There is a reflex we see in almost every organization: when a risk worries us, we buy a tool. A gateway to filter email, an appliance for remote access, a console to run the wide area network, an agent to protect endpoints. Each purchase is defensible. But each one also adds an interface to expose, a component to patch, elevated privileges to protect and a contract to manage.
The last two weeks made the point almost too well, and our 9 October recap summed it up in one line: your trusted tools became the way in. This article turns that into a method. Our conviction fits in two lines: you cannot prioritize what you cannot see, and every tool you add is also a door to guard.
Why attackers go after your security tools first
It is no accident that security products and edge devices keep showing up in exploitation advisories. They combine three properties an attacker is looking for:
- They are reachable. An email gateway, a VPN concentrator or a WAN management interface sits in front of everything else by design, and answers from the internet.
- They are privileged. An endpoint protection agent runs with the highest rights on the machine; a central console pushes configurations to hundreds of devices. Compromise the tool and you inherit its rights.
- They are trusted. Their traffic is expected, their processes are allow-listed, their alerts are the ones people watch. When they go quiet, everyone assumes all is well.
What it changes: a security tool is not a special asset protected by its purpose. It is an exposed, privileged asset that deserves more scrutiny than the rest, not less.
Four families, ten days, one lesson
In late September and early October, four families of tools were either the entry point or the first thing switched off.
The email gateway. On 1 October, Fortinet confirmed active exploitation of CVE-2026-104286 (CVSS 9.8) in FortiMail: an unauthenticated attacker can write files to the appliance and run commands with a single HTTP request. When the advisory came out, the fixed versions were not yet available; the only protection was to disable a feature or cut internet access to the management interface. CISA added the flaw to its KEV catalog the same day. Status: confirmed by the vendor.
Remote access appliances. Citrix disclosed two already exploited flaws in NetScaler ADC and Gateway on 27 September, then a third on 3 October: three exploited flaws in six days in the same product. Status: confirmed by the vendor.
The WAN console. On 30 September, CISA added CVE-2026-76504 to the KEV catalog, an authentication bypass in Cisco Catalyst SD-WAN Manager that grants administrator rights. Not for the first time: we had already covered SD-WAN under active attack in June. Whoever holds that console holds the configuration of every connected site. Status: confirmed.
The endpoint agent. Researchers at Symantec and Carbon Black described attacks by the Warlock group in which operators load a signed but vulnerable driver to gain kernel access and shut down antivirus and EDR on 40 machines in about two hours, before launching ransomware. Status: reported by researchers. Back in May, three flaws in Defender and Apex One were added to the KEV catalog within 72 hours, one of which silently disabled the antimalware engine.
And the case that sums it all up is not about a product but about delegation. In early October, the FBI confirmed that an intrusion into a platform managed by a third party came from a patch that had been released but never applied by the contractor, and removed that contractor. Status: confirmed by the FBI. You can outsource the operation of a tool; you cannot outsource accountability for its exposure.
What it changes: the question is no longer "do we have the right tools?" but "do we know which ones are exposed, who patches them, and how fast?". Microsoft's Digital Defense Report 2026 puts the median time between the discovery of a flaw and its exploitation well under 24 hours. A monthly patch cycle hands attackers weeks of head start on your most exposed equipment.
Spend better, not more: every tool has a hidden cost
A security tool is budgeted as a licence. It is also paid for in surface: one more interface to reach, one more family of flaws to track, more admin accounts to protect, one more vendor whose timelines become yours.
That is why piling up tools does not necessarily reduce risk. Two overlapping products double the surface without doubling the protection. A tool that is bought and poorly run, or delegated without oversight, creates a false sense of coverage: the dashboard stays green while the agent is switched off. And when the budget follows alert volume rather than risk reduction, you are funding complexity.
Before adding a tool, three questions are enough: which named risk does it bring down? What surface does it add? And who, by name, will run it and patch it? If the answer to the third is "the vendor" or "IT", the tool is not ready to be bought.
The method: five decisions to make once
1. Inventory the exposed tools. List every security product and edge device reachable from the internet: email gateways, VPN concentrators and remote access appliances, firewalls, SD-WAN consoles, EDR management portals, remote management tools. For each one: the product, the version, the exposed interface, and whether administration is reachable from outside. This is often where the list surprises people.
2. Name who patches. For every line, a name, not a department. If a provider manages the device, the name of the person on your side who checks the patch was applied, and on what evidence. A provider's monthly report is not evidence.
3. Set the shortest patch deadline in the organization. Exposed edge devices and security products come before everything else: when a flaw is added to the KEV catalog or confirmed exploited, the clock runs in hours or days, not until the next monthly cycle. And a flaw exploited before disclosure triggers a compromise assessment, signed off by someone named: patching a device that has already been hit does not make the attacker leave.
4. Decide in advance who can switch things off. When there is no patch yet, as with FortiMail, the only protection is a decision: disable a feature, close a management interface, isolate an appliance. Write down who holds that authority, without waiting for the vendor or a committee, and within how many hours. Without that decision, your exposure window is set by the vendor's calendar, not yours.
5. Treat a silent tool as an incident. An EDR agent stopping, losing its definitions or dropping into passive mode on a server is not a glitch to look at on Monday: it is often the step right before encryption. Block the list of known vulnerable drivers, alert on agent shutdown, and keep an independent source of telemetry for the day the EDR lies.
This week's test: thirty minutes, one list
Take thirty minutes with the person who runs your infrastructure, and answer in writing:
- How many security products and edge devices do we have that are reachable from the internet? Which ones expose their management interface?
- For each one, who patches it, by name, and how many days did it take to apply the last critical patch?
- Who can switch off an exposed feature tonight, without waiting for the vendor?
- If an EDR agent stops on a server at 3 a.m., who gets alerted, and within how many minutes?
Three results should worry you. A rough guess for question 1: you cannot prioritize what you cannot see. "The vendor" or "IT" for question 2: accountability has not been assigned. Nobody for question 3: your exposure depends entirely on someone else.
What you should have in two weeks
One page. The list of your exposed security tools and edge devices, each with its version, its owner, its target patch deadline and the name of the person who can switch it off. And, in the margin, the tools that overlap or that nobody really runs: that is your first source of savings, and often your first reduction in surface.
Where FortaRisks comes in
To find out right now what an attacker sees of your interfaces, our free exposure report looks at your organization from the outside, read-only, and gives you within 48 hours a score, ranked findings and a 30-day action plan. To place your overall posture in ten minutes, the cyber risk score is free and needs no sign-up.
To make this a continuous practice rather than a yearly exercise, Forta Exposure monitors your external attack surface continuously: every exposed service is identified with its version, then linked by Forta Radar to active vulnerabilities and the KEV catalog. Forta Actions then turns those findings into a short queue of prioritized actions, each routed to the right owner and tracked until it is resolved.
Sources: Help Net Security, FortiMail CVE-2026-104286 · SecurityWeek, FortiMail · Tenable, the three NetScaler flaws · CISA, 30 September alert · The Hacker News, Cisco Catalyst SD-WAN Manager · The Hacker News, Warlock and SharePoint · The Hacker News, the FBI and its contractor · BleepingComputer, Microsoft Digital Defense Report 2026 · CISA, Known Exploited Vulnerabilities catalog