and response software. Its security status may also be continually monitored.

But what about the equipment sitting between that laptop and the outside world?

The firewall protecting the office. The virtual private network (VPN) gateway providing remote access. The router connecting the organisation to the internet. The security appliance inspecting traffic. Or perhaps the forgotten internet-facing device installed years ago for a project that nobody quite remembers.

These devices are supposed to protect the network. Increasingly, however, they are also exactly where attackers are looking.

Edge devices are prime targets because they sit at the boundary between an organisation and potentially hostile external networks. Attackers exploit vulnerabilities, weak default settings and configuration errors in these devices to obtain an initial foothold, move further into networks and maintain access.

The devices we rely on, but rarely think about

Edge devices are systems positioned at the boundary of your organisation's technology environment. They often control or enable connections between your internal systems and the wider internet.

They can include:

firewalls
routers
VPN and remote-access gateways
secure web gateways
email security appliances
load balancers
internet-facing management systems
network-attached storage
internet-connected operational technology
other security and networking appliances

Many organisations depend on these devices every minute of every working day. Yet there is an important difference between an employee's laptop and a firewall. If a laptop stops working, somebody complains. If it runs slowly, the IT helpdesk gets a ticket. If it needs replacing, the employee knows it exists and where it is.

A firewall can be different. It might have been purchased several years ago, installed and largely forgotten because it has continued doing its job. Ironically, that reliability can become part of the problem. When technology quietly works for years, it becomes surprisingly easy to stop asking whether it is still safe.

Attackers have noticed the imbalance

Why wrestle with the security protecting an employee's laptop if there is an outdated VPN appliance directly accessible from the internet?

An attacker does not care whether something was purchased as a security product. To them, it is simply another device running software that may contain vulnerabilities. Edge devices can be particularly attractive because of where they sit and what they are trusted to do.

A compromised laptop might provide access to one user's account or device. A compromised gateway could put an attacker at the entrance to the wider network. It is the cyber equivalent of compromising the security desk controlling access to an entire building, rather than breaking into individual offices.

When the guard becomes the intruder

Imagine a business with excellent endpoint security. Every laptop is automatically patched. Multi-factor authentication is enabled. Staff receive cyber awareness training. Endpoint monitoring can identify unusual behaviour. The organisation feels reasonably well protected. But its VPN appliance was installed several years ago, and responsibility for maintaining it is unclear. The employee who configured it has left. It isn't included in the normal laptop or server patching process. Nobody has recorded the manufacturer's end-of-support date for it. Then a serious vulnerability is discovered.

The manufacturer releases an update. Security organisations publish warnings. Attackers begin scanning the internet for vulnerable devices. But nobody in the business realises its appliance needs attention. From the organisation's perspective, nothing appears wrong.

The firewall is running and the VPN still connects. The lights are still blinking. From an attacker's perspective, however, a new door may have opened.

Why do edge devices get forgotten?

Organisations cannot protect assets they do not know about.

Businesses grow, offices move, suppliers change, companies merge and temporary projects become permanent. Over time, the original reason for installing a device can disappear while the device itself remains. A reliable inventory is therefore far more important than it sounds.

For any business, the underlying principle is simple: know what is connected to your organisation and who is responsible for it.

"We can't update it because it might break something"

Edge infrastructure is often essential infrastructure. Taking a laptop offline for twenty minutes is usually manageable. Taking the organisation's firewall or remote-access service offline, however, can affect everyone.

Before long, a temporary postponement can become a permanent risk. This is particularly dangerous because criminals do not wait patiently while organisations arrange maintenance windows.

The end-of-support trap

Eventually, every technology product reaches the point where its manufacturer stops supporting it. That can mean losing access to new features, but for an internet-facing security device, the consequences can be far more serious. Once support ends, newly discovered security vulnerabilities may no longer receive fixes. Attackers are all too aware of this.

Visibility matters as much as prevention

What happens if an attacker does compromise one of these devices? With laptops and servers, organisations increasingly collect detailed security information that can help identify suspicious activity. Some network appliances, particularly older products, provide much less visibility. This matters because, after an incident, investigators need to establish what happened, when it happened and what the attacker did next.

Without suitable logs, an organisation may know an incident has occurred but be unable to establish exactly what the attacker accessed. That can make an already difficult incident much harder to contain and investigate.

Questions to ask

What do we have? — Maintain an inventory of all internet-facing devices and security appliances, including each device's manufacturer, model, software or firmware version, location and purpose. Unknown infrastructure is unmanaged infrastructure.
Who owns it? — Every device should have a named internal owner and, where relevant, a named supplier responsible for maintaining it. Avoid leaving responsibility vaguely with "IT".
Is it still supported? — Record end-of-support dates. Plan and budget for replacement before support expires, rather than waiting until afterwards.
Is it up to date? — Establish how vulnerability alerts and manufacturer security notices are monitored. Treat critical vulnerabilities affecting internet-facing devices with urgency, rather than simply placing them in the next routine maintenance cycle.
Is it configured securely? — Remove unnecessary services and management interfaces. Restrict administrative access. Change default credentials and configurations. Use strong authentication, including multi-factor authentication where supported. Expose only what genuinely needs to be exposed.
Would we notice if somebody compromised it? — Ensure important security events are logged and, wherever possible, send those logs somewhere separate from the appliance itself. Otherwise, an attacker controlling the device may also control the evidence needed to detect their activity.
When did we last check? — Include edge equipment in vulnerability management, asset reviews, penetration testing arrangements, supplier assurance, business continuity and disaster recovery planning.