The user may start the incident. OAuth apps, tokens, and integrations can turn it into quiet, scalable data theft.

We put a 30% chance on two public FCEB cases proving post-deadline edge exploitation by year-end.

A firewall, VPN, or secure-access gateway can hold much more than vulnerable code. It can mediate trusted sessions, store service-account credentials, expose configuration secrets, and connect external identities to internal systems. Once those artifacts leave the appliance, remediation becomes a trust-recovery problem—not only a software-maintenance task.

A lot of KEV response still collapses into one closure condition: the vulnerable system was patched. That works if exploitation never happened. It is weaker when the asset was exposed, telemetry is incomplete, or the system carries identity, remote-access, payment, or administrative authority.

AI gateways are starting to concentrate credentials, logs, routing, quotas, and policy. That makes them worth watching now.

China-linked operators are turning compromised routers into relay logistics. The defender move is behavior over bad IPs.

A malicious package can be removed. A credential harvested from the build path can keep creating risk long after the incident looks closed. That is why “cleanup” and “containment” are not the same word, even if a dashboard would very much like them to be.