Your Firewall Hasn’t Been Patched – and Attackers Already Know It

The firewalls, VPN gateways, and remote access devices sitting at the edge of your network have become the single most exploited entry point for attackers targeting businesses under 200 employees in 2025. Not theoretical — documented. CISA’s Known Exploited Vulnerabilities catalog has logged dozens of critical edge device vulnerabilities this year alone, most of them weaponized within days of public disclosure. If your IT firm installed your firewall a few years ago and has never once mentioned firmware patching since, this is the article you need to read.

1. What Is Actually Happening in 2025
2. Why Unpatched Edge Devices Are the Preferred Target
3. The Forgotten Firewall Problem
4. The Real-World Cost of Delayed Patching
5. What a Well-Run IT Relationship Looks Like
6. Questions Every Business Owner Should Be Asking Right Now
7. The Bottom Line

What Is Actually Happening in 2025

The pattern across 2025’s major breach advisories is consistent and uncomfortable. Threat actors — from nation-state groups to financially motivated ransomware crews — are systematically scanning the internet for edge devices running outdated firmware. They are not guessing. They are using publicly available vulnerability disclosures to build exploit kits, then running automated scans across millions of IP addresses to find devices that have not been patched.

The vendors involved are not obscure: Ivanti, Palo Alto Networks, Fortinet, Cisco, SonicWall, Check Point. These are exactly the brands protecting small and mid-size businesses across New Jersey and the Philadelphia region right now. Many of the vulnerabilities being exploited are not zero-days — they were disclosed and patched by the vendor weeks or months before attacks began. The exploitation window opens not because a fix doesn’t exist, but because no one applied it.

Why Unpatched Edge Devices Are the Preferred Target

Your firewall and VPN gateway sit between the open internet and everything inside your business. They authenticate remote employees, enforce traffic rules, and in many cases inspect encrypted traffic. They are trusted by design — with elevated access to everything behind them.

When an attacker compromises one of these devices, they don’t need to trick an employee into clicking a phishing link. They don’t need to get past your endpoint protection. They are already inside, having walked through the front door with keys forged from a publicly disclosed vulnerability. From there, they move laterally across your network quietly, establish persistent access, and choose when to deploy ransomware or pull data.

This is precisely why CISA has issued multiple advisories in 2025 urging organizations of all sizes to treat edge device patching as a time-sensitive priority — not a quarterly maintenance item. The CISA advisory library is public. The urgency in its language has increased noticeably year over year.

The Forgotten Firewall Problem

Here is what makes this especially dangerous for small businesses: edge devices are typically treated as infrastructure, not software. Laptops get refreshed. Endpoints get updated. But the firewall? It gets installed, it passes traffic, and nobody discusses it again until something breaks.

This is not entirely the business owner’s fault. Many IT arrangements — particularly older break-fix or reactive support models — were never designed to include proactive firmware management for network devices. The device sits in a closet, generates no helpdesk tickets, and appears fine. It is not fine.

Firmware updates for unpatched edge devices are not optional housekeeping. In 2025, they are the difference between being a hardened target and being easy prey. A firewall running two-year-old firmware is statistically carrying multiple known, publicly documented vulnerabilities that attackers are exploiting right now. The attacker doesn’t need a new technique — just your device’s IP address and firmware version.

For businesses under 200 employees, the exposure is often worse than at enterprise organizations — not because the hardware is different, but because the processes around maintaining it are. Large companies have dedicated teams running vulnerability management programs. Small businesses have a relationship with an IT firm, and whether firmware lifecycle management is explicitly in scope varies enormously.

The Real-World Cost of Delayed Patching

The numbers are not abstract. According to NIST guidance on SMB cybersecurity, incident response engagements for small businesses commonly run from $25,000 to over $150,000 depending on scope. Ransomware payments — when organizations choose to pay — have averaged six figures for SMB victims in recent years. Add regulatory notification requirements, customer trust erosion, and operational downtime, and the true cost climbs further.

The business disruption element is frequently underestimated. When an attacker enters through an unpatched edge device and moves laterally, the entire network is potentially compromised — not just one endpoint. Rebuilding from that position can take days or weeks. For a business with thin margins or time-sensitive client obligations, that window can be existential.

