Why End-of-Support Edge Devices Have Become a National Security Risk

### Executive summary CISA's Binding Operational Directive 26-02 mandates that federal agencies inventory, decommission, replace, and continuously discover End-of-Support (EOS) edge devices on defined timelines (3, 12, 18, and 24 months) to mitigate active exploitation of unsupported edge infrastructure; the brief frames EOS devices as high-risk perimeter blind spots that undermine Zero Trust and urges lifecycle management and procurement alignment rather than reactive patching.