The Box You Bought to Keep Attackers Out Is How They Got In

The firewall is the one piece of IT that small businesses genuinely believe is handled.

Somebody installed it. It has a brand name on it. It cost more than the workstations. It sits in the closet with a solid green light, and in most of the offices we walk into, nobody has logged into it since the day it went in — which was often four years and two owners of the IT relationship ago.

That box is now the single most reliable way into a small business network. Not a phished employee, and not a weak password on the accounting share. The security appliance itself.

This is not a hypothetical trend piece. Through the first half of 2026, exploitation of internet-facing firewalls and VPN gateways became the dominant initial-access method for ransomware crews, across every major brand a small business might own. If you have a FortiGate, a SonicWall, a Palo Alto, a Citrix gateway, or a Check Point appliance with SSL-VPN turned on and facing the internet, this post is about your network specifically.

What actually happened this year

A quick tour, because the pattern matters more than any single flaw.

In January, CISA published guidance on active exploitation of a Fortinet authentication-bypass vulnerability, CVE-2026-24858. In February it escalated: a FortiOS SSL-VPN zero-day, CVE-2026-0847, carrying a CVSS score of 9.8, serious enough that CISA issued a Binding Operational Directive over it. Researchers counted roughly 47,000 FortiGates exposed to the open internet at the time. By July, twenty-six separate Fortinet CVEs sat on CISA’s Known Exploited Vulnerabilities catalog — meaning twenty-six confirmed to be used in real attacks, not theoretical.

SonicWall had its own year. Rapid7’s incident response team found two SMA1000 zero-days already being exploited in the wild, CVE-2026-15409 and CVE-2026-15410. That followed a longer run of SSL-VPN intrusions where the Akira ransomware group worked through SonicWall appliances, documented by Huntress, abusing a flaw that in many cases let them get past multi-factor authentication entirely.

Then there is the case that should genuinely worry you. The Interlock ransomware group was exploiting a critical flaw in Cisco Secure Firewall Management Center for thirty-six days before Cisco publicly disclosed it. For over a month there was no patch, no advisory, and no CVE to search for. A well-run shop doing everything correctly was still exposed, because there was nothing to do.

Zoom out and the shape is unmistakable: a coordinated wave against edge appliances from Palo Alto, Fortinet, Citrix, and Check Point, with ransomware-as-a-service affiliates like Qilin chaining authentication bypasses to credential harvesting and moving to encryption within days of a CVE going public. In several investigated incidents, attackers were active on the device within minutes of identifying it.

Why the firewall is the prize

Attackers did not drift toward edge devices by accident. They are, from an attacker’s point of view, close to the perfect target.

It is deliberately reachable. Every other asset you own can hide behind something. The firewall’s entire job is to be exposed. You cannot make it unreachable without making it useless.

Compromising it usually skips authentication entirely. The bugs being exploited are not weak-password problems. They are authentication bypasses: the device answers a malformed request by simply not asking who you are. This is why “but we have MFA on the VPN” has not been saving people. MFA sits behind a login prompt. An auth bypass does not visit the login prompt.

It sees everything. A compromised firewall or VPN gateway hands over privileged network position across every segment it protects, plus a credential trove: cached VPN logins, LDAP or Entra bind accounts, and often domain credentials configured for authentication passthrough.

It is a terrible place to be watched from. Your EDR runs on Windows endpoints. It does not run on the appliance. Most small businesses ship no appliance logs anywhere, so activity on the device leaves no trail anybody reviews. In one investigated FortiGate case the initial compromise happened in late November 2025 and went undetected until February 2026. Roughly two months of quiet residency before anyone noticed.

It survives your incident response. This is the part that ruins recoveries. A business gets hit, rebuilds servers from backup, resets passwords, declares victory — and the attacker walks back in through the same unpatched appliance, because nobody thought the firewall was the problem. We have watched this happen. It is demoralizing and expensive.

Once inside, the playbook is consistent: harvest credentials, establish a backdoor for persistence, escalate privileges, disable defenses, hunt down and delete the backups, then encrypt. That backup-hunting step is not incidental — industry data puts the share of ransomware incidents that specifically target backup locations at around 96%. Your backup is not a bystander in this. It is a named objective.

Why this hits small businesses harder

Enterprises get exploited too. But they usually have someone whose actual job includes firmware. Small businesses have a specific structural gap, and it looks like this:

The firewall was bought as a project rather than a service. Somebody was hired to install it. They configured it, handed over a PDF, invoiced, and left. There was never a line item for “keep this patched for the next five years,” so there is no owner. When a critical CVE drops on a Thursday afternoon, there is no one whose phone buzzes.

Then it compounds:

• Nobody knows the end-of-support date. An appliance past end of life stops receiving firmware fixes entirely. It keeps passing traffic and showing a green light, which is exactly what makes it dangerous. We routinely find production firewalls that stopped getting security updates two or three years ago.
• The support contract lapsed. On most brands, firmware updates require an active subscription. Let it expire and you are locked out of the patch even when you want it.
• SSL-VPN got turned on in 2020 and never turned off. A remote-access method stood up in a hurry during the pandemic, for staff who now work in the office, still listening to the entire internet.
• The admin interface faces the WAN. Convenient for whoever installed it. Convenient for everyone else too.
• Patching means downtime, so it never happens. Firmware updates drop the internet for ten minutes. No one wants to own that during business hours, and nobody schedules the after-hours window.

None of this is stupidity. It is what happens when a durable security control gets bought like a piece of furniture.

What to actually do

Ordered by how much risk each item removes per hour of effort. Do them in this order.

