The edge device warning NCSC gave you in August just showed up in your logs

In late August, the National Cyber Security Centre issued an advisory most IT teams filed and moved past. It warned of "increased targeting of operational technology... and internet exposed systems and edge devices affecting all sectors," driven by misconfiguration, legacy connections and unmanaged devices still running insecure protocols like Telnet and SNMPv1/v2. 

Weeks later, it stopped being general.

CISA added a newly named chained exploit, dubbed MikroTrick, to its Known Exploited Vulnerabilities catalogue. An SSH authentication-bypass flaw in MikroTik RouterOS, chained with a second vulnerability, hands an attacker full unauthenticated administrative access to internet-exposed routers and firewalls. CERT Polska has documented active attacks since early September. Alongside it, a code-injection flaw in Microsoft SharePoint Server, rated 8.8 out of 10 in severity, lets an authenticated low-privileged attacker run arbitrary code remotely. Federal agencies in the US were given until today to remediate both, under CISA's binding directive.

That is the exact device class NCSC's August advisory described. From general warning to catalogued, actively exploited attack chain: five weeks.

Only 18% of higher education institutions have Zero Trust architecture in place. Ninety-four per cent of IT teams report being understaffed. Put those two numbers together and the honest answer to "is your edge estate inventoried, or assumed?" is often somewhere between the two, and closer to assumed than most teams would say out loud in a board meeting.

The cost of getting this wrong is not abstract. In late August, a group calling itself FulcrumSec breached Manchester, Stansted and East Midlands airports through Manchester Airports Group. When the ransom deadline passed unpaid, the group released roughly 550 gigabytes of data: contact details, vehicle registrations, postcodes, booking history for 8.8 million people. A security researcher has since warned the group is using AI to mine the leaked data for targeted phishing.

Universities hold a comparable shape of data, at comparable scale: student and alumni contact details, addresses, financial and academic records, held for years rather than months. The same refuse-to-pay-then-leak playbook that worked against an airport operator works just as well against a university — and the follow-on risk isn't the breach itself. It's the phishing campaign against every current student and every alumnus with an email address on file, run by an attacker who now has the target list and the tools to personalise every message.

None of this is about buying a better firewall. It's about how fast a patch actually reaches the device that needs it, how quickly an unmanaged VPN concentrator or legacy remote-access gateway gets found and retired rather than quietly accreted onto the network years ago, and whether "our edge estate is inventoried" is a fact your team can demonstrate or a belief they're carrying on your behalf.

A managed cloud platform closes that gap by design rather than by heroics: continuous patching against a known, current baseline, rather than a quarterly cycle racing an attacker who moved five weeks faster this time.

Security starts with visibility. Before an organisation can modernise or secure its environment, it needs a clear understanding of what exists today. Cloud readiness is not simply about planning a migration; it is about discovering business-critical applications, infrastructure dependencies, legacy connections and externally exposed services that may not be fully documented. By establishing an accurate baseline of the current estate, institutions can make informed decisions about risk reduction, security improvements and future transformation priorities.

The Cloud Readiness Assessment is a free, no-obligation way to find out where your own estate actually stands against that question, before the next advisory becomes the next headline rather than a warning you had time to act on.

So, is your edge estate inventoried, or assumed? It's worth answering honestly before something else answers it for you.

Find out more: Tribal Cloud v3.