Edge Device Risk Executive Briefing for Boards

The firewalls, VPN gateways and other appliances bought to keep attackers out have become one of the most common ways attackers get in. This briefing is for directors, chief executives, audit and risk committee members and CISOs who need to understand edge device risk in business terms: why internet-facing appliances are targeted, why "we patched it" is not the same as "we are safe", what end of support means for the balance sheet, and how to test management's answers. It stays at board level. The technical controls are in the Edge Device Security Guide and attacker behaviour in the Edge Device Exploitation by Threat Actors Guide.

The risk in one paragraph

Every organisation has a boundary between its internal network and the internet, and that boundary is made of devices: firewalls, VPN and remote access gateways, routers, load balancers and file transfer appliances. They must be reachable from the internet to do their job, they hold the keys to the network (administrator accounts, directory connections, certificates and the sessions of every remote user) and they are closed boxes on which the organisation usually cannot run its own security tools. When a flaw is found in one, attackers can scan the whole internet for vulnerable devices within days, sometimes before a fix exists. A compromised appliance lets them read traffic, steal credentials and move inside while appearing to be part of the security estate itself. Patching closes the flaw but does not remove an attacker who got in first. The board can influence the outcome through three decisions: how many such devices face the internet, how quickly unsupported ones are replaced, and whether the organisation can detect and investigate a compromise when it happens.

Why this is a board-level issue now

Exploited flaws now lead breach statistics. Recent industry breach reports, including the Verizon Data Breach Investigations Report, rank vulnerability exploitation among the leading ways attackers get in. Internet-facing appliances are where many of those exploits land.
Governments are acting in concert. In February 2025 the Australian Signals Directorate published executive and practitioner guidance on edge devices with the US, UK, Canadian, New Zealand and other partner agencies. In February 2026 CISA, the FBI and the UK NCSC issued a joint alert on end-of-support edge devices, alongside CISA's Binding Operational Directive 26-02, which requires US federal civilian agencies to manage the lifecycle of their edge devices to reduce the risk from end-of-support equipment. The agencies strongly encourage every other organisation to follow the same approach.
State-sponsored groups specialise in this route. Groups such as Volt Typhoon and Salt Typhoon have been the subject of joint government advisories describing their use of routers and other network devices for access and concealment. Criminal ransomware groups use the same flaws once they are public.
Management interfaces on the internet are now treated as unacceptable. CISA's BOD 23-02 gives US federal agencies 14 days to remove internet-exposed management interfaces of routers, firewalls, VPN concentrators, proxies and load balancers from the internet or put them behind a separate zero trust enforcement point. That is a clear benchmark for any board.
Unsupported devices are a known, dated liability. When a manufacturer stops issuing patches, every future flaw stays open for as long as the device stays in service. Replacement is a capital decision, which is why it belongs with the board and not only with IT.

How edge device compromise unfolds, in business terms

Stage	What happens	Business consequence	Control management should evidence
Exposure	Appliances and their admin pages are reachable from the internet; some are unsupported	The organisation is on attackers' scan lists before any flaw is announced	Complete inventory with support dates; no management interface on the internet
Exploitation	A flaw is used, often within days of disclosure and sometimes before a patch exists	An attacker controls a trusted security device	Patch time targets for edge devices; emergency change process; supplier advisories monitored
Credential theft	Admin accounts, directory connections, VPN sessions and certificates are taken from the device	Access survives the patch; the attacker can log in as staff or as the device	Credential rotation after any suspected compromise; phishing-resistant MFA for admins
Persistence and concealment	Implants or configuration changes keep access; logs are thin or altered	Long dwell time and an investigation that cannot answer what was taken	Central logging off the device; integrity checks; investigation retainer
Impact	Data theft, ransomware, espionage or use of the device to attack others	Outage, notification duties, regulatory and reputational harm	Tested response plan for edge compromise; replacement stock or alternative access path

In MITRE ATT&CK terms the entry points are Exploit Public-Facing Application (T1190), External Remote Services (T1133) and Valid Accounts (T1078). Management should be able to show which edge devices are covered by detection for each.

Five questions for the board to ask

How many internet-facing devices do we have, and how many are past or within 12 months of end of support? A credible answer is a number from a scan reconciled with an inventory, with support dates per device, not an estimate.
Can anyone on the internet reach the administration page of any of our firewalls, VPNs or routers? The answer should be no, verified by an external scan, with exceptions approved and dated.
When a critical flaw is announced in one of our edge devices, how long do we take to mitigate it, and what did we do last time? Expect a target measured in days or hours for actively exploited flaws, and evidence from a recent event.
If one of these devices had been compromised before we patched it, how would we know? Look for logs held off the device, integrity checking, a compromise assessment step after emergency patches and a named investigation partner.
What credentials live on our edge devices, and could we rotate them all within a day? Directory service accounts, admin accounts, certificates and shared secrets on appliances are non-human identities. A good answer names them and shows a rotation runbook.

Red flags in management answers

"It's a security product, so it's secure": appliances run complex software with their own flaws and need the same scrutiny as any internet-facing application.
"We patched it the day the fix came out": necessary, but it says nothing about whether the device was compromised before the fix. Ask what was checked after patching.
"The supplier manages it": suppliers issue patches and guidance; configuration, exposure, logging and credential rotation remain the customer's responsibility.
"We'll replace it at the next refresh": if the device is already unsupported, the refresh date is the date the organisation accepts an open door. Ask for the exception, its owner and its compensating controls.
"We have no logs from that device": without logs held elsewhere, an incident cannot be scoped, which can turn a contained event into a notifiable one by default.
Inventory from memory: a list compiled by asking teams, rather than from external scanning, almost always misses devices in branch offices, acquisitions and test environments.

