Exploitation of Internet-Facing Systems: Why Unpatched Edge Devices Are Now the Top Way In

Hero Summary

Verizon's 2026 Data Breach Investigations Report states that 31% of breaches now start with software vulnerabilities, which now beat stolen passwords as the top way in. Attackers favour internet-facing systems — web applications, VPNs, firewalls, remote-access gateways, and other "edge" devices — because they are reachable from anywhere, often lack the monitoring that internal systems have, and a single flaw can yield privileged access. The FBI's guidance to organizations facing ransomware is direct: keep software and firmware up to date and prioritise patching known exploited vulnerabilities in internet-facing systems. This guide explains how to find your exposure, rank it, fix it faster, and compensate when you cannot.

Executive Summary

Most organizations cannot patch everything immediately, and attackers know it. The winning approach is not "patch faster" in general but know what you expose, rank what is being exploited, and shorten the time to fix the few things that matter most. This guide covers why edge systems are targeted, the main categories of exposure, how to build an inventory, how to prioritise using exploitation evidence, patching and compensating controls, testing, and how to measure progress. It uses CERT-In's and the FBI's published guidance and Verizon's findings, and links to related guides on firewalls, VAPT, and monitoring.

What the data shows {#data}

• Verizon, 2026 DBIR: 31% of breaches now start with software vulnerabilities, ahead of stolen passwords as the top way in.
• IBM, 2025 India research: vulnerability exploitation was the initial attack vector in 13% of breaches in India, behind phishing (18%) and third-party compromise (17%).
• FBI IC3, 2025 report: among its recommendations for companies, "Prioritize patching known exploited vulnerabilities in internet-facing systems."
• CERT-In, 2025: CERT-In issued 1,530 alerts, 390 vulnerability notes, and 65 advisories, and published 29 CVEs, according to a Government of India summary of its work.

The datasets differ in method, so exact percentages vary, but the direction is consistent: exploitation of exposed software is a leading route in.

Why edge and internet-facing systems are targeted {#why}

• Reachable from anywhere, so attackers can scan the whole internet for a specific flaw.
• Privileged position: edge devices such as VPNs and firewalls often sit between the internet and the internal network and handle credentials.
• Limited visibility: many appliances cannot run standard security agents, so compromise can go unseen.
• Slow patching: appliances are business-critical and patching means downtime, so updates are delayed.
• Mass exploitation: once a flaw is public, automated tools exploit it widely within days, so the window between disclosure and attack is short.
• End-of-life equipment that no longer receives security fixes stays in service.

What counts as exposed {#exposed}

• Web applications and APIs — including admin panels and test environments. See Web Application VAPT and API Penetration Testing.
• Remote access — VPN gateways, remote desktop, and remote administration tools.
• Network edge devices — firewalls, routers, load balancers, and other appliances. See Firewall Configuration Best Practices.
• Management interfaces exposed to the internet.
• Mail, file-transfer, and collaboration servers.
• Cloud assets — storage, databases, and services that are misconfigured to be public.
• Forgotten subdomains and shadow IT that nobody is patching.
• Third-party hosted systems that are part of your attack surface.

Step 1: Know what you expose {#inventory}

You cannot patch what you do not know you have. Build and maintain an inventory of internet-facing assets from the outside, as an attacker would see them:

• list all domains and subdomains and what they point to;
• scan your IP ranges and cloud accounts for open services;
• identify software and versions where possible;
• find assets no one owns, such as old test sites and abandoned subdomains; and
• assign an owner to every asset.

Repeat this regularly, because exposure changes as teams deploy new systems. See What Is Domain Security?.

Step 2: Prioritise using exploitation evidence {#prioritise}

Severity scores alone produce thousands of "critical" findings. Rank by a combination of:

1. Evidence of active exploitation. Vulnerabilities that authorities list as known to be exploited deserve the fastest response. CISA maintains a catalog of known exploited vulnerabilities, and CERT-In publishes advisories and vulnerability notes for India.
2. Exposure. An internet-facing system is riskier than an internal one with the same flaw.
3. Asset criticality. What does the system connect to, and what data does it hold?
4. Exploit availability and ease. Public exploit code or simple exploitation raises priority.
5. Compensating controls already in place.

A common policy is to set service-level targets by tier — for example, a very short deadline for known-exploited flaws on internet-facing systems and longer ones for lower risk.

Step 3: Fix faster {#fix}

• Pre-authorise emergency patching for critical edge devices so you do not wait for a monthly window.
• Maintain spares or high-availability pairs so devices can be updated without extended downtime.
• Automate where possible with patch management and configuration management.
• Retire end-of-life equipment or replace it on a schedule.
• Track exceptions with owners and expiry dates, so postponements do not become permanent.
• Subscribe to vendor and government advisories for the products you run, including CERT-In.

Step 4: Compensating controls {#compensate}

When a fix is not immediately possible:

• Remove the exposure — take management interfaces off the internet, or restrict access to specific addresses or a VPN.
• Apply vendor workarounds and mitigations.
• Add virtual patching or filtering, such as a web application firewall rule.
• Increase monitoring on the affected system, and watch for the indicators vendors and authorities publish.
• Segment the system so compromise cannot reach sensitive networks.
• Prepare to assume compromise — if a device was exposed during a known exploitation window, investigate it before assuming it is clean.

Step 5: Test and verify {#test}

Scanning confirms that fixes were applied; penetration testing shows what an attacker can still do. Combine regular vulnerability assessment with periodic VAPT of external and internal systems. See Network VAPT. Verify that patches actually took effect — device version checks, not just change tickets.

Step 6: Monitor and measure {#monitor}

• Mean time to remediate known-exploited vulnerabilities on internet-facing assets.
• Number of exposed services and unowned assets, trending down.
• Patch compliance by tier against your targets.
• End-of-life systems still in service.
• Detection coverage for edge devices — logs reaching your monitoring. See SOC as a Service.

How Threat ResQ fits {#threat-resq-fit}

• DomainShield IQ, Threat ResQ's domain security platform, includes subdomain discovery, attack surface mapping, DNS and SSL/TLS monitoring, and brand and typosquat monitoring, all cloud-based with no agents required.
• The VAPT service covers vulnerability assessment and penetration testing, with retest included on all critical findings, delivered in collaboration with a CERT-In empanelled security firm; the empanelment belongs to that partner, not to Threat ResQ itself. The IT Security Audit service reviews configuration and controls.
• SOC+ provides 24x7 monitoring and alert triage by a live analyst team, with correlated detection across endpoint, network, and identity signal, and receives external attack-surface alerts from DomainShield IQ.

FAQ {#faq}

What is the most common way breaches begin? Verizon's 2026 DBIR reports that 31% of breaches now start with software vulnerabilities, ahead of stolen passwords. IBM's 2025 India research found phishing the leading vector at 18%, with vulnerability exploitation at 13%. The mix varies by dataset.

Why are edge devices such attractive targets? They are reachable from the internet, sit in a privileged position between the internet and the internal network, often cannot run security agents, and are patched slowly because of downtime concerns.

How should I prioritise vulnerabilities? By evidence of active exploitation first, then exposure, asset criticality, and exploit availability, rather than by severity score alone. The FBI advises prioritising known exploited vulnerabilities in internet-facing systems.

What can I do if I cannot patch immediately? Remove or restrict the exposure, apply vendor mitigations, add filtering or virtual patching, increase monitoring, and segment the system — and investigate if it was exposed during a known exploitation window.

How often should I test my internet-facing systems? Scan continuously or frequently, and run penetration tests on a regular schedule and after significant changes.