Your most exposed hardware is probably your oldest. End-of-support edge devices, meaning the routers, firewalls, VPN concentrators and gateways that sit between the internet and your data, are the systems attackers reach first and vendors have stopped fixing. In February 2026 the Cybersecurity and Infrastructure Security Agency (CISA) turned that risk into a federal mandate, and the first hard removal deadline arrives in about three months. This guide explains what Binding Operational Directive 26-02 requires, who should treat it as their own deadline, and how to replace unsupported perimeter gear without breaking the network.

Definition: End-of-support edge devices are internet-facing network products, such as routers, firewalls, VPN gateways and load balancers, whose manufacturer has stopped issuing security patches. Every vulnerability discovered after that date stays permanently exploitable unless the device is upgraded or retired.

Key Takeaways

• CISA issued BOD 26-02 on February 5, 2026, ordering federal civilian agencies to inventory and remove end-of-support edge devices on a staged schedule.
• The twelve-month mark lands in early February 2027; the eighteen-month mark lands in early August 2027.
• The directive binds federal agencies, but CISA, the FBI and allied agencies encourage every organization to follow it.
• Unsupported perimeter gear is what we call the unpatchable perimeter: a boundary you cannot repair, only replace or wall off.
• A 90-day inventory, isolate and replace plan beats a last-minute refresh.

Why End-of-Support Edge Devices Became a Federal Priority

Edge products are attractive because they are reachable from the internet, run with high privilege, and often lack the endpoint monitoring that protects laptops and servers. CISA’s directive cites widespread exploitation campaigns by advanced threat actors against unsupported edge hardware as the reason for acting. The pattern is familiar. When a flaw appears in a product that no longer receives updates, the fix never ships, and the flaw becomes a standing invitation.

Recent history shows why this matters for the network layer in particular. In June 2026, CISA added a maximum-severity Ivanti Sentry flaw to its Known Exploited Vulnerabilities catalog, and BleepingComputer reported that attackers were already hitting exposed gateways within a day of the patch. In February, the agency issued Emergency Directive 26-03 after a CVSS 10.0 Cisco SD-WAN authentication bypass was exploited. Supported products at least have a patch path. Unsupported ones do not.

BOD 26-02 Timeline: What Is Due and When

The directive runs on a clock that started on February 5, 2026. CSO Online and Help Net Security summarize the stages. Calendar dates below are our projections from the issuance date.

CISA also maintains an end-of-support edge device list to help agencies identify affected models, as TechSpot noted. Read the directive itself for the exact wording before you commit dates to a contract.

Who Should Treat This as Their Own Deadline

Strictly, BOD 26-02 applies to Federal Civilian Executive Branch agencies and, according to the Center for Cybersecurity Policy, to contracts those agencies hold for managed network hardware. In practice the audience is wider.

• Federal contractors and managed service providers: if you operate network gear for an agency, you inherit the deadline. This pairs with the cryptographic obligations covered in our Executive Order 14412 analysis.
• Financial services and insurance: examiners expect an asset inventory and lifecycle management under NYDFS 23 NYCRR 500 and the FFIEC IT Handbook. An unsupported firewall is hard to defend in an exam.
• Healthcare: the proposed HIPAA Security Rule update emphasizes asset inventory and risk analysis, and unsupported gateways routinely front clinical systems. See our look at the cryptographic lifespan gap in medical devices.
• Cloud providers: FedRAMP notice 0014 makes its new vulnerability rules mandatory on December 7, 2026, and an edge device you cannot patch is a vulnerability you cannot close.

The Unpatchable Perimeter: Why Compensating Controls Are Not Enough

We use the phrase the unpatchable perimeter for the set of network boundary devices that can no longer be repaired. Its danger is not only the missing patch. It is the combination of three facts: the device is reachable, it is trusted, and nobody is watching it closely. Our post on SD-WAN encryption keys showed how control-plane compromise exposes tunnel keys, and our VMware ESX analysis showed how a compromised system can distort its own logs. An unsupported edge device can do both at once.

The Volt Typhoon advisory from CISA, NSA and the FBI described attackers living inside network infrastructure for long periods. Pre-positioned access is most valuable on gear that will never be patched. That is why compensating controls buy time rather than safety.

How to Find End-of-Support Edge Devices You Did Not Know You Had

You cannot retire what you cannot see. Most organizations discover that their written inventory misses branch routers, forgotten VPN appliances, and carrier-managed equipment. Build one list from several independent sources:

1. Passive discovery: scan and fingerprint management interfaces, SNMP, and certificates exposed to the internet and to internal segments.
2. Configuration backups and change tickets: every device with a saved config deserves a lifecycle date.
3. Procurement and carrier billing: circuits and managed hardware often appear on invoices before they appear in a CMDB. Our telecom expense management guide explains how the contract, inventory and invoice reconcile.
4. Vendor lifecycle pages: record last-date-of-support for every model and software train.
5. External attack-surface view: compare what the internet sees against what you believe you run.

Tag each device with owner, location, software version, support-end date and business function. That is the same asset-tag discipline risk-based vulnerability management under BOD 26-04 depends on. If you cannot say what a device protects, you cannot rank its replacement.

