Self-Test: Can You Answer These 5 Questions?
If you can’t answer three of them, treat that as a finding.
- Which devices in your company are reachable from the public internet (firewall, VPN, mail gateway, remote access tool)?
- What firmware version is each one running right now?
- Is the firewall’s admin page reachable from the internet?
- How fast can you patch an internet-facing device after an advisory: hours, days, or “next window”?
- If one of these devices were already compromised, would you know?
The Window Has Shrunk to Days
Rapid7’s Q3 2026 threat report puts numbers on the problem. It measured an average of three days between public disclosure and exploitation of high-severity vulnerabilities, and 71% of tracked exploitation happened within the first week. helpnetsecurity
| Day | What happens |
|---|---|
| Day 0 | Vendor publishes the advisory and patch |
| Day 3 | Average time to first exploitation |
| Day 7 | About 71% of exploitation has already started |
| Day 30 | Your monthly patch cycle gets to it |
A 30-day cycle is not slow by old standards. It is simply built for a world where attackers took weeks to weaponize a flaw. That world is gone.
The same report adds two details that matter for planning:
- Of 43 newly exploited high and critical vulnerabilities, 34 needed neither authentication nor user interaction, so an attacker only needed network reach to the device. helpnetsecurity
- A CVSS score alone cannot tell you which systems are externally reachable or which flaws are being actively exploited, which is why a severity-sorted patch list often fixes the wrong things first. helpnetsecurity
Why the Edge Is the Target
Firewalls, VPN gateways, and remote-access appliances share a set of properties that attackers love:
- They face the internet by design, so they can be found and scanned from anywhere.
- They hold high privilege. A VPN gateway sees credentials and has a path into the internal network.
- They often can’t run an EDR agent, so the usual endpoint detection tools are blind there.
- Their logging is thin, and many organizations don’t forward those logs anywhere.
- They get patched last, because rebooting a firewall means downtime and people fear breaking connectivity.
Attackers have noticed that this one device type gives them privilege, reach, and low visibility in a single step.
What Is Happening Right Now
This is not a future risk. In just the last few weeks:
- Ransomware groups, with Qilin and Inc named by Unit 42, have been exploiting a Palo Alto GlobalProtect VPN flaw, and responders have been investigating related intrusions since early June. helpnetsecurity
- CISA confirmed that ransomware gangs are also exploiting a critical remote-code-execution flaw in WatchGuard Firebox firewalls. Bleeping Computer
- Attackers exploited a critical SonicWall SMA 1000 flaw, rated CVSS 10.0, just days after its public disclosure, and CISA added an Ivanti Connect Secure flaw to its list of exploited vulnerabilities. securityaffairs
Notice that these span many vendors. The point is not that one brand is unsafe. Every vendor ships vulnerabilities, so what decides your outcome is how quickly and carefully you respond.
Under the Hood: How an Edge-Device Intrusion Unfolds
Understanding the stages shows where to put defenses.
- Discovery. Attackers continuously scan the internet for specific appliance login pages and banners. Your device is found within minutes of an exploit becoming public.
- Exploitation. A flaw that requires no authentication lets the attacker run commands on the appliance itself.
- Credential and config theft. Appliances store VPN credentials, certificates, and network maps. Attackers copy them, which gives them valid logins that look legitimate later.
- Persistence. They plant a backdoor or modify the device so access survives a reboot, and sometimes a patch.
- Quiet waiting or resale. Of 63 underground posts Rapid7 monitored, 41 advertised remote-desktop or network access, which shows that access is bought and sold. The person who breaks in is often not the person who deploys the ransomware. helpnetsecurity
- Lateral movement and ransomware. Using the stolen access, the buyer moves inside the network, finds backups, and encrypts.
The exposed device is not just a flaw to patch. It is the first domino.
Patching Is Not Enough
If the attacker got in before your patch, patching closes the door but does not remove them. After patching an exposed device that was vulnerable and reachable, assume you may already have been touched:
- Review the logs around and after the disclosure date for unusual admin logins, new accounts, and config changes.
- Compare the current config against a known-good backup and look for unexpected rules, users, or tunnels.
- Rotate credentials and secrets the device holds: local admin, VPN accounts, pre-shared keys, certificates, and any service accounts.
- Kill active sessions and force re-authentication.
- Check for persistence using the vendor’s published indicators of compromise, if they provide them.
