NCSC Warns: Your Internet-Facing Devices Are a Target

The UK’s National Cyber Security Centre (NCSC) published a warning in late August 2026 that attackers are increasingly targeting internet-exposed firewalls, routers, and VPN gateways. If your business has any kind of internet-facing network equipment — and most do — here is what you need to know and what to check.

What the NCSC said

On 27 August, the NCSC issued an advisory confirming that disruptive cyber activity is specifically targeting internet-exposed edge devices: the firewalls, VPN appliances, and routers that sit on the boundary between your business network and the internet.

The agency has been working directly with affected organisations and is now sharing the guidance publicly to help all UK businesses reduce their exposure. The warning follows a pattern the NCSC has been tracking, where attackers seek out poorly maintained or misconfigured boundary devices as a way into business networks — often bypassing traditional endpoint protections entirely.

Why edge devices make such an attractive target

A compromised firewall or VPN gateway gives an attacker something genuinely valuable: a foothold inside your network before any antivirus or endpoint detection tool can see them. Unlike phishing-based attacks, which rely on a user making a mistake, exploiting an edge device can be quiet and largely automated.

There is a specific problem the NCSC highlights: many businesses assume their internal systems cannot be reached from the internet. They often can be — and sometimes are — without the business realising it. Misconfigurations, old connections left open during a previous IT change, and unmanaged devices can all create internet exposure silently.

Devices still running legacy management protocols are particularly at risk. SNMP version 1 and version 2, and Telnet, were designed decades ago without modern threats in mind. They can allow attackers to interact with devices in ways that generate very little noise in standard monitoring tools.

End-of-life devices that no longer receive security updates from their manufacturer are another serious concern. Once vendor support ends, known vulnerabilities stay open permanently — and attackers know exactly which products are out of support.

What this means for your business

You do not have to be a large corporation or run industrial machinery for this to be relevant. Any business with a broadband router, firewall, or VPN is potentially exposed. The NCSC’s recommendations apply across all sectors and all sizes.

The encouraging point is that the actions required are not complex. They are the kind of ongoing maintenance that a good managed IT support provider should already be handling on your behalf. But it is worth asking directly, because these checks are easy to overlook when a device has been quietly running without obvious problems.

What we do for System Force IT clients

All network edge devices we manage — including Fortinet firewalls — are kept on current firmware and configuration baselines. We carry out regular reviews to confirm that remote management is not accidentally exposed to the internet, that legacy protocols have been replaced with their secure equivalents, and that no devices are approaching or past their manufacturer end-of-life date.

We also maintain a live inventory of all internet-facing systems for every client. The NCSC specifically calls out the importance of knowing what you have exposed, because you cannot protect what you cannot see. As part of our IT security services, we can also carry out an independent review of your network perimeter and give you a plain-English report on what needs attention.

What to check right now

If you manage your own network equipment, or your current IT provider has not raised these points with you, here are the steps the NCSC recommends — translated into plain terms:

1. Know what is exposed. Get a list of all internet-facing systems — not just your main firewall, but any device that accepts inbound connections from the internet.
2. Keep firmware current. Every router, firewall, and VPN appliance should be on the latest vendor-supported firmware. If your device is end-of-life, plan to replace it.
3. Disable legacy protocols. SNMP v1 and v2, and Telnet, should be disabled. If you are not sure whether these are active on your devices, ask your IT provider directly.
4. Restrict management access. Administrative access to network devices should not be reachable from the open internet. It should be limited to specific internal addresses or over a VPN.
5. Monitor for unexpected changes. Configuration changes you did not make, or outbound connections to unfamiliar addresses, can be a sign of compromise. Your IT support should have visibility of both.

The NCSC also offers a free Early Warning service (available via ncsc.gov.uk) that alerts UK organisations to known vulnerabilities affecting their publicly exposed systems. It is free to register and is worth setting up.

If you are considering a structured review of your security posture more broadly, Cyber Essentials provides a recognised baseline for the five most important technical controls — and it is increasingly required by clients, insurers, and public sector bodies. We hold UKAS-accredited ISO 27001 certification ourselves, so our own security practices are independently verified to the international standard.

If you would like us to review your internet-facing devices or check your network perimeter configuration, get in touch or call 01452 701355 for a no-obligation conversation.