An analysis of millions of active devices reveals a clear shift in the threat landscape: network infrastructure has become a critical risk factor. Edge hardware, particularly routers, now tops the list of the most vulnerable device types for the first time. To secure these effectively, IT teams must fundamentally change their strategy. Routers lead the list of riskiest IT devices for the first time, closely followed by serial converters and workstations. Eleven device types appear in the top rankings for the first time, including time clocks, RFID readers, BACnet routers, power distribution units, DICOM gateways, and medical imaging printers. 75 percent of the device types now classified as critical were completely absent from the list two years ago. Routers alone account for roughly one-third of the most severe vulnerabilities in enterprise networks. On average, routers and switches each have approximately 32 documented CVEs. According to the Forescout analysis The Riskiest Devices of 2026, this creates an imperative for IT, network, and security teams. Patch management, vulnerability scanning, and logging should now treat network hardware on equal footing with servers. The security stack should also include platform-specific scanners for Cisco IOS, Junos OS, FortiOS, PAN-OS, or Aruba OS-CX. On the server side, platforms from Tenable, Qualys, or Rapid7 provide equivalent services. Results feed into the same ticketing system that controls server patches, with the same SLAs and chains of responsibility. Network devices must be inventoried in the CMDB at server level. An asset inventory in which routers, switches, firewalls, and access points are recorded merely as transport infrastructure will no longer suffice in the future. Each network device therefore receives the same level of detail as a server. In the CMDB, each device includes firmware status, end-of-support date, management IP, responsible team, serial number, location, assigned VLANs, and compliance status. The reconciliation runs automatically via the APIs of network platforms and is supplemented by NetFlow and SNMP data. A vulnerability scanner with direct integration to this CMDB can mark affected devices within minutes of each new CVE. Figure 1: An increasing number of network devices are actively attacked and pose a threat to the network. External visibility complements the inventory with the attacker’s perspective. Monthly cross-referencing of your own IP blocks against Shodan, Censys, or Coalition Control uncovers management interfaces that have long been marked as unreachable in the internal inventory. Any management UI reachable from the public Internet should be moved behind a VPN, bastion host, or ACL filter as quickly as possible. Couple patch prioritization to exploit intelligence. Rigid monthly windows for router patches will no longer work in the future. According to VulnCheck State of Exploitation 2026, 28.96 percent of vulnerabilities listed in the KEV database from 2025 were actively exploited on the day of CVE publication or before. Prioritization requires exploit intelligence as an input signal. A practical pipeline combines four feeds: PSIRT advisories from the manufacturers in use provide the fastest information for specific hardware. CISA KEV marks actively exploited vulnerabilities with the highest urgency. EPSS values prioritize by the likelihood of exploitation within 30 days. ISAC feeds from your own sector (for example, IT-ISAC, Health-ISAC) finally supplement sector-specific threat data. Any vulnerability appearing in the KEV list must move directly to the next maintenance window, regardless of the quarterly plan. A dedicated network change board has proven effective for implementation, approving router and firewall patches outside of endpoint cycles and bringing together reviewers from operations and security teams. According to VulnCheck 2026 State of Exploitation: Exploiting The Network Edge, 42.5 percent of vulnerabilities exploited in 2025 affected products without manufacturer support or shortly before support end. Consumer routers and globally distributed network devices accounted for 56 percent of exploited edge vulnerabilities. Figure 2: Devices without support should no longer be deployed in networks. A binding replacement plan with fixed deadlines, budget line items in the following year, and documented replacement path ensures that devices are removed from the network before the EoS date. Automatic reminders six months before EoS in the CMDB give procurement the necessary lead time. Virtual patching as a bridge between advisory and firmware update. Attackers derive working exploits from published patches within hours. The effectiveness of a counter-patch typically occurs after an average of 30 days or more, according to TrendMicro. Virtual patching closes the gap between advisory and firmware update. Signatures on IPS devices, WAF rules before Internet-facing management interfaces, and updated detection patterns in next-generation firewalls neutralize known exploit payloads before the underlying device is patched. When selecting and maintaining this protection layer, specific CVE coverage is critical. A signature feed that only provides generic web attack patterns offers no protection against Cisco IOS-XE or Fortinet-specific vulnerabilities. The release notes of IPS and WAF vendors list the covered CVEs per update. A monthly cross-check of the hardware in use against this list shows whether the current signature generation covers critical vulnerabilities in your network devices. In OT environments with certification cycles of several months, virtual patching is often the only realistic security measure between advisory and replacement. Use threat intelligence before the CVE. Exploit activity does not begin with the public disclosure of a vulnerability. GreyNoise observed 104 activity spikes against 18 different vendors, including Cisco, Palo Alto Networks, Fortinet, Ivanti, HPE, MikroTik, TP-Link, VMware, Juniper, F5, and Netgear during the study period. In approximately half of the cases, an official disclosure by the affected vendor followed within three weeks. The median lead time of attack activity was nine days before publication. A daily dashboard with traffic observations from public sensor networks provides clues to active scanning campaigns against specific vendors. In such activity windows, your own devices from the same vendor come into closer observation. SIEM rules for these devices should run into a separate alarm channel. The warning time decides whether successful compromise prevention is possible in an emergency. Document configuration changes without gaps. After a compromise, a router or firewall provides access to routing tables, access control lists, administrator credentials in plaintext, and the traffic of all routed segments. Endpoint protection does not apply to these devices and logs are often rudimentary. Chinese campaigns Salt Typhoon and Volt Typhoon exploit this. Attackers create local administrators on network devices, escalate via privilege-escalation vulnerabilities to root rights, establish Generic Routing Encapsulation tunnels for permanent data exfiltration, and manipulate access control lists to permanently legitimize their own source IPs. Network device configuration change visibility must match the visibility level of domain controller events. Syslog, NetFlow, sFlow, and API exports from the platform