Your VPN Appliance Is the Front Door

The Decision in Front of You

Every company that lets staff, contractors or partners connect from outside runs a few devices that sit on the internet and decide who gets in. They are VPN gateways, firewalls, load balancers, remote desktop gateways and managed file transfer servers. Most were bought as plumbing. Many are patched quarterly, if a change window opens.

The decision is whether to keep treating them as plumbing or to run them as the highest-risk systems you own. That means a patch clock measured in days, monitoring that assumes they will be breached, a retirement date for each unit, and a funded plan to reduce how much of the business sits behind a single appliance.

The stakes are concrete. When CISA ordered U.S. federal agencies to disconnect Ivanti VPN appliances in February 2024, the order gave them about two days, and reconnection required a factory reset, a rebuild and a reset of every credential the device had touched ⁸. A company that faces the same event without a plan loses remote access for its workforce while the rebuild happens.

What's Happening

The edge became the main target

Verizon's 2025 Data Breach Investigations Report, covering November 2023 to October 2024 and about 12,200 confirmed breaches, found that edge devices and VPNs accounted for 22% of exploited vulnerabilities, against 3% in the prior period ³. Organizations fully fixed only 54% of those edge flaws, with a median of 32 days to do it ³.

Mandiant's M-Trends 2025 reported exploits as the top way into networks in 2024, at about one intrusion in three ⁴. The four vulnerabilities exploited most often were Palo Alto Networks' GlobalProtect flaw CVE-2024-3400, two Ivanti Connect Secure flaws, and a Fortinet management server flaw, all in edge devices ⁴. Mandiant noted that three of the four were first exploited as zero-days, and that edge devices usually cannot run endpoint detection software, so intrusions through them go unseen ⁴.

The traffic data agrees. GreyNoise recorded 2.97 billion sessions against its sensors in the second half of 2025 and counted 16.7 million aimed at Palo Alto GlobalProtect alone ⁵. More than half of the remote code execution attempts came from addresses it had never seen before, which defeats blocklists built on yesterday's attackers ⁵.

In February 2025 the cyber agencies of the United States, United Kingdom, Canada, Australia and New Zealand issued joint guidance on edge devices, one set for executives and one for practitioners, plus a specification telling manufacturers what logs their devices must keep ¹².

Five cases from 2024 and 2025

Palo Alto PAN-OS, April 2024. Palo Alto disclosed CVE-2024-3400 on April 12, 2024, a command injection flaw in the GlobalProtect VPN feature rated 10.0, the maximum severity, that let an unauthenticated attacker run code as root on the firewall ⁶. Exploitation dated back to at least March 26, and hotfixes arrived on April 14 ⁶⁷. The attacker copied firewall configuration files to a web folder and downloaded them, and planted a scheduled task to fetch further commands every minute ⁶. For about two weeks the only defense was a mitigation, and the firewall itself was the compromised system.

Ivanti Connect Secure and MITRE, 2024 and 2025. In January 2024 a nation-state actor exploited two Ivanti Connect Secure zero-days, hijacked sessions to get past multi-factor authentication, and moved from MITRE's research network into its VMware infrastructure ⁹¹⁰. MITRE, which maintains the ATT&CK framework that defenders use to describe attacks, published the intrusion so others would understand that a mature security program can still be breached through its VPN ¹⁰. CISA's directive for agencies required disconnection, factory reset, rebuild and credential rotation before any Ivanti device returned to service ⁸. A year later, on January 8, 2025, Ivanti disclosed another unauthenticated remote code execution flaw in the same product line, already exploited ¹¹. The lesson is that one product can produce repeated emergencies, and each one costs a rebuild.

Cisco ASA, September 2025. CISA's Emergency Directive 25-03 ordered federal agencies to collect forensic data from Cisco ASA firewalls, patch them, and permanently disconnect any whose support ended by September 30, 2025 ¹². The attacker, linked by Cisco to the ArcaneDoor campaign first seen in 2024, modified the device's read-only memory so the implant survived reboots and software upgrades ¹². CISA's April 2026 update states that patching does not necessarily remove an attacker and that some models need a full power-off reset ¹².

CitrixBleed 2, June and July 2025. CVE-2025-5777 let an unauthenticated attacker read memory from Citrix NetScaler gateways, and public exploits showed it could steal session tokens ¹³. GreyNoise saw targeted exploitation from June 23, almost two weeks before public exploit code appeared on July 4 ¹⁴. CISA added it to its Known Exploited Vulnerabilities catalog on July 10 and gave agencies one day to fix it ¹³. On July 17 the Dutch Public Prosecution Service disconnected its internal systems from the internet after a warning from the national cyber center about Citrix vulnerabilities. Six days later the justice minister told parliament the service was still offline, staff could log in only at office locations and had no email, and parts could stay offline for weeks ¹⁵. The national cyber center urged every NetScaler customer to investigate for misuse even after updating ¹⁵.