1. Find out what you have and when it dies

You cannot manage what you have not written down. For every internet-facing appliance: make, model, firmware version, end-of-support date, whether the support subscription is current, and who is responsible for updating it. Put a human name in that last field.

The end-of-support date is the one people skip and the one that matters most. If any device is already past it, everything else in this list is rearranging furniture — the box needs to be replaced, and no amount of configuration hardening substitutes for a device that can no longer receive fixes.

2. Get SSL-VPN off the open internet

This is the highest-leverage change available to most small businesses, and it is the one we push hardest.

Traditional SSL-VPN puts a login portal on the public internet and grants network-level access on success. Everything about that model is what attackers are exploiting. The modern alternative, zero-trust network access or per-application access brokered through your identity provider, removes the public portal entirely. There is no listening service for a scanner to find, access is scoped to specific applications rather than the whole network, and authentication happens at the identity layer where your MFA and conditional access policies actually apply.

If you cannot make that move immediately, reduce the blast radius today: restrict VPN portal access to known source IP ranges, require certificate-based authentication, and disable any local appliance accounts that bypass your identity provider.

Worth saying plainly: for a lot of small businesses that never really needed network-level remote access, the right answer is not a better VPN. It is no VPN, because the applications people actually use already live in Microsoft 365. Our Microsoft 365 managed services work is frequently how that transition happens, and it usually simplifies the network rather than complicating it.

3. Make firmware patching somebody’s actual job

Edge-device firmware needs a real cadence with a named owner and a defined emergency path: a documented answer to “a CVSS 9.8 auth bypass in our firewall was published two hours ago, what happens now?” If the honest answer is “somebody notices eventually,” that is the finding.

In practice that means monitoring advisories for the specific models you own, a scheduled maintenance window nobody has to negotiate each time, and an out-of-band process that can push a critical firmware update within 24 to 48 hours instead of at the next quarterly review. Given how fast exploitation followed disclosure this year, a 30-day patch cycle for edge devices is not a patch cycle. Our patch management service exists because this specific gap is where we find the most real risk in small business networks, and remote monitoring and management is what makes an emergency window actually executable at 9pm on a Friday.

4. Send the appliance’s logs somewhere it cannot reach

An attacker on the device can clean up after themselves locally. They cannot edit logs that already left the building. Forward firewall and VPN logs to external storage or a SIEM, and set alerts on the handful of events that matter: administrator logins, configuration changes, firmware changes, new VPN user accounts, and VPN authentications from geographies where you have no staff.

This is the difference between a two-month dwell time and a two-hour one. It is also, for most small businesses, the cheapest item on this list.

5. Assume the appliance will fall, and plan for it

Because sometimes there is no patch. The Cisco FMC case had a thirty-six-day window with nothing available. Defense in depth is what covers that gap.

• Immutable backups, offsite, with restores actually tested rather than assumed. If the backup can be deleted by someone holding domain admin, it is not a backup — it is a copy. Cloud backup solutions done properly means the attacker cannot reach the restore point even with full network control.
• Segment the network so the flat LAN behind the firewall is not one continuous space from the guest Wi-Fi to the accounting server.
• Rotate credentials after any edge-device CVE, whether or not you think you were hit. Patching a device that already leaked your LDAP bind account fixes the door and leaves the key under the mat.
• Do not trust the VPN as a security boundary. Access to the network should not equal access to applications.

6. Take the management plane off the internet

The firewall’s own admin interface should never be reachable from the WAN. Restrict management to the internal network or a jump host, enforce MFA on administrator accounts, and delete the leftover local admin logins from previous providers. On that last point: if your IT relationship has changed hands in the past few years, assume the credentials from the prior arrangement still work until you have personally confirmed otherwise.

Questions worth asking whoever manages your network

If you outsource IT, these five questions will tell you where you stand faster than any assessment. Ask them by email so you have the answers in writing.

1. What make, model, and firmware version is our firewall, and what is its end-of-support date? A provider who has to go look is telling you something.
2. Is our support subscription active, and when does it renew? Expired means no patches.
3. Is SSL-VPN enabled and internet-facing? If so, why, and who still needs it? “It has always been on” is not a reason.
4. When was firmware last updated, and what is our process when a critical CVE is published? You want a named owner and a timeframe.
5. Where do the firewall’s logs go, and who looks at them? “The device keeps them” means nobody looks at them.

Fair warning about what you might hear back. “It’s behind the firewall so it’s fine” is circular. “We’d have to check with the manufacturer” on a basic model question means no inventory exists. And if firmware patching turns out to be billable time nobody ever authorized, that is worth knowing — because it means it has not been happening, and it explains why.

If you would rather not run that conversation yourself, that is exactly what an outside review is for. Our managed cybersecurity services treat edge devices as monitored, patched, logged infrastructure rather than furniture, and our IT infrastructure support work usually starts by building the inventory that should already exist.

The uncomfortable summary

For years the advice to small businesses was to buy a good firewall and keep employees from clicking things. The second half still holds. The first half quietly became conditional: a good firewall that nobody patches is now a liability with a warranty.

That is not an argument against having one. It is an argument that a security appliance is a service you maintain, not a product you purchase. The businesses getting hurt this year are not the ones with cheap firewalls. They are the ones whose firewall has not been logged into since installation — which, in our experience across New Hampshire, Massachusetts, and Virginia, is most of them.

The good news is that this is a solvable problem with a short list, and steps one and two alone remove most of the exposure. You do not need a bigger security budget. You need someone to own the box.

If you want an honest read on where your edge devices actually stand — firmware, end-of-support dates, what is exposed, what is logged — that is included in our free cyber security audit. You keep the findings whether or not you ever hire us, and if your current provider is handling this well, we will tell you that too. Or just get in touch and ask.