TL;DR
Most IT and security teams treat “is it still running?” as the test for whether a firewall, router, or VPN appliance is safe to keep. It isn’t. In February 2026, CISA issued Binding Operational Directive 26-02, ordering federal agencies to inventory and replace edge devices that have reached end-of-support — citing active, widespread exploitation campaigns by nation-state actors. Independent research backs up why: VulnCheck found that more than four of every ten vulnerabilities exploited in 2025 involved products that had already reached end-of-life status, and Cisco’s own Talos threat intelligence unit found two of the top three vulnerabilities attackers went after in 2024 were sitting in unsupported network hardware. The device still passes traffic. It just stopped being defensible the day the vendor stopped patching it — and almost nobody tracks that date.
The Status Quo Trap: “It’s still under contract, so it’s still covered”
Ask most IT directors how they know their firewall, edge router, or VPN gateway is secure, and the answer is usually some version of: “we have a support contract” or “it hasn’t given us any problems.” Both answers conflate two different things — a maintenance renewal and a vendor’s actual patch-issuance lifecycle. A device can be fully paid-up on a support contract while its hardware platform or firmware branch has already crossed the vendor’s Last Date of Support, meaning no new security patches will ever be issued for it again, contract or no contract.
This gap persists because hardware refresh competes against headline-grabbing budget lines — a new SD-WAN rollout, a SASE migration, a cloud project — for the same capex pool, and “the firewall still works” is an easy argument to win when nobody’s tracking end-of-life dates against the asset inventory. Network edge devices that have reached end-of-life status continue to pose a significant security risk in enterprise environments, and more than four of every 10 vulnerabilities exploited during 2025 involved products that had reached end-of-life status or likely end-of-life status, according to VulnCheck. Attackers aren’t guessing at this — about two-thirds of the vulnerabilities linked to botnet activity involved devices that were no longer receiving active support from manufacturers. They scan for exactly this blind spot because it’s reliably there.
And this isn’t a theoretical federal-government problem. CISA’s new binding operational directive comes amid persistent concerns about nation-state adversaries targeting end-of-service edge devices, like routers — once an edge device is exploited, threat actors can gain initial access to networks, move laterally, disrupt operations and exfiltrate sensitive data. The same unsupported Cisco, SonicWall, Fortinet, and Ivanti platforms sitting in a federal closet are sitting in commercial data closets too — the directive just forces one sector to finally look.
The Tele Data Guru Framework: The Edge Device Lifecycle Risk Matrix
Before you trust any firewall, router, switch, or VPN gateway to sit on your network perimeter, map it against the five stages every vendor’s hardware actually moves through — not the single “is it broken yet?” question most teams ask instead:
| Lifecycle Stage | Patch Availability | Vendor Support | Breach Risk | Common Buyer Blind Spot |
|---|---|---|---|---|
| Full Support (Active) | Full security and feature patches | Complete — new hardware still sold | Baseline | None — this is the assumed state everyone budgets around |
| End-of-Sale (EoS) | Security patches continue | No new units sold; existing units still maintained | Low, unchanged | Teams assume EoS means “stop using it” — it doesn’t yet |
| End-of-Software-Maintenance | Bug fixes stop; critical security patches may continue | Feature development frozen | Rising | IT assumes “maintenance” only means features, not security |
| End-of-Vulnerability/Security Support | No further security patches issued, ever | Support contract may still be technically active | High — known CVEs will never be fixed | The exact gap CISA’s directive targets: paid support without patches |
| Last Date of Support / End-of-Life | None — device is frozen in place | None | Severe — publicly known exploit chains, no remediation path | “It’s still running” is treated as proof it’s fine |
The dangerous middle isn’t the device nobody’s heard of running since 2012 — it’s the appliance in stage four, still under a support contract, still issuing renewal invoices, that quietly stopped receiving the one thing that actually matters. Two of the top three vulnerabilities that threat actors tried to leverage in 2024 were in end-of-life network devices that manufacturers had stopped issuing patches for, according to a Cisco Talos report, which underscores the importance of decommissioning and replacing EOL components as soon as possible.
The Edge Device Exposure Cost Formula
Risk-Adjusted Breach Exposure = (Baseline Breach Probability × Breach Probability Multiplier) × Average Breach Cost − Refresh/Replacement Cost
Illustrative example: assume a mid-sized enterprise carries a baseline annual probability of a material network breach of roughly 10%. One analysis of firewall and VPN lifecycle risk found that organizations running end-of-life network software or hardware are 3.0 times more likely to suffer a breach — pushing that same organization’s effective probability to roughly 30%. Against a global average data breach cost of $4.44 million and a US average that is significantly higher at $10.22 million (IBM Cost of a Data Breach Report 2025), the expected-loss swing for a US-based organization runs from roughly $1.02M at baseline to over $3.0M at the 3x multiplier — a shift of roughly $2M in risk-adjusted exposure. Compare that to the typical five-figure cost of refreshing a single edge firewall or router stack, and the “wait for next budget cycle” decision stops looking like cost control and starts looking like the more expensive option.
Commercial Realities & Vendor Pitfalls
- A support contract renewal invoice is not proof of patch availability. Many organizations keep paying for “support” on hardware that has already crossed its vendor’s security-patch cutoff date — the invoice still arrives, the patches don’t.
- Federal deadlines are a preview of attacker behavior, not just a compliance checkbox. Under BOD 26-02, agencies get roughly three months to inventory unsupported edge devices and up to eighteen months to replace them — but a warning about a Chinese state-sponsored espionage campaign also included recommendations to upgrade any “unsupported network devices” well before the directive existed. Attackers were already exploiting this gap; the directive just codified the response.
- Cyber insurers are starting to write EOL exclusions directly into policy language. Standard end-of-life and unsupported-system exclusion endorsements deny indemnity for losses arising from hardware or software whose manufacturer has stopped issuing patches — meaning an unsupported edge device can void the exact coverage you’re counting on if it’s the entry point.
- “Extended support” upsells are not the same as a fix. Vendors frequently offer paid extended-support tiers after a platform’s standard end-of-life date — these can buy time for a phased migration, but they rarely restore full security-patch issuance, and procurement teams sometimes mistake the invoice for the remediation.
- Nation-state actors specifically hunt this inventory gap. The Volt Typhoon campaign compromised thousands of small-office/home-office routers and firewalls, with a particular focus on end-of-life equipment from Cisco and Netgear — the targeting wasn’t random; unsupported edge hardware was the selection criteria.
Implementation Checklist
- Build a complete inventory of every edge device — firewalls, routers, switches, VPN gateways — by exact model number and firmware version, not just asset tag or serial number.
- Cross-reference every device against its manufacturer’s published End-of-Sale, End-of-Software-Maintenance, and Last-Date-of-Support pages, and repeat this review at least quarterly.
- Flag any device within 12 months of its Last Date of Support as a mandatory refresh-budget line item — not a discretionary “nice to have” competing against other capex projects.
- Contact your cyber insurance carrier directly and ask, in writing, whether end-of-life or unsupported-system exclusions apply to your current policy — before a claim depends on the answer.
- For any device that can’t be replaced immediately, document compensating controls: network segmentation, disabling internet-facing management interfaces, and enhanced monitoring on that segment.
- Establish a rolling three-to-five-year hardware replacement calendar tied to budget cycles, so the next refresh decision is scheduled — not triggered by a breach.