CISA's Edge Devices Deadline Hit This Week. Most Businesses Still Can't Say What's on Their Network

Edge devices are the firewalls, routers, switches and VPN gateways that sit between your network and the internet. On Tuesday, May 5, 2026, federal agencies hit their first deadline under a directive that makes them list every one of those edge devices that no longer gets security updates. Your business is not bound by it, but the same agencies that wrote it are asking you to follow it, and the first step is knowing what is plugged in.

What CISA's directive on edge devices requires

The Cybersecurity and Infrastructure Security Agency issued Binding Operational Directive 26-02, "Mitigating Risk From End-of-Support Edge Devices," on February 5, 2026. It defines end of support as hardware, firmware and software versions that "no longer receive timely, supported updates from the original equipment manufacturer," including security patches.

The directive sets a schedule counted from the day it was issued. Federal civilian agencies must:

• Immediately: move any supported device that is running out-of-support software onto a supported version.
• Within 3 months (May 5, 2026): inventory every device on CISA's end-of-support list and send that inventory to CISA. This is the deadline that passed this week.
• Within 12 months: remove listed devices whose support ends by that date, replace them with equipment that still receives security updates, and report every edge device that is or will be out of support within the following twelve months.
• Within 18 months: remove every identified end-of-support edge device, listed or not.
• Within 24 months: run a continuous discovery process that finds all edge devices and keeps an inventory of those that are, or within a year will be, out of support.

That last step is the real change. A spreadsheet updated once a year does not meet it. The directive asks for an ongoing process that notices a device the day it appears and knows when its updates will stop.

Why the government singled out edge devices

The directive says CISA is aware of "widespread exploitation campaigns by advanced threat actors targeting EOS edge devices," and that these devices are attractive targets because of their "extensive reach into an organization's network." A firewall or VPN gateway sees all of your traffic and holds privileged access. It also runs its own operating system, which means the security software on your laptops does nothing for it.

Why edge devices matter to a business that is not a federal agency

CISA said on the day it issued the directive that it "strongly encourages non-federal organizations to adopt similar actions" for their edge devices. The same day, CISA, the FBI and the UK's National Cyber Security Centre published a joint fact sheet, Reducing the Attack Surface for End-of-Support Edge Devices, written for all organizations. Its advice comes down to three habits: keep an inventory that lists each device's support timeline, replace end-of-support edge devices promptly, and keep everything else patched.

Many small offices run the very gear the directive targets. The router the internet provider installed years ago. A VPN box set up for remote work in 2020. A switch in a closet nobody has logged into since the last office move. None of it shows up on a laptop inventory, and none of it tells you when the maker stops shipping fixes.

Old edge devices are already being used against small businesses

This is not a theoretical risk. In May 2025 the FBI's Internet Crime Complaint Center warned that criminals were taking over end-of-life routers, installing malware on them and selling access as proxy services so other criminals could hide their activity. The FBI noted that routers dated 2010 or earlier likely no longer receive software updates.

State-sponsored groups go after the same layer. A joint advisory published in August 2025 by CISA, the FBI, the NSA and allied agencies described actors who focus on backbone routers as well as the provider edge and customer edge routers that connect organizations to the internet, and who "often modify routers to maintain persistent, long-term access to networks." A router at the edge of a small office can be the way into a much larger network it connects to.

A 30-day plan to inventory your edge devices

You do not need a federal budget to follow the directive's logic. You need a list, dates and an owner. The NIST Cybersecurity Framework 2.0 asks for the same thing in its asset management outcomes: inventories of the hardware you manage, and systems managed "throughout their life cycles."

1. Week 1, find everything. List every firewall, router, switch, wireless access point and VPN gateway, including the ones your internet provider owns. Write down the make, model, serial number, firmware version and where it sits.
2. Week 2, find the dates. Look up each model's end-of-support date on the manufacturer's site. Mark anything already past it, and anything that reaches it in the next twelve months, the same window the directive uses.
3. Week 3, fix what you can. Update firmware on supported devices. Turn off remote administration where nobody needs it. Change default passwords and save a copy of each configuration.
4. Week 4, plan replacements. Budget for the out-of-support devices and set a date for each. Then name the person who keeps the list current, and decide how a new device gets added the day it is installed.

Step four is where most small businesses stall. The list is easy to make once. Keeping it true is the work, which is why the directive gives agencies two full years to build that habit.

A worked example for a 20-desk office

Picture a 20-desk accounting office. The week 1 walk-through turns up seven boxes: the provider's modem and router, a firewall bought in 2019, two switches, three wireless access points and a small VPN appliance a former contractor set up for tax season. Week 2 shows the VPN appliance and one access point are already past end of support, and the firewall reaches it next spring. Week 3 updates the rest and turns off remote management on the provider router. Week 4 puts two replacements in this quarter's budget, the firewall in next quarter's, and makes the office manager the owner of the list. That office now knows more about its edge devices than it did a month ago, and it spent most of that month on lookups, not purchases.

What CISA asks for beyond the inventory of edge devices

The inventory is the first step, not the last. CISA's Edge Device Security guidance maps the rest of the work onto the six functions of the NIST framework, and it urges every organization to replace end-of-support boundary equipment immediately. Here is what each function means for a small office:

CISA also asks buyers to choose replacements from manufacturers that follow Secure by Design principles. In practice that means asking, before you buy, how long the model will get security updates and how the maker will tell you when they stop.

Where LTFI fits

LTFI runs on a server Kief Studio hosts for you, and we patch and watch that server as part of the service. We host, secure and update it so nobody on your team has to log into it. Our overview of LTFI explains how that environment is built.

The edge devices in your own office stay yours, and the 30-day plan above is the place to start. If you want an outside first look, the free website grade checks the security basics of what you already have online, and you can talk to us about the rest.

Frequently asked questions