What to Replace End-of-Support Edge Devices With

A like-for-like swap fixes the support problem but repeats the architecture. Use the refresh to reduce how many edge devices you operate at all.

Consolidate branch connectivity

A centrally managed SD-WAN with integrated security lets you retire a patchwork of branch routers and firewalls, with one console and one patch cadence. If legacy circuits are part of the refresh, review MPLS replacement options and the trade-offs between dark fiber and wavelength services.

Move remote access toward zero trust

Aging VPN concentrators are the classic unpatchable perimeter. Replacing broad network access with identity-aware, per-application access shrinks the attack surface. Our Zero Trust Content Security and Exodus NxtGen Firewall pages describe the layers we deploy. Align the design with NIST CSF 2.0 and NIST SP 800-53.

Write the support lifecycle into the contract

Ask every vendor for a minimum support period, the cost of extended support, and how end-of-sale is announced. Our IBM i modernization guide makes the same point for platforms: a support date is a budget date.

Compensating Controls While You Wait for Replacements

Some devices cannot be replaced by February. For those, document a time-boxed exception and apply layered controls. The Cybersecurity Awareness Month theme from CISA, Reduce, Replace, Recover, maps neatly here.

• Reduce exposure: remove internet-facing management interfaces, restrict administration to a dedicated management network, and block unneeded inbound services. Packet filtering at the edge can blunt entire bug classes.
• Increase visibility: forward logs off-device to an immutable store and alert on configuration change. Exodus Aria ADR adds anomaly detection and response.
• Protect the crypto: rotate keys and certificates, and keep them out of the device where possible. See Exodus Key Management and our guide to certificate lifecycle management.
• Prepare to recover: test restore of configurations and data against a backup and recovery plan, using the approach in our immutable backups guide.
• Monitor endpoints behind the edge: if the boundary falls, EDR limits what follows.

A 90-Day Plan to Retire End-of-Support Edge Devices

Run replacement in waves, schedule cutovers around business cycles, and keep rollback ready. The goal on day 90 is not zero risk. It is a defensible record that every unsupported device is either gone or documented and compensated.

Why End-of-Support Hardware Is Also a Post-Quantum Problem

Old edge devices usually cannot run modern algorithms. NIST’s finalized post-quantum standards and the deprecation timeline in NIST IR 8547 mean today’s RSA and elliptic-curve tunnels will eventually need replacement. Traffic captured now can be decrypted later, the risk we describe in quantum computing and encryption. A device that cannot be patched today certainly cannot be upgraded to post-quantum key exchange tomorrow. Every edge refresh should ask whether the replacement supports crypto-agility, and whether data in motion and data at rest are protected independently of the box.

Questions to Ask Every Edge Vendor

1. What is the guaranteed support period for this model and software train?
2. How many days of notice do you give before end-of-sale and end-of-support?
3. Can you provide a software bill of materials and your vulnerability disclosure policy?
4. Is the management interface isolated from user traffic by design?
5. Does the platform support post-quantum and hybrid key exchange on a published roadmap?
6. How are secure-boot and image integrity verified, and how do you detect in-memory tampering?

Compare answers against NIST SP 800-40 Rev. 4 on enterprise patch management and the KEV catalog history of the vendor’s product line. A pattern of repeated KEV entries on one product family is a procurement signal. Also review how a breach at a trusted provider played out in our FBI data breach lessons, and how governance gaps appear in the AI safety culture analysis.

Frequently Asked Questions

What are end-of-support edge devices?

They are network perimeter products, such as routers, firewalls, VPN concentrators and gateways, that the manufacturer no longer patches. Every new vulnerability stays open permanently.

Does CISA BOD 26-02 apply to private companies?

It binds federal civilian agencies and, per policy analysts, their contracts for managed network hardware. CISA and allied agencies encourage all organizations to follow the guidance, and regulators increasingly expect the same lifecycle discipline.

What are the BOD 26-02 deadlines?

Issued February 5, 2026: inventory at about three months, removal of devices already past end of support at twelve months (about February 2027), and removal of all identified devices at eighteen months (about August 2027).

How do I find end-of-support devices on my network?

Combine passive discovery, configuration backups, procurement and carrier billing records, vendor lifecycle pages and an external attack-surface view into one inventory with a support-end date for each device.

Can compensating controls replace an unsupported device?

No. Segmentation, management isolation, egress filtering and logging reduce risk for a short, documented period, but replacement remains the objective.

What should replace an unsupported edge device?

Most enterprises choose a supported, centrally managed platform, such as SD-WAN with integrated security and zero-trust access, backed by a written support-lifecycle commitment and a crypto-agility roadmap.

Retire Your Unpatchable Perimeter With ibm/SEIMless

ibm/SEIMless helps enterprises inventory end-of-support edge devices, design supported replacements, and protect data in motion and at rest while the migration happens. Our team can map your perimeter, rank the riskiest devices, and build a 90-day plan you can show to auditors and leadership.

Get StartedContact Us

Phone: 646-546-5245
Email: in**@**********ss.com
Address: One Liberty Plaza, New York, NY 10006