What good looks like

Area	Weak position	Good position
Inventory	Spreadsheet maintained by hand	External scan reconciled monthly with an asset register holding support dates and owners
Exposure	Admin pages and unused services reachable from the internet	No management interface on the internet; unused features and ports disabled
Lifecycle	Devices run until they fail	Funded replacement plan; no device past end of support without a dated, board-visible exception
Patching	Edge devices patched in the normal monthly cycle	Separate, faster target for edge devices, with an emergency change route
Authentication	Shared or local admin passwords	Phishing-resistant MFA for administrators; individual accounts; credentials vaulted and rotatable
Visibility	Logs stay on the device	Logs sent to central monitoring and kept long enough to investigate
Buying	Price and features only	Security requirements in procurement, including logging, support life and secure-by-design commitments

These positions follow the seven mitigation strategies in the 2025 joint executive guidance: know the edge, procure secure-by-design devices, apply hardening guidance and patches, use strong authentication, disable unneeded features and ports, secure management interfaces and centralise monitoring.

Where to invest first

Visibility of the edge: external attack surface scanning and an inventory with support dates. It is cheap and every other decision depends on it.
Removing exposure: taking management interfaces off the internet and turning off unused VPN, portal and legacy services. Mostly configuration effort, with immediate risk reduction.
Replacing unsupported devices: the largest cost line, so prioritise by exposure and by what the device protects. Where the remote access architecture is being replaced anyway, consider whether zero trust network access reduces the number of internet-facing appliances. See the ZTNA Guide.
Logging and investigation readiness: central logging for every edge device and a retainer or in-house capability that can examine an appliance after an emergency patch.
Credential hygiene on appliances: individual admin accounts with phishing-resistant MFA, and a tested runbook to rotate every secret the devices hold.

Metrics to track

Metric	Why it matters	Direction
Internet-facing edge devices past end of support	Each is a permanent open risk	To zero, with dated exceptions
Management interfaces reachable from the internet	Direct route to device control	Zero
Median time to mitigate actively exploited flaws on edge devices	Speed is the main defence once a flaw is public	Falling; target set by policy
Edge devices sending logs to central monitoring	Determines whether an incident can be scoped	100%
Edge admin accounts with phishing-resistant MFA	Stops stolen passwords becoming device control	100%
Devices discovered by scan but missing from the inventory	Measures inventory quality	Falling to zero

For presenting these to the board, see the Board Cyber Risk Reporting Guide.

A 90-day plan

Days 1 to 30, see the edge: run an external scan, reconcile it with the asset register, record the manufacturer support date for every device, and confirm which management interfaces are reachable from the internet. Report the counts to the risk committee.
Days 31 to 60, close the obvious doors: remove internet access to management interfaces, disable unused services, move administrators to individual accounts with phishing-resistant MFA, and send logs from every edge device to central monitoring.
Days 61 to 90, plan the rest: approve a funded replacement plan for unsupported and near-end-of-support devices, set a patch time target for edge devices, rehearse an edge compromise scenario using the Edge Device Compromise Investigation Playbook, and add security requirements to the procurement standard.

The replacement work itself is covered in the Edge Device End of Life Replacement Playbook.

Common failure patterns

Patch and forget: applying the fix for an exploited flaw without checking for compromise or rotating credentials, leaving an attacker with valid access.
Unfunded end of life: knowing a device is unsupported but leaving replacement in next year's budget, so the exception becomes permanent.
Forgotten devices: appliances in branch offices, acquired companies or test environments that never reach the inventory.
Treating the device as trusted: allowing an edge device broad access inward, so its compromise reaches the directory, file stores and backups.
No logs when needed: discovering during an incident that the device kept only a few hours of logs locally.

Practitioner checklist

Maintain an edge device inventory reconciled with external scanning, holding owner, location and manufacturer support date.
Confirm no management interface is reachable from the internet; verify by external scan.
Set and measure a separate patch time target for actively exploited flaws on edge devices.
After any emergency patch, run a compromise check and decide on credential rotation.
Give every administrator an individual account with phishing-resistant MFA.
Inventory and be able to rotate all credentials held on appliances: directory accounts, local admins, certificates, shared secrets and API keys. See the Service Account Security Guide.
Send logs from every edge device to central monitoring with retention sufficient to investigate.
Hold a funded, dated replacement plan for every unsupported device, with board-visible exceptions.

Standards and references

ASD's ACSC and partners: Mitigation Strategies for Edge Devices, Executive Guidance
CISA, FBI and NCSC: Reducing the Attack Surface for End-of-Support Edge Devices
CISA: BOD 23-02 Mitigating the Risk from Internet-Exposed Management Interfaces
Verizon: 2026 Data Breach Investigations Report
MITRE ATT&CK: T1190 Exploit Public-Facing Application
NIST SP 800-53 Rev. 5: CM-8 System Component Inventory, SA-22 Unsupported System Components, SI-2 Flaw Remediation, AC-17 Remote Access; NIST CSF 2.0 ID.AM-01, ID.RA-01, PR.PS-02

How NHI Mgmt Group can help

We provide independent board briefings and risk assessments on the identities that edge devices hold and rely on: administrator accounts, directory service accounts, certificates and API keys. Our NHI Foundation Level Training Course helps security and infrastructure teams govern these non-human identities. Contact us to arrange a briefing.

Edge Device Risk Executive Briefing: Firewalls, VPNs and Exploited Appliances