The Cybersecurity and Infrastructure Security Agency has issued one of its most pointed directives in recent memory, instructing federal agencies to identify and replace aging, end-of-life edge devices that have become prime targets for sophisticated threat actors. The directive underscores a growing and uncomfortable reality across government IT infrastructure: legacy networking equipment that no longer receives security patches has become the path of least resistance for nation-state hackers and cybercriminal organizations alike.

The guidance, reported by TechRadar, reflects CISA’s escalating concern that edge devices — routers, firewalls, VPN appliances, and other network boundary equipment — represent a systemic vulnerability when they reach end-of-life status and vendors cease issuing firmware updates or security patches. These devices, which sit at the perimeter of government networks and serve as the first line of defense against external intrusions, become increasingly dangerous liabilities once manufacturer support expires.

Why Edge Devices Have Become the Preferred Entry Point for Nation-State Hackers

Edge devices have emerged as the attack vector of choice for advanced persistent threat groups, particularly those linked to China, Russia, and other nation-state adversaries. Unlike traditional endpoints such as laptops and servers, which benefit from robust endpoint detection and response solutions, edge devices often operate with minimal monitoring and logging capabilities. They run proprietary or stripped-down operating systems that are difficult to inspect, and they frequently lack the ability to support modern security agents. When these devices reach end-of-life, the problem compounds dramatically — known vulnerabilities accumulate with no prospect of remediation through vendor patches.

Recent years have seen a parade of high-profile campaigns exploiting precisely these weaknesses. Chinese state-sponsored groups, including the cluster tracked as Volt Typhoon, have been documented compromising end-of-life small office and home office routers to build operational relay networks capable of tunneling malicious traffic through legitimate infrastructure. These compromised devices serve as launchpads for deeper intrusions into critical infrastructure networks, making detection extraordinarily difficult for defenders. The FBI and CISA have repeatedly warned about these tactics, and the latest directive represents an attempt to close the door on one of the most exploited categories of vulnerability in the federal enterprise.

The Scope of the Problem: Thousands of Devices Across Hundreds of Agencies

The scale of the challenge facing federal agencies is immense. Across the civilian executive branch, thousands of network appliances from manufacturers such as Cisco, Fortinet, SonicWall, Ivanti, and others are deployed in configurations that may have been state-of-the-art a decade ago but now represent significant security gaps. Many of these devices were procured under multi-year contracts and have remained in service well beyond their intended operational lifespan. Budget constraints, procurement complexities, and the sheer logistical difficulty of replacing infrastructure that must remain operational around the clock have all contributed to the persistence of end-of-life equipment in federal networks.

CISA’s directive is not merely advisory. The agency has the authority under Binding Operational Directives to compel federal civilian agencies to take specific actions to protect federal information systems. While the specific mechanisms and timelines associated with this latest guidance will shape the pace of compliance, the message is unambiguous: end-of-life edge devices must go. Agencies are expected to conduct thorough inventories of their network perimeter equipment, identify devices that have reached or are approaching end-of-life status, and develop remediation plans that prioritize replacement or, where immediate replacement is not feasible, implement compensating controls to reduce risk.

A Pattern of Exploitation That Has Forced CISA’s Hand

The urgency behind the directive is rooted in a series of devastating real-world incidents. Throughout 2023 and 2024, vulnerabilities in edge devices from major manufacturers were exploited at scale, often before patches were available — and in the case of end-of-life products, patches never arrived at all. Ivanti’s Connect Secure VPN appliances were hit by zero-day exploits that compromised federal agencies and private-sector organizations. Fortinet’s FortiOS saw repeated exploitation of critical vulnerabilities, with CISA issuing emergency directives to address the fallout. Cisco’s legacy routers and switches have been targeted by multiple threat groups seeking persistent access to high-value networks.

In each of these cases, the devices in question sat at the network edge, handling traffic between trusted internal environments and the untrusted internet. When compromised, they gave attackers a privileged position from which to intercept communications, manipulate traffic, and pivot deeper into target networks. End-of-life devices amplify this risk because there is no remediation pathway — once a vulnerability is discovered, the device remains permanently exposed. As TechRadar noted, CISA has been increasingly vocal about the need for agencies to take proactive steps rather than waiting for the next breach to force action.

