Securing all edges is hard because there is no longer one edge. Branch offices, cloud networks, home workers, mobile devices, partner links and IoT each form their own boundary, run different software and have different owners. Start with an inventory, stop trusting location, and patch internet-facing devices first.
What counts as an edge?
Any point where your systems meet something you do not control. The office firewall is one. So are a remote worker's laptop on home Wi-Fi, a cloud virtual network peered with a vendor, a retail store router, a VPN gateway and a sensor on a factory floor.
NIST SP 800-207 describes the reason the single boundary stopped working. Enterprise networks now include remote users, personally owned devices and cloud assets that are not located within an enterprise-owned network boundary. Its answer, zero trust, grants no implicit trust to an asset or account based on where it sits on the network.
Why do edges multiply faster than teams?
Three forces. Each new SaaS tool, cloud account or partner connection adds an edge without a security review. Edge devices are often managed by a facilities or branch team rather than IT. And edges are many but small, so the budget for each is small.
Adversaries notice. Internet-facing devices such as gateways, VPN appliances and firewalls are attractive because they sit outside most endpoint monitoring and hold privileged access. CISA's Known Exploited Vulnerabilities catalog, which lists vulnerabilities with evidence of active exploitation, regularly includes entries for network and edge products, so checking your own device models against that list is a cheap first control.
Why not just buy one tool for all edges?
A single product can unify policy, but it cannot discover an edge nobody told it about. The hard part is knowledge: what exists, who owns it, what software it runs and whether it is current. A tool is only as complete as the inventory feeding it.
There is also a trust gap in the other direction. Edge devices that handle your traffic are themselves software supply chain items. If a vendor's firmware has a flaw, your whole boundary inherits it.
What does a workable approach look like?
Treat edges as a risk register, not a project. Rank each by what it can reach and how exposed it is. A constructed example: a regional clinic group has twelve sites. One site runs an old router that an outside contractor installed and nobody has logged into for two years. It has a management interface reachable from the internet and a flat connection to the patient records network. That one device outranks the other eleven combined, and it appears on no one's list until the inventory exercise finds it.
After ranking, apply three moves in order. Close management interfaces to the internet. Segment so a compromised edge cannot reach crown jewels. Enforce strong authentication on every administrative path, and keep a patch clock for edge devices that is shorter than the one for internal servers.
How does this connect to zero trust?
CISA's Zero Trust Maturity Model organizes progress across pillars including identity, devices, networks, applications and data. Edges touch all five. Use it to ask of each edge: how do we verify the user, how do we verify the device, what can the session reach and how do we watch it?
How to check or apply this
- Build an inventory of edges: sites, clouds, remote access, partner links, devices. Name an owner for each.
- Match each device model and firmware version against the CISA catalog of known exploited vulnerabilities.
- Remove internet exposure from management interfaces; use a separate admin path with multi-factor authentication.
- Segment so edge compromise does not equal network compromise.
- Set a shorter patch deadline for internet-facing devices and track it.
- Log edge events centrally and review unusual administrative logins.
Quick check
What should I secure first?
Internet-facing management interfaces and any device with a known exploited vulnerability. Those have the clearest, fastest payoff.
Does zero trust remove the need for firewalls?
No. NIST SP 800-207 treats network controls as one part of an architecture that also verifies users and devices for each session.
Sources
- NIST SP 800-207, Zero Trust Architecture
- CISA Zero Trust Maturity Model
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 18 October 2026.
