The Hole in Your Wall Just Moved

For almost two decades, the same advice topped every security checklist: protect your passwords, train people not to click, turn on MFA. The model was that attackers walked in through the human — a guessed password, a phished employee, a stolen session token. The job was to make that door harder to pick.

That model is now wrong. Verizon’s 2026 Data Breach Investigations Report found that vulnerability exploitation overtook stolen credentials as the number-one initial access pattern for the first time in the report’s 19-year history, driven by edge device and VPN appliance attacks, which jumped from 3% to 22% of exploitation-driven breaches. Unit 42’s 2026 Global Incident Response Report shows phishing and exploitation essentially tied at 22% each. The bad guys stopped picking the lock. They started walking through the wall.

If you run a small or mid-sized business and haven’t done a Q4 hardening pass, this is the week — not because of a fresh CVE, but because the entry point you spent the last decade defending is no longer the entry point.

The shift nobody budgeted for

Edge devices are the gear at the boundary of your network: firewalls, VPN concentrators, remote access appliances, email gateways. They’re often the most privileged thing on your network — full traffic visibility, broad trust relationships, a quiet place to sit while attackers stage the rest of the move. They also tend to be the least loved. A firewall configured in 2019, still running firmware from 2021, with a management interface exposed to the internet for “convenience.”

The math on why this matters is uncomfortable. Sophos’s State of Ransomware 2026 reports a median recovery cost of $1.7 million per incident, with smaller organizations only stopping the attack before encryption about one time in three. Halcyon’s SMB research puts average downtime at roughly 21 days. For a 50-person company, three weeks of operational paralysis is the difference between a bad quarter and a closed business.

The attackers aren’t doing anything exotic. They scan the entire IPv4 space for known-vulnerable edge devices and log in with a published exploit. It’s industrial, automated, continuous. The same exploit that worked last Tuesday works this Tuesday. Your appliance being on the internet is enough.

What hardening actually means in 2026

Hardening got a bad name because it became a synonym for an 80-page checklist nobody reads. The version that matters this year is shorter.

Inventory your edge. Walk your network and write down every device with a public IP, every appliance that accepts inbound connections, every remote access tool. That list is almost always longer than people expect: the firewall, the VPN, the remote access product the IT consultant set up in 2022, the email gateway someone forgot was still running on a corner VM. Each one is a door. Decide which ones you actually need open.

Patch like the report depends on it, because it does. The exploits being weaponized are overwhelmingly against vulnerabilities that already had patches available — sometimes for over a year. Automated patching for operating systems and business apps is table stakes. For network and security appliances, where a bad firmware push can take you offline, the discipline is staged rollouts with a tested rollback path. The goal isn’t zero exposure. The goal is a window shorter than the time it takes an automated scanner to find and exploit the gap.

Get rid of everything you don’t use. Disable management interfaces on the public side. Turn off protocols you’ve stopped using. If your firewall still has an SSL VPN portal from 2018, kill it. Every feature turned off is an exploit you don’t have to think about.

Watch the authentication on the appliances themselves. The same MFA fatigue attacks that work on Microsoft 365 work on the admin console of a firewall. Phishing-resistant factors — FIDO2 keys, passkeys, certificate-based auth — are the answer for high-privilege accounts. The credentials on your edge device should never be a username and password alone.

Verify what your backups actually do. A backup you haven’t restored from isn’t a backup. Pick three systems — one critical, one annoying to recover, one nobody thinks about — and restore them this quarter. Time it. The first run will be slow and will reveal gaps. That’s the point.

The Microsoft 365 piece nobody wants to do

If your business runs on Microsoft 365 — and most do — the tenant is a critical piece of your attack surface. The default settings are designed to not break onboarding. They were not designed to be secure. The most impactful hardening doesn’t require an E5 license or a security operations team.

Block legacy authentication. This single toggle stops the majority of automated account takeover attempts against Microsoft 365, because older protocols (POP, IMAP, SMTP basic auth, older Office clients) don’t support MFA. Attackers love them precisely because they bypass the second factor entirely. If you’re not sure whether your tenant allows it, assume it does and turn it off.

Require MFA for everyone, all the time. Not “MFA for admins” and “MFA for finance.” Everyone. Conditional Access policies that require phishing-resistant authentication strength for admins, and a basic MFA requirement for everyone else, are a reasonable baseline. The user friction is lower than most IT teams fear, and the prevention value is enormous.

Turn on the Unified Audit Log and the default alert policies. Most tenants ship with these off or degraded. Without audit logs you have no idea who did what, when, or from where. The first sign of a compromise is usually visible in the logs days before the actual attack.

Set up a break-glass account that isn’t tied to a real employee. Two emergency access accounts in Entra ID, with long random passwords stored in a safe, used only for disaster scenarios. If your only global admin leaves and their account gets disabled, you’ll thank yourself.

Restrict who can register applications. In a default tenant, any user can register an application and grant it permissions. Attackers who compromise a regular user account use that capability to persist access long after the password is reset. The setting to disable it is a single checkbox.

The boring work that wins

Hardening has always been less exciting than the threat of the week. There’s no new product to buy, no alert to chase, no dramatic story for the board meeting. The 2026 breach data is just a long series of organizations that ran the wrong version of the same software they’d been running for years, and someone scanned their way in.

What the data actually shows is that the boring version of this work is genuinely effective. Most breaches in the DBIR this year exploited vulnerabilities that had patches available before the incident. Most of the Microsoft 365 compromises in the Unit 42 report would have been stopped by legacy auth being disabled. The defenders who did the unsexy work this year had a dramatically better year than the ones who chased the new shiny thing.

The hole in your wall just moved. Walk the perimeter, patch the edge, lock the tenant, and test the restore. That’s the work. The rest of the budget can wait.