Your Firewall Might Be Giving You a False Sense of Security

It might, if it is the only thing you are relying on. A firewall is essential, but it controls one boundary, and many attacks now go through the firewall itself, around it, or past it with valid credentials. In February 2026, Singapore's Cyber Security Agency disclosed that the state-backed group UNC3886, which targeted all four major Singapore telcos, in one instance "used a zero-day exploit to bypass a perimeter firewall". Sophos's 2026 ransomware survey found 21% of attacks began at a firewall and 8% at a VPN. And Verizon's 2025 breach report found edge devices and VPNs made up 22% of exploitation targets, up from 3% the year before. None of that means firewalls do not work; a well-run next-generation firewall such as a Fortinet FortiGate blocks a great deal. It means the firewall needs patching, MFA, endpoint protection, backups and secure configuration around it. At SourceIT, the FortiGate 50G with 1-year Unified Threat Protection is S$1,819.20 (listed 30 Oct 2026).

How do attacks get past a firewall?

From CSA (Feb 2026), Sophos (2026), Verizon (2025), Microsoft (2025), the Singapore Police Force (Apr 2025) and Fortinet PSIRT advisories.

A firewall is one control, not a security programme. The false sense of security comes from treating it as both.

Why is the firewall itself a target?

Because it faces the internet, runs complex software and holds the keys to the network. Fortinet's PSIRT advisories list several critical FortiOS vulnerabilities exploited in the wild between 2024 and 2026, and other vendors have similar records. Google's threat intelligence team counted 90 zero-days exploited in 2025, of which 21 were in security and networking products. Verizon found only about half of edge-device vulnerabilities were fully fixed within the year, with a median of 32 days to patch. A firewall that is never updated becomes the easiest way in.

What should sit around the firewall?

CSA's Cyber Essentials standard is a good map. Alongside a perimeter firewall, it expects:

• An inventory of hardware, software and data, so you know what you are protecting.
• Malware protection on laptops, desktops and servers.
• Access control, including MFA for administrator access to important systems.
• Secure configuration, such as removing default passwords and unused services.
• Software updates, with known exploited vulnerabilities fixed as soon as possible.
• Backups, stored separately and isolated, tested at least twice a year.
• An incident response plan.

A firewall health check you can run

1. Firmware: is it on a supported release? Fortinet's recommended release for entry models in October 2026 is FortiOS 7.6.8, newer than every fix listed above.
2. Exposure: is the admin interface reachable from the internet? It should not be.
3. Admin accounts: are they individual, with MFA, and are old ones removed?
4. Remote access: has SSL VPN been replaced with IPsec VPN with MFA?
5. Rules: any "allow all" rules, old port forwards or unexplained exceptions?
6. Inspection: are IPS, antivirus and web filtering profiles applied to every outbound policy, with SSL inspection where appropriate?
7. Subscription: is FortiGuard active, and when does it expire?
8. Logs: are logs kept off the device, and does anyone review them?
9. Segmentation: are servers, CCTV, guests and staff on separate networks?

More warning signs are listed in Hackers Have AI Now. Is Your Company's Firewall Still Living in 2015?

If you find a device that was compromised before patching, upgrading alone may not be enough; follow Fortinet's guidance on checking for persistence, and get help. The Cyber Resilience Centre's helpline on 6890 9555 offers triage and advice.

So is a firewall still worth having?

Yes. It blocks automated scanning, known exploits, malicious sites and command-and-control traffic for every device, including the printers and cameras nothing else protects, and it is a Cyber Essentials requirement. The point is to own it actively. For the case for a firewall in the first place, see Your Business Has Antivirus. So Why Would You Need a FortiGate Firewall?; for password practice, Your Company Password Policy Might Be Making Security Worse; and for forgotten devices, A Cyber Incident Can Start With a Forgotten Device in Your Office.

Buying in Singapore

SourceIT supplies FortiGate firewalls with UTP, including the FortiGate 50G (S$1,819.20 with 1-year UTP), 70G (S$2,630.40) and 90G (S$6,094.80), plus renewals for existing units, Microsoft Defender for Endpoint and Synology backup systems, with local warranty and a GST invoice. Prices listed 30 Oct 2026. Browse the FortiGate firewall collection. For a quotation or help reviewing an existing firewall, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

Can a firewall stop every cyberattack? No. Attackers exploit firewalls themselves, sign in with stolen passwords, trick users into running malware and target cloud services the firewall never sees. Firewalls need patching, MFA, endpoint protection and backups alongside them.

Can hackers get through a firewall? Yes. CSA reported in February 2026 that the UNC3886 group used a zero-day exploit to bypass a perimeter firewall at a Singapore telco.

Why are firewalls and VPNs targeted? They face the internet and control access to the network. Verizon found edge devices and VPNs made up 22% of exploitation targets in its 2025 report.

How often should a firewall be updated? Critical and actively exploited vulnerabilities should be fixed as soon as possible, as CSA's Cyber Essentials standard requires. Check vendor advisories at least weekly.

What else do I need besides a firewall? An asset inventory, endpoint protection, MFA, secure configuration, regular patching, isolated and tested backups and an incident response plan, as set out in CSA's Cyber Essentials standard.