FortiBleed turns firewalls into a liability, while Patch Tuesday quietly raises the bar for everyone

This week's theme is simple: the stuff you rely on to keep people out is now being used to let people in.

FortiBleed is not interesting because it is clever. It is interesting because it is mundane. Credentials tied to Fortinet devices were exposed at scale, and CISA is explicitly telling organisations to harden devices because attackers are already using what is out there. For regulated businesses, that is the nightmare scenario. Not a breach that starts with a phishing email, but a breach that starts with remote access you assumed was "fine" because it has always been there.

If you are a financial services firm, a law firm, a government body, or a medical practice, your edge devices sit in the worst possible place. They are internet facing, they often have privileged access behind them, and they tend to be owned by "IT" rather than "security". That gap in ownership is where incidents start. The practical takeaway is not "buy a new firewall". It is to treat edge access like a regulated control. Lock down management access, rotate credentials, enforce MFA, and make sure you can prove who logged in and when.

Now connect that to the Microsoft patch cycle. Patch Tuesday stories can feel like background noise, until they are not. When multiple zero-days are fixed in one month, it is a signal that attackers have working paths into common business environments. In the Channel Islands, most organisations run Microsoft heavily. That means patching is not an IT hygiene task, it is a business continuity control. The organisations that do well are the ones that can patch quickly without drama, because they have a repeatable process, clear ownership, and a short list of systems that always get done first.