The price tag isn't what costs you money. A router at around S$300 can be a perfectly good business device. The losses come from what many home-grade routers lack once they are in an office: a published support lifetime, separate networks for staff and guests, central management and logs, and a second internet line that takes over when the first fails. Government advisories since 2024 show attackers building botnets out of old routers that vendors no longer patch. And when the only router fails, every person in the office stops at once. The "thousands" in the headline is easy to reach. Ten staff idle for four hours already costs about S$1,800 in wages before you count lost sales or recovery time (illustrative CALC below).
What should you check before trusting a router with your office?
| Check | Typical home router | Typical business router or gateway | Why it matters |
|---|---|---|---|
| Published support / end-of-life policy | Often none | Usually published (e.g. Cisco Meraki: about 5 years of support after end of sale) | End-of-life routers formed the KV and Moonlander botnets |
| Singapore security label | CLS Level 1 mandatory for residential routers since 2 May 2022 | Not mandated | The label covers basics, not office features |
| Separate staff, guest and device networks (VLANs) | Usually a guest Wi-Fi only | Yes | Keeps visitors and cameras off the staff network |
| Central management and config backup | Phone app, one device at a time | Cloud or controller | A failed unit can be replaced and restored quickly |
| Dual-WAN failover | Rare | Common | A second line keeps the office online |
| Logs and syslog export | Minimal | Yes | You can see what happened after an incident |
| Remote administration | Sometimes left on for convenience | Usually restricted | The FBI's May 2025 advice: switch it off |
Source: FBI FLASH (7 May 2025, as reported by Bitdefender and The Register); US DOJ/FBI KV botnet disruption (31 Jan 2024); CSA Cybersecurity Labelling Scheme (2022) and MDDI announcement (2 Mar 2026); Cisco Meraki end-of-life policy. Features vary by model; check the datasheet.
How do old routers end up costing businesses money?
The documented pattern is consistent: attackers go after routers that are past end of life, where known flaws will never be fixed.
- KV botnet (Jan 2024). The US Justice Department and FBI disrupted a network, run by the group known as Volt Typhoon, built mostly from end-of-life Cisco and NETGEAR routers "no longer supported" by their vendors.
- Raptor Train (Sep 2024). Lumen's Black Lotus Labs traced more than 200,000 compromised small-office routers, cameras and NAS devices since 2020. The FBI later cited more than 260,000 devices. Brands included ASUS, DrayTek, MikroTik, QNAP, Ruckus, Synology, TP-Link and Zyxel, so business brands were affected too.
- Moonlander (May 2025). The FBI warned that end-of-life Linksys and Cisco routers were being infected and rented out as criminal proxies. US authorities alleged the operation earned more than US$46 million.
- No fix coming. In Nov 2024, D-Link said it would not patch a critical flaw in about 60,000 internet-exposed end-of-life modems and told owners to replace them. In Jun 2025, CISA added a flaw in three TP-Link router models that were discontinued in 2017 to its Known Exploited Vulnerabilities list and advised discontinuing them where no fix exists.
When your router becomes someone else's proxy, the bill arrives in several ways: traffic from your IP address gets blocked, email starts landing in spam, staff time goes on clean-up, and in the worst case attackers get a foothold inside your network. Our post on the hidden cost of end-of-life hardware covers how to track support dates across your kit.
The question to ask any router vendor isn't "how fast is it?" but "until what date will you ship security updates for it?". If nobody can answer, budget for its replacement now.
What does an outage actually cost?
Here is a simple model. The figures are assumptions; put in your own.
- 10 staff at a loaded cost of S$45 an hour, offline for 4 hours while a failed router is replaced: S$1,800 (CALC).
- Add an afternoon of outside IT support, a missed client call or an online order system that went dark, and the total climbs quickly.
- Repeat it twice a year because nobody kept a spare or a configuration backup, and the router has cost several times its purchase price.
A business router with a second WAN port and a cheap 4G/5G backup line would have kept that office working. We cover the wider resilience plan in our guide to surviving an internet outage.
Isn't a cheap router fine for a very small office?
Sometimes, yes. Singapore already requires residential routers sold here to carry at least CLS Level 1, which covers unique default passwords, vulnerability management and keeping software updated. The requirement rises to Level 2 by end 2027, according to CSA's 2 Mar 2026 announcement. For a two-to-five-person office with no servers, a current, labelled router with automatic updates and a separate guest Wi-Fi can be proportionate.
It stops being enough when you have staff, guests and devices such as cameras or printers that shouldn't share one network; when downtime costs real money; when a client or Cyber Essentials assessment asks for documented configurations; or when the router is more than a few years old with no update in sight. CSA's Cyber Essentials mark expects default passwords changed, secure configurations for routers and firewalls, and end-of-support assets removed or risk-assessed. An expensive business router left unpatched is no better than a cheap one. If you're weighing a router against a full firewall, read why a S$200 router isn't a replacement for a business firewall and why a firewall alone can give a false sense of security.
What should a small office do this month?
- Look up your router's model and its vendor's end-of-life list. If it is past end of support, plan to replace it.
- Switch off remote administration from the internet and change any default password.
- Put guests, cameras and smart devices on their own network. Our post on network switch security explains how VLANs carry that separation through the office.
- Back up the router's configuration and keep a note of the ISP settings.
- Add a second internet line, even a mobile one, if an outage would stop work.
Buying in Singapore
At around the S$300 mark, the D-Link DBR-600-P multi-gig PoE business router is S$330 and the D-Link DSR-250V2 VPN router is S$336. A step up, the HPE Instant On Secure Gateway SG1004 is S$649.20 and the SG2505P with 2.5GbE and PoE is S$940.80. For a full firewall, the FortiGate 30G is S$766.80 and the FortiGate 50G S$1,168.80; check with us which security subscriptions are included (all listed 8 Nov 2026). Prices change; ask for a current quotation. For help sizing, see our FortiGate sizing guide. Use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Are cheap routers insecure? Not automatically. Routers sold for homes in Singapore must carry at least CLS Level 1. The documented risk is routers past end of life that no longer get security updates, whatever the brand.
How do I know if my router is end of life? Check the model on the vendor's end-of-life or end-of-support page. If the last firmware release is years old and no support date is published, treat it as unsupported.
What is dual-WAN and do I need it? Dual-WAN lets a router use two internet connections and switch over if one fails. If an outage would stop sales or client work, it is one of the cheapest forms of insurance.
Is a business router the same as a firewall? No. Some business routers include basic firewall and VPN features, but a next-generation firewall adds deeper inspection and security subscriptions. Choose based on your risk and compliance needs.
What does Cyber Essentials expect for routers? CSA's Cyber Essentials mark expects default passwords changed, secure configurations for network devices such as routers and firewalls, and assets past end of support removed or formally risk-assessed.