Budget Realities and Bureaucratic Hurdles Stand in the Way

For all the clarity of CISA’s directive, implementation will be anything but simple. Federal IT procurement is governed by a labyrinthine set of regulations, approval processes, and funding cycles that can stretch timelines from months to years. Replacing a fleet of edge devices is not a matter of placing an order and swapping hardware — it requires network redesign, configuration migration, testing, and validation, all while maintaining continuous operations. Agencies with limited IT staff and competing modernization priorities may struggle to meet aggressive timelines.

Moreover, the federal government’s reliance on shared services, managed service providers, and contractor-operated infrastructure adds layers of complexity. In many cases, edge devices are managed by third parties under contracts that may not include provisions for hardware refresh cycles aligned with manufacturer end-of-life dates. Untangling these contractual and operational dependencies will require sustained attention from agency leadership, not just IT departments. The Office of Management and Budget and Congress will also play critical roles, as funding for large-scale hardware replacement must ultimately flow through appropriations processes that are themselves subject to political dynamics and fiscal constraints.

Industry Response and the Push Toward Zero Trust

The private sector has taken notice of CISA’s intensifying focus on edge device security. Major networking vendors have begun offering migration incentives and trade-in programs designed to accelerate the retirement of legacy equipment. Cisco, Fortinet, and Palo Alto Networks have all expanded programs aimed at helping government customers transition to current-generation platforms with enhanced security features, including better logging, integrated threat detection, and support for zero trust architectures.

Zero trust — the security model that assumes no device or user should be inherently trusted, regardless of network location — has become the strategic framework guiding federal cybersecurity modernization. Executive Order 14028, signed by President Biden in 2021, mandated that federal agencies move toward zero trust architectures, and subsequent guidance from CISA and the Office of Management and Budget has reinforced this direction. Replacing end-of-life edge devices is a necessary precondition for meaningful zero trust implementation, as legacy equipment often cannot support the granular access controls, continuous authentication, and micro-segmentation that zero trust demands.

The Broader Implications for Critical Infrastructure and the Private Sector

While CISA’s directive is aimed at federal civilian agencies, its implications extend far beyond the government. Critical infrastructure operators — including utilities, healthcare systems, financial institutions, and transportation networks — face identical challenges with aging edge devices. Many of these organizations rely on the same product lines and face the same economic pressures that have led to the persistence of end-of-life equipment in federal networks. CISA has increasingly used its advisories and directives as signaling mechanisms, setting expectations for the broader ecosystem even when it lacks direct enforcement authority over private-sector entities.

The message to industry is clear: if the federal government, with its vast resources and dedicated cybersecurity apparatus, considers end-of-life edge devices an unacceptable risk, private-sector organizations should take note. Insurance carriers, regulators, and auditors are likely to follow CISA’s lead, incorporating edge device lifecycle management into their risk assessments and compliance frameworks. Organizations that fail to address this issue proactively may find themselves facing not only heightened cyber risk but also increased regulatory scrutiny and higher insurance premiums.

What Comes Next: Enforcement, Accountability, and the Race Against Threat Actors

CISA’s directive marks a significant escalation in the federal government’s approach to network infrastructure security. The agency has moved beyond simply cataloging vulnerabilities and issuing advisories; it is now demanding concrete action to eliminate entire categories of risk. The coming months will test whether federal agencies can translate this mandate into operational reality at the speed required by the threat environment.

The stakes could not be higher. Nation-state adversaries have demonstrated repeatedly that they will exploit any available weakness, and end-of-life edge devices represent one of the most predictable and preventable categories of vulnerability in modern networks. CISA’s directive is both a recognition of this reality and a challenge to the federal enterprise: replace the weakest links in your network perimeter, or accept the consequences when adversaries inevitably find and exploit them. For agency CISOs, IT directors, and budget officials, the clock is now ticking.