Industrial Espionage: The Edge is the New Frontier for State-Sponsored Attackers. TrendAI's Analysis

The edge is increasingly under attack, particularly from attackers sponsored by States or their rogue parts. TrendAI puts this in black and white in its research "How State-Sponsored Actors Exploit Your Perimeter," highlighting how more and more cybercriminals are focusing their attention on the violation of IoT devices like firewalls, VPN gateways, and connected devices in general.

Attacks against edge devices represent 22% of the total in 2025, up from just 3% the year before. Historically, cybercriminals have exploited phishing emails as their initial attack vector. For years, email has been the most vulnerable point for any organization: a mere click on a malicious attachment or link gives attackers initial access to IT systems.

However, in 2025, TrendAI noted a shift: attacks targeted at enterprise edge devices (routers, firewalls, VPN gateways, IoT devices) have grown tremendously. If these represented 3% of breaches in 2024, they skyrocketed to 22% in 2025.

According to TrendAI, one reason for this trend is also economic: exploits for edge devices are sold at relatively low prices. We're talking about prices ranging from $30,000 to $100,000—considerable amounts, but definitely within reach for groups of attackers backed by a State. In contrast, exploits for browsers and mobile devices trade for up to 10 times these amounts. Additionally, hardware manufacturers typically take about 30 days to release security patches, a time frame more than sufficient to exploit vulnerabilities.

Moreover, edge devices are often closed systems that provide only a limited set of logs, making it easier for attackers and more difficult for IT teams to detect attack attempts.

The situation is not set to improve, according to TrendAI: the company has indeed found that even groups of "independent" criminals, not linked to States, have started to target the edge, enhancing their campaigns through AI to search for undiscovered vulnerabilities.