The asymmetry is stark. Proactive firmware patch management — when built into a well-structured managed IT services engagement — costs a fraction of a single incident. The calculus is not close. Yet the gap between organizations that treat perimeter device patching as a continuous discipline and those that do not remains wide, especially among businesses under 200 employees.

Ransomware groups have noticed. Their tooling is purpose-built to find unpatched edge devices at scale. Automated reconnaissance across millions of IP addresses is trivially inexpensive for attackers. The only meaningful defense is closing the vulnerability before the scanner finds it.

What a Well-Run IT Relationship Looks Like

A well-run IT relationship in 2025 treats your edge devices the same way it treats your endpoints — as software-driven assets that require active lifecycle management. Here is what that looks like in practice.

Firmware patch tracking is automated and documented. Your IT firm is not waiting for a vendor email about a critical vulnerability. They are subscribed to advisory feeds, they know every device in your environment and what firmware version it is running, and they have a process for deploying critical patches within days of disclosure — not months.

Your attack surface is periodically reviewed. Old VPN endpoints, legacy remote access gateways, test environments never decommissioned — all common sources of exposure. A well-run environment audits what is exposed to the internet and removes anything that does not need to be there.

Configuration drift is monitored. Factory defaults left in place, unnecessary services left enabled, permissive firewall rules accumulated over years of “just make this work” requests — these compound over time. An engaged IT partner reviews device configurations proactively, not only when something breaks.

Vulnerability intelligence is part of the conversation. When CISA adds a new entry to its Known Exploited Vulnerabilities catalog affecting your class of device, your IT firm should know about it before you do. Ideally, the patch is already deployed before the story hits the news.

At Xact IT, this kind of proactive management is not an upgrade tier — it is the baseline. We have maintained a zero-breach record across every client we have served since 2004. That record is not an accident. It is the result of treating security as a continuous discipline, not a one-time installation. Our cybersecurity practice covers the full perimeter — including the devices most IT firms treat as set-it-and-forget-it infrastructure.

Questions Every Business Owner Should Be Asking Right Now

You do not need a technical background to ask the right questions. If you have an IT firm managing your environment — or you are evaluating whether they are doing their job — these questions will tell you most of what you need to know about how your perimeter is being managed.

• What firewall and VPN hardware is currently deployed in our environment, and what firmware version is each device running?
• When was the last firmware update applied to our firewall, and what is the process for applying future updates?
• Are we subscribed to vendor security advisories for all network devices, and who is responsible for acting on them?
• Have any CISA Known Exploited Vulnerabilities been flagged against our current device inventory in the past 12 months — and if so, how were they remediated?
• What remote access services does our company expose to the open internet, and when were they last reviewed for necessity and security posture?
• Can you provide a current asset inventory that includes all network devices, firmware versions, and end-of-support dates?

A confident IT partner answers these questions without hesitation and with documentation. Vague answers, deferred responses, or surprise at the specificity of the question are meaningful signals about the quality of service you are receiving.

The Bottom Line

The 2025 wave of attacks targeting unpatched edge devices is not a story about exotic techniques or nation-state capabilities that only large enterprises need to worry about. It is a story about basic maintenance that did not happen. Attackers are winning through patience and automation — scanning millions of addresses, finding unpatched devices that were never updated, and walking through a door left open years ago.

The practical implication is straightforward: the firewall is not a one-time purchase. It is a managed asset that requires ongoing attention. If your current IT arrangement does not include explicit, documented, proactive firmware management for every device at the edge of your network, that gap deserves attention now — not because a breach is certain, but because the probability has never been higher that someone is already scanning for exactly that opening.

The businesses that avoid breaches in 2025 are not the ones with the most expensive hardware. They are the ones with IT partners who treat every layer of the environment — including the forgotten firewall in the closet — as a live security responsibility. That is what quiet looks like.

Not sure where your perimeter stands? Book a Free Cybersecurity Strategy Call — a 20-minute conversation with our team, no pressure, no obligation. You will leave knowing exactly where your gaps are.