Flaws in Network Security Tools Persistently Prevalent, Gradually Undermining Enterprise Defenses
In the rapidly evolving digital landscape of the past few years, enterprise networks have faced a relentless barrage of cyber threats. A closer examination of the 2023-2025 period reveals common and persistent intrusion points that have proved to be a challenge for network security.
Identity and access management weaknesses have emerged as a prime target for attackers, who increasingly exploit identity as the primary gateway to enterprise data and systems. Credential abuse, multi-factor authentication (MFA) bypass, and privilege misuse have become prevalent tactics.
Third-party and supply chain vulnerabilities have also been a significant concern. Attackers often gain entry via compromised or insufficiently secured third-party vendors, with supply chain attacks remaining a significant vector due to overlooked security gaps.
Misconfigurations in cloud environments have also exposed sensitive data and provided easy access to attackers. Unpatched vulnerabilities in widely used network security tools and appliances have further compounded the problem.
For instance, a critical vulnerability in Citrix NetScaler ADC and Gateway (CVE-2025-6543) was disclosed in June 2025, actively exploited by threat actors. Trojans targeting SonicWall’s NetExtender VPN were identified in mid-2025, and attackers linked to groups like SafePay have exploited unpatched VMware or Citrix appliances.
Sophisticated ransomware groups have also used social engineering tactics, such as spam phishing, phone calls via Microsoft Teams pretending to be IT staff, and leveraging legitimate tools like Microsoft Quick Assist for remote access, to infiltrate networks.
Broader attack techniques include fileless malware, deepfakes, encrypted communication channels, AI-driven phishing, and advanced persistent threats (APTs) that bypass traditional defenses.
Notably, there are no Endpoint Detection and Response (EDR) products for VPN appliances, routers, and firewalls due to the lightweight nature of these devices and vendors' restrictions on third-party software. This leaves victim organizations struggling to discover compromised devices and malware deployment.
Despite these challenges, cybersecurity experts expect firewalls and VPNs to continue being used. Organisations like Palo Alto Networks, which holds a commanding lead in the firewall segment, closing the second quarter of 2024 with a 29% share of the market, continue to play a crucial role in network security.
However, as organisations rapidly adopt digital transformation and innovation, they must also address the legacy tech debt from yesteryear. Incorporating hardware updates into vulnerability programs, as suggested by Sherrod DeGrippo, director of threat intelligence strategy at Microsoft, is a crucial step towards this goal.
The cybersecurity landscape is a dynamic one, and the fight against cyber threats is an ongoing battle. By understanding the common intrusion points and the tools being exploited, organisations can better equip themselves to protect their networks and data.
References: [1] KrebsOnSecurity, 2023-2025: Year in Review. [Online] Available at: https://krebsonsecurity.com/2026/01/2023-2025-year-in-review/ [2] Cybersecurity Dive, The top cybersecurity threats of 2023. [Online] Available at: https://cybersecuritydive.com/news/the-top-cybersecurity-threats-of-2023/639519/ [3] Help Net Security, Top 5 cybersecurity trends in 2023. [Online] Available at: https://www.helpnetsecurity.com/2023/01/01/top-5-cybersecurity-trends-in-2023/
- In the rapidly evolving digital landscape, ransomware groups have used social engineering tactics, such as spam phishing, phone calls via Microsoft Teams, and leveraging legitimate tools like Microsoft Quick Assist for remote access, exploiting vulnerabilities in enterprise networks.
- The 2023-2025 period has shown that identity and access management weaknesses have emerged as a prime target for attackers, with credential abuse, multi-factor authentication (MFA) bypass, and privilege misuse becoming prevalent tactics.
- Third-party and supply chain vulnerabilities have been a significant concern, as attackers often gain entry via compromised or insufficiently secured third-party vendors and supply chain attacks remain a significant vector due to overlooked security gaps.
- Malware and network security threats have also been amplified by misconfigurations in cloud environments and unpatched vulnerabilities in widely used network security tools and appliances, such as the critical vulnerability in Citrix NetScaler ADC and Gateway (CVE-2025-6543) disclosed in June 2025.
- As organizations rush to adopt digital transformation and innovation, they must address the legacy tech debt from yesteryear by incorporating hardware updates into vulnerability programs and focusing on cybersecurity, privacy, and network security to better protect their sensitive data and systems from cyber threats.
