Edge exploitation patterns: what security teams need to act on now

TL;DR: Edge exploitation is concentrating on VPNs, infrastructure sourcing, and long-tail vulnerabilities, while 52% of remote code execution attempts came from previously unseen IPs, according to GreyNoise, which analyzed 2.97 billion sessions over 162 days in H2 2025. The signal is clear: static defenses and recency-biased patching leave internet-facing systems exposed to fast-changing attack infrastructure.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “2026 GreyNoise State of the Edge Report: Where Attacks Concentrate and Defenses Fall Short”.

By the numbers:

• GreyNoise analyzed 2.97 billion sessions over 162 days in H2 2025.
• 52% of remote code execution attempts came from IPs with no prior history in GreyNoise data.

Key questions

Q: How can security teams detect edge device exploitation?

A: Security teams detect edge device exploitation by monitoring internet-facing appliances for unexpected reboots, configuration changes, new admin accounts, and outbound connections that do not match normal management traffic.

Q: Why do fresh attacker IPs make edge defence harder?

A: Fresh IPs break the assumption that threat intelligence will identify bad infrastructure before it is used.

Q: What breaks when patching focuses on individual CVEs instead of attack chains?

A: You can close a headline flaw and still leave the attacker’s next step open.

Practitioner guidance

• Harden internet-facing remote access paths Review VPNs, firewalls and routers as privileged entry points, then verify MFA, posture checks, patch status and exposure on every externally reachable access path.
• Retire reputation-only blocking decisions Use exploit behaviour, request patterns and session anomalies as primary signals, because attacker infrastructure now turns over faster than static blocklists can age.
• Prioritise long-tail CVEs by reachability Rank exposed assets by exploitability and business criticality, then keep old but reachable vulnerabilities in the same remediation queue as current ones.

Bottom line: Edge systems are now a concentrated attack surface where VPNs, routers and AI endpoints attract disproportionate scanning and exploitation.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →