- Edge devices and VPNs went from 3% to 22% of exploitation-driven breaches in a single year, according to Verizon's 2026 DBIR.
- In the same report, exploiting a vulnerability overtook stolen credentials as the leading route to initial access for the first time.
- Patching is not enough: 42.5% of exploited edge flaws affect unsupported devices, and three in four never appear in CISA's KEV catalogue.
- The answer is not more EDR but visibility where no agent can be installed: network telemetry, out-of-band logging, configuration integrity and threat hunting.
Edge devices and VPNs have gone from 3% to 22% of exploitation-driven breaches in a single year. That figure, published in Verizon's 2026 DBIR, measures more than a passing attacker preference. It measures a decade of security investment aimed at the wrong place.
The past decade was built around the endpoint. EDR agents went onto laptops and servers, telemetry was tuned, detection rules were written. It worked well enough that attackers moved to where we cannot see them: firewalls, VPN concentrators, routers, load balancers and management appliances. Internet-facing devices running proprietary firmware, with no way to install an agent and little forensic capability. Few organisations watch them with the intensity they give their laptops.
The data behind the shift
Alongside that jump from 3% to 22%, the same study records a deeper change: vulnerability exploitation overtook stolen credentials as the leading initial-access vector, something that had not happened in the report's nineteen-year history.
The technical detail comes from VulnCheck. Of the 181 network-edge vulnerabilities exploited during 2025, only 23.7% appeared in CISA's KEV catalogue, and 42.5% affected end-of-life or unsupported devices. Most of the actual risk therefore sits outside the very lists many teams use to prioritise.
From the incident-response side, Mandiant's M-Trends 2026 points the same way: exploitation of internet-facing systems leads the initial vectors for the sixth year running, at 32% of cases where the entry point could be identified. The report also documents handoffs of initial access from one actor to another in as little as 22 seconds. Activity grouped under identifiers such as UNC6201 and UNC5807 concentrates on network devices that produce no EDR telemetry.
Nor is this one vendor's reading. CISA and the FBI, with the UK's NCSC and Australia's ASD, have published specific guidance on edge-device targeting and on the risk of unsupported equipment. When agencies in four countries converge on the same point, it is worth noting.
What has changed in a year?
A year ago the dominant story was still identity and phishing. Both still matter, but the DBIR marks a change of order: access is now won more often by exploiting a flaw than by stealing a password. At the same time, the volume of KEV vulnerabilities awaiting remediation has grown by roughly 50% in a year, and median remediation time has risen from 32 to 43 days.
What follows is a widening gap. Edge flaws are exploited within days, sometimes before a patch exists, while maintenance cycles for that equipment run to weeks or months. And when an attacker arrives that way, they leave nothing like the trail they would on a laptop. They selectively delete and restore configuration files to frustrate analysis — an anti-forensic move that on an EDR-covered endpoint would have raised alerts.
Why can't EDR protect a firewall or a router?
The short answer is that EDR does not fail; it cannot be installed there. An agent needs an operating system to run on and a way to send telemetry. Firewalls and routers run closed firmware, so they accept no agent and surrender none of the process, memory and network events that feed behavioural detection. The blind spot is not a configuration oversight but a property of the device.
That is why adding more EDR or more XDR does not close the gap. Endpoint coverage can be excellent while the attacker works comfortably at the perimeter, moving towards hypervisors, backup systems and domain controllers from a point your console never sees.
Which controls still hold when EDR can't reach?
Defence is not about replacing EDR but about surrounding it with the signals the perimeter itself emits. There are five fronts.
Network telemetry. Where there is no agent, there is still traffic. Network analysis (NDR), flow data, DNS and the perimeter's own logs form the primary detection source for anything that runs no agent.
Out-of-band logging. Send firewall, VPN and router logs to an external, immutable destination, so that deleting them on the device does not delete the evidence. That turns the attacker's anti-forensics into a lead.
Configuration integrity. Watching for unauthorised changes on network devices and comparing them against a reference configuration catches precisely the tampering that characterises these intrusions.
Attack surface and end-of-life. Knowing which devices you expose, at which firmware version and which have fallen out of support solves much of the problem, because an end-of-life device cannot be patched: it is replaced or isolated. That is the job of attack surface management, plus vulnerability management driven by real exposure rather than CVSS alone.
Hunting and response over agentless assets. A managed SOC and a threat hunting service able to search network telemetry and perimeter logs, with an incident response retainer whose scope explicitly covers network appliances.
Industrial environments are full of devices that cannot take an agent by design, which is the territory of OT security. Recent cases make the pattern plain. The FortiSandbox chain, Citrix Bleed 2 and the critical VMware vCenter and ESXi flaws all begin at equipment EDR did not cover — the same reason edge exposure now ranks among the highest-return controls.
What to watch before there is an incident
| Agentless asset | Why the agent cannot reach it | Where the signal does remain |
|---|---|---|
| Firewall / VPN | Proprietary firmware, no installable agent | Out-of-band perimeter logs, flow data, sessions and DNS |
| Router / switch | Closed system, limited telemetry | Configuration integrity and centralised syslog |
| Management appliance (RMM, SIEM) | Exposed surface with privileged access | Access logs, SIEM correlation and change alerts |
| Hypervisor / backup | Target beyond the perimeter, off the endpoint | East-west network telemetry and admin access control |
| End-of-life device | No vendor patches available | Surface inventory, isolation and planned replacement |
Rule of thumb: if a device cannot run an agent, its detection lives in the network and in logs the attacker does not control.
The conclusion is an awkward one for any board: what matters is no longer whether your EDR is good, but how much of your exposed surface sits entirely outside its reach. Until that number is measured, the perimeter stays the cheapest way in, and an organisation that in 2026 watches only its laptops is watching one room while the intruder works on another floor.
If you want that exposure measured, it is the work we do at Hard2bit as a cybersecurity company with its own SOC and threat hunting across the traffic and logs the endpoint never sees.
This article is for educational and defensive purposes. The figures come from public reports — Verizon DBIR 2026, VulnCheck, Mandiant M-Trends 2026 and official advisories from CISA/FBI, the NCSC and the ASD — available at the date of publication; the detection recommendations should be adapted to each organisation's architecture and regulatory framework.
