The Dangers of an Outdated Firewall, and How to Tell If Yours Is One

Ask an incident-response team how attackers got into the small businesses they visited last year, and two answers come back more than any other: a stolen password on an account without multi-factor authentication, and an unpatched firewall or VPN appliance at the edge of the network. Firewalls became a favourite target because they are exposed to the internet by design, they are often old, and nobody looks at them until they fail. This article explains what “outdated” really means, what has happened to businesses running old firewalls since 2024, a checklist to tell whether yours is one, and what replacing it involves.

What “outdated” actually means

A firewall can be outdated in four different ways, and any one of them is enough.

• End of support. The manufacturer has stopped issuing firmware for the model. New security holes found in it will never be fixed, and they are found regularly.
• Lapsed subscriptions. The intrusion-prevention signatures, web filtering, malware scanning and threat feeds on a modern firewall are annual subscriptions. When they expire the box keeps passing traffic and quietly stops inspecting it. This is the most common state we find in new clients.
• Old firmware. The model is supported but nobody has applied the updates. Most of the attacks below hit firewalls whose fixes had been available for months.
• Old design. The device only filters by address and port, cannot inspect encrypted traffic, has no multi-factor authentication for its VPN, and cannot send logs anywhere. That includes every consumer router and most carrier-supplied gateways.

What has happened since 2024

The last three years have been the worst on record for firewall and VPN vulnerabilities, and the attacks have not been theoretical. In 2024 a critical flaw in Palo Alto Networks’ GlobalProtect VPN and a campaign against Cisco ASA firewalls, both exploited before patches existed, put edge devices at the top of every security agency’s warning list. Fortinet’s SSL VPN has had a run of serious vulnerabilities since 2022, including a 2025 case where devices patched late were found to still carry attackers’ access. SonicWall SSL VPN appliances, including end-of-life models that will never be fixed, became the entry point for ransomware groups such as Akira through 2024 and 2025. Ivanti’s VPN products were hit in both 2024 and 2025. In September 2025 the US cybersecurity agency ordered federal agencies to urgently patch or disconnect Cisco firewalls under active attack. In every one of these cases the pattern was the same: an internet-facing device, a known flaw, and a business that had not updated or replaced it.

The consequences are not abstract. Once inside through the firewall, attackers move to the servers, disable backups and deploy ransomware; our guide to preventing ransomware attacks describes the rest of that chain. And because the entry point was an unsupported or unpatched device, cyber insurers have grounds to question the claim. The cyber insurance readiness check shows the firewall question as insurers now ask it.

The quieter costs

Even without an attack, an old firewall costs something every day. Its throughput caps the internet connection: a firewall rated for 200 megabits with inspection turned on will throttle the gigabit fibre most Twin Cities offices now have, which is a common answer to why is our internet slow. Ageing hardware locks up and needs rebooting. It cannot separate guests, cameras and printers from the computers, so one infected device reaches everything. And it cannot show you what it blocked, so nobody knows whether it is working.

A checklist: is your firewall outdated?

1. Find the model number and look it up on the manufacturer’s lifecycle page. Is it past end of support, or within a year of it?
2. Open the admin page. Are the security subscriptions active, and when do they expire?
3. When was the firmware last updated? If nobody knows, assume never.
4. Does the VPN require multi-factor authentication? Are there VPN accounts for people who left?
5. Is the admin interface reachable from the internet? It should not be.
6. Is the device a consumer router or a carrier gateway doing the firewall’s job?
7. Is inspection of encrypted traffic possible, and is it on?
8. Does it send logs somewhere a person or a system reviews?
9. Are guests, cameras, printers and phones on separate networks from the computers?
10. Does its rated throughput with inspection on exceed your internet speed?

Two or more failures on this list is a replacement, not a tune-up. One is a project for this quarter.

What replacing it involves

A firewall replacement for a small business is a day of work after a week of planning. Sizing comes first: users, internet speed, and whether encrypted traffic will be inspected, which roughly halves a device’s rated throughput. Then the security subscriptions, bought for one or three years so they cannot lapse unnoticed. The configuration is rebuilt rather than copied, because the old one carries fifteen years of forgotten rules: separate networks for staff, guests, cameras and equipment; a VPN with multi-factor authentication, or a zero-trust remote-access service instead of a VPN; web and DNS filtering; logging to a system that alerts on the important events. Cutover is done after hours with the old device kept for a week. Hardware for a small business firewall typically runs from several hundred to a few thousand dollars, with annual subscriptions on top, which is small next to what it protects. Our firewall services page covers the models we deploy and manage.

Keeping it current afterwards

A firewall is only as good as its last update, so under a managed IT plan it is monitored, its firmware is applied on a schedule, its subscriptions renew automatically, its VPN accounts are removed when people leave, and its logs feed the same monitoring as the computers. The pricing calculator gives a monthly figure for that. Firewalls are one layer; our article on firewalls, antivirus and EDR explains the others, and securing your wireless network covers the part of the network the firewall does not see.

Common questions

How long does a firewall last?

Five to seven years is typical before the manufacturer ends support and stops issuing firmware. The security subscriptions on it, for intrusion prevention, web filtering and threat signatures, are annual and lapse much sooner if nobody renews them. Plan to replace a firewall at end of support, not when it dies.

Is the router from our internet provider enough?

No. Carrier routers do basic address translation and little else: no intrusion prevention, no filtering, no VPN with multi-factor authentication, no logging you can read. For a business they should be put in bridge mode behind a real firewall.

Do we need a firewall if everything is in the cloud?

Yes, though its job changes. It still protects the computers, printers, cameras and phones in the office from each other and from the internet, filters what staff reach, and provides the guest and IoT separation. What you may no longer need is a VPN into the office, if there is nothing left in the office to reach.

What is a next-generation firewall?

One that inspects the content of traffic rather than only the addresses and ports: it identifies applications, blocks known-bad sites and files, runs intrusion prevention and can inspect encrypted traffic. The features depend on subscriptions, which is why an unrenewed next-generation firewall quietly turns back into an ordinary one.

Does a firewall replace antivirus?

No. The firewall guards the boundary of the network; endpoint protection guards each computer, including the laptop that left the building. Our article on firewalls, antivirus and EDR explains how the layers fit together.

How do I check whether our firewall is end-of-life?

Find the model number on the device or in its admin page, then look it up on the manufacturer’s product lifecycle page; every major vendor publishes end-of-sale and end-of-support dates. Then check the subscription expiry in the admin page. If either has passed, or you cannot find out, that is the answer.

Talk to us

If you are not sure how old your firewall is or whether its subscriptions are current, we will check it and give you a straight answer, and a price if it needs replacing. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.