Network ‘background noise’ may predict the next big edge-device vulnerability

GreyNoise analysis found that large-scale reconnaissance and inventory-scanning surges targeting edge devices (routers, VPNs, firewalls, and security appliances) frequently precede vendor vulnerability disclosures, with a median lead time of nine days and roughly half of surges followed by a disclosure within three weeks; increases in both session counts and new source IPs are presented as high-confidence early-warning signals that defenders can use to detect imminent exploitation across multiple major vendors.