The best way to protect your firewall and VPN is to stop counting on any single device to keep attackers out. Put as little as possible on the internet, assume the edge will be breached, patch within days, lock down admin accounts, and watch for intruders. No brand is immune, so the strategy matters more than the vendor.
In 2026 alone, CISA has listed actively exploited flaws in firewall, VPN, and remote access products from Palo Alto Networks, Fortinet, SonicWall, Cisco, Citrix, Check Point, Ivanti, and F5. Our post on the GlobalProtect ransomware attacks lists them. The trend is not new: in Verizon's 2025 Data Breach Investigations Report, edge devices and VPNs were the target in 22% of breaches that started with an exploited vulnerability, up from 3% the year before.
Key takeaways
- Expose less. Attackers can only exploit what they can reach. The fewer login pages and admin pages you put on the internet, the fewer doors there are to try.
- Assume the edge will be breached. Limit what a VPN user can reach, and monitor for the activity that follows a break-in.
- Patch edge devices in days, not weeks. Some flaws are attacked before a fix even exists, so speed and a check for compromise both matter.
- Lock down admin accounts. No default passwords, MFA everywhere, and new passwords after any exposure.
- Switching brands does not solve it. Every major vendor has had exploited flaws this year. Choose vendors for how they handle security, then follow the same strategy.
Why do firewalls and VPNs keep getting hacked?
Firewalls, VPN gateways, and remote access appliances, often called edge devices, have a few things in common that make them the first target for ransomware groups and other attackers.
- They have to face the internet. Anyone in the world can try their login pages around the clock. In its 2026 State of the Edge report, GreyNoise recorded 16.7 million sessions aimed at GlobalProtect alone.
- They open onto the whole network. A VPN session or an admin login on the firewall puts an attacker inside, often with wide access.
- Security software does not run on them. The endpoint detection tools that protect laptops and servers cannot be installed on most firewalls, so a compromised device can go unnoticed.
- Attackers move faster than patches. Some flaws are exploited before the vendor has a fix. GreyNoise saw a Citrix flaw attacked three days before it even had a CVE number.
- Old devices stay online. GreyNoise found that flaws from before 2015 still drew 7.3 million attack sessions, because unpatched and end-of-life devices are still out there.
- Passwords are guessable. The FortiBleed campaign and the k0t access broker broke into many devices with stolen or guessed admin and VPN passwords, no software flaw needed.
Does switching firewall brands help?
Not on its own. Every major firewall and VPN vendor has had flaws on CISA's exploited list in 2026, so moving from one brand to another trades one set of flaws for another. When you do choose or replace a device, favor vendors that fix flaws quickly, publish clear advisories, support their products for years, and build in MFA and good logging. The joint guidance on edge devices from CISA, Australia's ASD, Canada's Cyber Centre, the UK's NCSC, and other agencies makes the same point: buy devices that are secure by design, then harden, patch, and monitor them.
What are the best practices for firewall and VPN security?
Think in layers. Each one makes the next attack harder or catches what the layer before it missed.
1. Shrink what is exposed
This is the single biggest improvement for most businesses.
- List every device that faces the internet: firewalls, VPN gateways, remote access appliances, and anything at branch or home offices.
- Make sure no admin page is reachable from the internet. Manage devices only from inside the network or over a secure management connection.
- Turn off features you do not use, such as an SSL VPN portal nobody logs in to or older VPN protocols.
- Replace the public VPN gateway with Zero Trust Network Access (ZTNA), which connects people to specific applications without a login page sitting on the internet. Our post on moving from SSL VPN to ZTNA explains how it works.
2. Assume the edge will be breached
Plan for the day a flaw gets past the firewall, because in 2026 that day has come for every brand.
- Require phishing-resistant MFA for every VPN and admin login. It will not stop a flaw that skips the login, but it stops most password attacks.
- Give VPN users access only to the systems they need, not the whole network, and keep servers, backups, and management systems on separate network segments.
- Send firewall and VPN logs to a central place where they are kept and reviewed, not only on the device itself.
- Monitor around the clock for what attackers do after they get in: new remote access tools, password dumping, logins at odd hours, and large uploads to cloud storage. In the GlobalProtect intrusions, that follow-on activity is where attackers could be caught.
3. Patch edge devices within days
Treat a firewall or VPN advisory as urgent. CISA now gives federal agencies as little as three days to fix flaws on its exploited list, and attackers often move within hours of a public fix.
