Why End-of-Support Edge Devices Have Become a National Security Risk

The growing threat from End-of-Support edge devices has become a national cybersecurity liability as threat actors exploit outdated firewalls, routers, VPN gateways, and other perimeter appliances to gain access and pivot into federal networks. The Binding Operational Directive BOD 26-02 mandates time‑bound inventory, decommissioning, replacement, and continuous discovery to eliminate these risks and enforce lifecycle management across agencies. #BOD26-02 #CISA

Keypoints

End-of-Support edge devices at the network perimeter present high-risk entry points when they no longer receive vendor updates.
CISA has observed exploitation campaigns using EOS edge devices for initial access and lateral movement into identity systems and internal networks.
BOD 26-02 requires agencies to inventory EOS devices in 3 months, decommission within 12 months, remove within 18 months, and adopt continuous discovery within 24 months.
Effective lifecycle management, asset visibility, and procurement alignment are essential governance controls to prevent EOS device risk.
Compliance with the directive is mandatory and necessary to move agencies from reactive patching to proactive, resilient security practices.