Your security vendor was breached: a 48 hour checklist

When a security or network vendor says it was breached, assume the attacker now knows more about your environment than you would like. In 2025 both F5 and SonicWall made such disclosures. The first 48 hours should cover inventory, exposure, credentials and a check of the vendor's scope, which can change.

What the two 2025 cases looked like

CISA's Emergency Directive 26-01 says a nation-state affiliated actor took files from F5 including part of the BIG-IP source code and vulnerability information, and warned this could help find flaws and build targeted exploits.

SonicWall said an unauthorized party accessed firewall configuration backups in its cloud backup service. Its first scope estimate was fewer than 5 percent of firewalls. After Mandiant's work, the October update said all customers using the cloud backup service were affected.

Two different breaches, one shared shape. What the attacker took was either a map of the product, or a map of the customer.

Hours 0 to 4: understand your exposure

1. Name an owner and open an incident channel.
2. List every instance of the product, with version, location and who manages it.
3. Find out whether any management interface is reachable from the internet. CISA's directive made this an early step.
4. Check whether you used any vendor hosted service tied to the breach, such as cloud backup, support portals or telemetry.

Hours 4 to 24: contain and rotate

1. Restrict management access to a jump host or private network.
2. Apply vendor updates on a short clock, and retire devices that no longer get fixes.
3. Rotate credentials, keys and certificates that live on the product or were stored with the vendor. CISA names embedded credentials as a risk and SonicWall provides reset steps.
4. Review recent logins and configuration changes on the device.
5. Check whether the vendor offers a list of affected customers or serial numbers, and read it.

Hours 24 to 48: verify and communicate

1. Re-read the vendor notice. SonicWall's scope changed, so expect the same.
2. Hunt for unusual access in logs, especially configuration downloads and new accounts.
3. Brief leadership with what you know, what you do not, and what you changed.
4. Check contracts for the vendor's notification duties and note any gaps.
5. Decide whether your own customers need to hear from you.

Questions for the vendor

1. What was taken, and how do you know?
2. Which of our assets or data are in scope?
3. What should we change on our side, and by when?
4. How will you tell us if the scope changes?
5. What will you change so it does not happen again?

Longer term

Keep a living list of security and network vendors with what each can see about you. Prefer products where stored configuration and secrets are encrypted with keys you hold. Treat the vendor's disclosure speed as part of its quality.

Where Safeguard fits

Safeguard's asset discovery and compliance evidence automation can help you keep the vendor list and record each review. It does not replace the vendor's own fixes. A free scan is at gold.safeguard.sh/scan.

Quick check

Sources

• CISA Emergency Directive 26-01, 15 October 2025
• SonicWall, MySonicWall cloud backup file incident

Last reviewed: 19 October 2026.