Elodie Collins 
A recent binding operational directive, or BOD, from the Cybersecurity and Infrastructure Security Agency aims to address vulnerabilities associated with outdated edge infrastructure, which is increasingly being targeted by cyber adversaries seeking to gain access to government networks, according to Felipe Fernandez, chief technology officer at Fortinet Federal. In a recent blog post, the executive discussed the security risks posed by legacy edge infrastructure and how CISA BOD 26-02 is strengthening edge security across federal civilian networks.
Fortinet Federal is a platinum sponsor at the Potomac Officers Club’s 2026 Cyber Summit on May 21. Join top cyber experts from across government and industry to explore the growing threats to American systems amid rising global tensions. Tickets are still available here.
Why Is Legacy Edge Infrastructure a Security Risk?
According to Fernandez, agencies are discovering outdated infrastructure across remote offices, testing laboratories, field sites and distributed networks. He explained that end-of-support devices do not get ongoing patching and security updates, making them easier for adversaries to exploit.
He also said that threat actors are utilizing automation tools to more easily and quickly find vulnerabilities in a network.
How Does CISA’s Directive Address These Vulnerabilities?
Issued in February, BOD 26-02 requires agencies to inventory edge devices and decommission unsupported systems within a given timeline.
The directive also calls for continuous lifecycle management to ensure agencies maintain visibility to edge devices and immediately identify which systems have stopped or will stop receiving security updates.
Fernandez said agencies should view the directive “as a catalyst for federal network modernization, pushing agencies to replace legacy systems and adopt more secure, agile technologies.”
What Services Does Fortinet Federal Offer to Agencies Modernizing Edge Infrastructure?
Fortinet Federal provides integrated networking and security platforms designed to help agencies modernize edge devices and meet CISA’s BOD 26-02 requirements.
According to Fernandez, the company’s approach combines networking and security capabilities into a single operating system to reduce complexity and improve visibility across distributed networks. Key features include secure SD-WAN, centralized management and analytics, and artificial intelligence-driven threat intelligence.