Fortinet FortiGate, April 2025. Fortinet disclosed that attackers who had exploited older FortiOS flaws left a symbolic link in a file system area that updates do not clear, keeping read-only access to patched devices ¹⁶. The Shadowserver Foundation counted more than 14,000 affected devices ¹⁶.

The pattern is older than these cases. In 2023 the Cl0p group exploited a flaw in the MOVEit file transfer product, and by June 2024 Emsisoft counted 2,773 organizations and about 95.8 million individuals affected ¹⁷.

Why the Usual Approach Fails

Edge devices sit between two teams. The network team owns the hardware and treats firmware updates as change-controlled events that need downtime. The security team owns vulnerability scanning and usually sees servers and laptops first. Neither owns the question of whether the VPN gateway has been compromised.

The tools that protect the rest of the estate do not reach these boxes. They run closed operating systems from the vendor. Endpoint detection agents cannot be installed, so the most capable monitoring a company owns is blind to them ⁴. Local logs are small, rotate quickly, and are the first thing an attacker on the device can alter.

Patching on a monthly or quarterly cycle misses the attack window. Verizon's median of 32 days to fix edge flaws compares with attackers who started before disclosure in the Palo Alto, Ivanti and Citrix cases ³⁶¹¹¹⁴.

Unsupported units stay in service because they still pass traffic. CISA's February 2026 directive BOD 26-02 states that unsupported edge devices face exploits for newly found flaws that will never be fixed, and cites widespread campaigns against them ¹⁸.

Finally, the VPN model itself grants broad access. A traditional VPN puts the remote user on the internal network, so a stolen session or a compromised gateway reaches far more than one application. CISA, the FBI and partner agencies said in 2024 that VPNs are prone to vulnerabilities and misconfiguration, and urged organizations to move toward zero trust designs that grant access per application ¹⁹.

The Framework: Own, Clock, Watch, Retire, Replace

Run the edge as a separate control with five parts. Each has an owner and a number that leadership sees monthly.

flowchart LR
    A[Own<br/>named inventory<br/>and owner] --> B[Clock<br/>exploited flaws<br/>fixed in 72 hours]
    B --> C[Watch<br/>logs off the box<br/>hunt after patches]
    C --> D[Retire<br/>no unsupported<br/>units online]
    D --> E[Replace<br/>access per user<br/>and application]

Own. List every device reachable from the internet: model, software version, end-of-support date, the business services behind it, and a named owner. Include devices that vendors or managed service providers run for you. BOD 26-02 gives federal agencies three months for their first inventory and requires continuous discovery within two years ¹⁸.

Clock. Subscribe to the vendor's advisories and to CISA's Known Exploited Vulnerabilities catalog, which lists flaws confirmed as attacked ²⁰. When an edge device's flaw appears there, the fix or the vendor's mitigation goes in within 72 hours, outside the normal change calendar. CISA gave agencies one day for CitrixBleed 2 and 48 hours for later Cisco firewall updates ¹²¹³. Pre-approve the emergency change so nobody waits for a meeting.

Watch. Send device logs to a system the device cannot alter, and alert on new administrator accounts, configuration exports and logins from unusual places. After every emergency patch, run the vendor's integrity tool, look for indicators the advisories list, and revoke active sessions. The Five Eyes guidance asks manufacturers for forensic logging for this reason ².

Retire. Any device past its end-of-support date comes off the internet on a dated plan. BOD 26-02 gives agencies 12 months to remove devices already unsupported and 18 months to replace all identified ones ¹⁸. A private company can use the same deadlines.

Replace. Write a two- to three-year plan to move remote access from appliance VPNs to identity-based access, often sold as zero trust network access or secure service edge. Users then reach one application at a time after the system checks who they are and the state of their device ¹⁹.

What the patch clock buys

Costs, Risks, and Tradeoffs

How to Act

Questions to Ask Your Team

1. How many devices do we expose to the internet, who owns each one, and when does vendor support end?
2. How long did we take to patch our edge devices after each of the last three emergency advisories?
3. After we patched, did anyone check whether the device had already been compromised?
4. Where do our firewall and VPN logs go, and could an attacker on the device delete them?
5. Which of our edge units are past end of support, and what is the removal date for each?
6. If we had to disconnect our VPN for a week, how would staff and contractors work?
7. What share of our remote users could reach their applications without being placed on the internal network?

Closing

Attackers now come in through the devices built to keep them out, often before a fix exists, and sometimes stay after it is installed. Run your VPN gateways, firewalls and file transfer servers as the highest-risk systems you own. Give each one an owner, patch exploited flaws within 72 hours, hunt after every emergency fix, keep logs off the box, and remove units that no longer receive updates. Then fund the move to identity-based access so the next gateway flaw opens one application instead of the whole network.