- Watch the internal network for the next 30 days for unusual authentication and lateral movement from the device’s network segment.
Five Myths That Cause Breaches
Myth 1: “We’re too small to be a target.”
Scanning is automated and indiscriminate. Your size is irrelevant to a scanner, and access to a small company is still sold to buyers.
Myth 2: “We patch every month, so we’re fine.”
A monthly cycle leaves a long window against a three-day average. Internet-facing devices need a faster, separate lane.
Myth 3: “MFA on the VPN stops this.”
MFA protects against stolen passwords. It does not stop a pre-authentication flaw, where the attacker exploits the appliance before any login happens.
Myth 4: “Our vendor is secure.”
Every major vendor has had exploited flaws this year. Choose reputable products, but plan for the next advisory regardless of the brand.
Myth 5: “We patched, so we’re clean.”
Only if nobody got in first. Patching ends the exposure; it does not prove there was no compromise.
A Smarter Priority Rule Than “Fix the Critical Ones”
Rank patches by three questions instead of severity alone:
| Question | If yes |
|---|---|
| Is the device reachable from the internet? | Raise priority sharply |
| Is the flaw known to be actively exploited (for example, listed in CISA’s Known Exploited Vulnerabilities catalog)? | Treat as an emergency |
| Does it need no login to exploit? | Emergency, and assume exposure already happened |
An internet-facing device with an actively exploited, no-login flaw belongs in the 24 to 72 hour lane. A medium-severity flaw on an internal-only server can wait for the regular cycle.
Harden the Front Door Before the Next Advisory
- Take the management interface off the internet. Admin pages should be reachable only from a management network or through a VPN, never from the open internet.
- Restrict who can reach the VPN login by country or IP range where practical.
- Use phishing-resistant MFA for remote access, so stolen passwords alone are not enough.
- Disable unused services and features on the device (old VPN modes, remote-management ports).
- Forward device logs to a central system so an unusual login is visible even if the device itself is tampered with.
- Keep an inventory of every internet-facing device, its model, firmware version, and support status, and retire hardware that no longer receives updates.
- Keep offline or immutable backups, because ransomware that arrives through the edge will go looking for your backups first.
A quick exposure check (only against addresses you own and are authorized to test): from a machine outside your network, scan your public IP for common management and VPN ports.
nmap -Pn -p 22,443,4443,8443,10443 <your-public-ip>If a management or admin login answers from the open internet, that is your first fix.
The 72-Hour Emergency Playbook
| When | Action |
|---|---|
| Hour 0 to 4 | Confirm whether you own the affected product and version. Check exposure. Restrict management access immediately. |
| Hour 4 to 24 | Apply the patch or the vendor’s mitigation. Take a config backup first. Have a rollback plan. |
| Hour 24 to 72 | Review logs, rotate credentials, kill sessions, and compare configs for tampering. |
| After | Monitor closely for 30 days and document what you learned for the next advisory. |
Write this down before you need it. The worst time to decide who has authority to take the VPN offline is during an incident.
How We Can Help
We supply firewalls and network security equipment, and our implementation team can install, configure, and harden them, including management-plane lockdown and VPN policy. Our monitoring and SIEM solutions bring device logs into one place so an unusual login stands out. Our identity solutions add stronger authentication to remote access, and our cyber security and backup solutions protect what sits behind the edge.
Already running a firewall or VPN we supplied? Send us the model and firmware version, and we will help you check it against current advisories and review its exposure.
The Bottom Line
Attackers are not breaking in through the windows anymore. They are walking through the front door the moment it is found unlocked, and the time they give you is measured in days. You do not need to patch everything instantly. You need to know which devices face the internet, rank them by real risk, keep a fast lane for emergencies, and assume that a patched device may still need a check.
Talk to Revolution Technology BD
- Firewall:
https://revolutiontech.com.bd/products/thirdCategory/390 - Firewall Implementation Service:
https://revolutiontech.com.bd/services/details/implementation-installation-firewall - Network Monitoring Solution:
https://revolutiontech.com.bd/products/thirdCategory/615 - SIEM Solution:
https://revolutiontech.com.bd/products/thirdCategory/616 - Identity & Access Management:
https://revolutiontech.com.bd/products/thirdCategory/617 - Cyber Security:
https://revolutiontech.com.bd/products/subCategory/157 - Data Backup Solutions:
https://revolutiontech.com.bd/products/subCategory/220
