Edge Infrastructure Under Siege: What Two Independent Datasets Reveal About Who’s Exploiting Your Perimeter

Tenable and SentinelOne show that state-sponsored actors and criminal ransomware groups independently converge on the same edge-product vendors (e.g., F5, Citrix, Ivanti, Fortinet), with confirmed multi-nexus exploitation of multiple CVEs, widespread organizational exposure, slow remediation (e.g., Citrix median 461 days), and DFIR cases demonstrating credential theft, management-plane abuse, and lateral movement — recommending urgent patching of high-exposure vendors, attack-surface minimization, and edge-specific patch SLAs.