- Subscribe to your vendors' security advisories and watch CISA's Known Exploited Vulnerabilities catalog.
- Keep devices on a supported release so a fix is always one update away.
- After patching an exploited flaw, check the device for signs of compromise. A patch closes the door but does not remove anyone already inside.
Our patch management guide for small businesses covers how to build this into a routine.
4. Lock down admin accounts and saved passwords
- Change every default password and avoid common ones. Attackers try "admin" first.
- Give each administrator a named account with MFA, instead of one shared login.
- Lengthen lockout times so password guessing is slow.
- Encrypt passwords saved on the device with your own key where the device supports it.
- If a device may have been exposed, change every password it stores, including VPN users and the account it uses to talk to your company directory.
5. Retire end-of-life devices
A device past its vendor's end of support never gets another security fix, so any new flaw stays open for good. Track support dates for every firewall and VPN gateway and budget for replacement before they arrive.
6. Make sure you can recover
If every other layer fails, recovery decides how bad the day gets. Ransomware groups go after backups first, so keep at least one copy that cannot be changed or deleted from the main network, test restores on a schedule, and write down who to call and what to do in an incident. Our data backup services page explains what a recoverable setup looks like.
What should a small business do first?
| When | What to do |
|---|---|
| This week | List every internet-facing device and its software version. Close any admin page open to the internet. Turn on MFA for every VPN and admin login. |
| This month | Update every device to a current supported release and subscribe to vendor advisories. Change default and shared admin passwords. Start sending firewall logs to a central place. |
| This quarter | Set up monitoring that someone actually watches. Separate servers and backups from the rest of the network. Test a backup restore. Plan the move from a public VPN to ZTNA and the replacement of end-of-life devices. |
Questions to ask your IT provider
- Which of our devices face the internet, and what software version is each running?
- Can anyone reach a firewall or VPN admin page from the internet?
- How quickly do you patch a firewall or VPN flaw that is being exploited, and do you check for compromise afterward?
- Do all VPN and admin logins require MFA, and is there a shared admin account?
- Who watches our firewall logs, and what happens if they see something at 2 a.m.?
- Which of our devices reach end of support in the next two years?
- Should we replace our VPN with ZTNA?
How Spot On Tech can help
For the businesses we manage, firewall patching, configuration reviews, and security monitoring and response are part of the same service, and we moved the networks we manage off public SSL VPN gateways to Zero Trust Network Access. Our cybersecurity services cover the full strategy above, and a technology risk assessment finds the exposed admin pages, forgotten devices, and old passwords attackers look for. If you have an in-house IT team, Compass can add just the pieces you need, such as 24/7 coverage or security operations center (SOC) monitoring.
If you are a New York or New Jersey business and want to know how exposed your firewall and VPN are, talk with Spot On Tech.
Frequently asked questions
What is the best way to protect a firewall from hackers?
Keep its admin pages off the internet, turn off features you do not use, patch it within days of a security advisory, require MFA for every admin and VPN login, and monitor its logs and your network for signs of a break-in. No single step is enough on its own.
Is a VPN still safe for remote access?
A well-patched VPN with MFA is far safer than an unpatched one, but any VPN login page on the internet is a target. Many businesses are moving to Zero Trust Network Access, which gives staff access to specific applications without a public gateway.
Which firewall brand is the most secure?
No brand is immune. Palo Alto Networks, Fortinet, SonicWall, Cisco, Citrix, Check Point, Ivanti, and F5 products all had exploited flaws in 2026. Pick a vendor that fixes flaws quickly and supports its products for years, then follow a layered strategy.
How fast should firewall and VPN patches be applied?
Within days for any flaw that is being exploited. CISA gives federal agencies as little as three days for flaws on its Known Exploited Vulnerabilities list, and attackers often start within hours of a public fix.
Does MFA protect a VPN from exploits?
MFA stops most password attacks, but not flaws that skip the login entirely. In 2026, ransomware groups used a GlobalProtect flaw to get past MFA, which is why patching and monitoring matter as much as MFA.
How do I know if my firewall has been hacked?
Look for admin accounts or settings you did not create, VPN sessions from unfamiliar devices or locations, remote access software you did not install on your computers, and large uploads to cloud storage. If you find any of these, treat it as an incident and get help.
