The firewall protects the network it sits on and very little beyond it, so what should companies be doing to benefit from its capabilities without relying on it completely? asks Richard Frost, Head of Technology Solutions and Consulting at Armata Cyber Security.
From January to June 2026, ransomware as a service activity increased by 45%. According to Flashpoint, this increase comes down to automation, cheaper access and mature criminal service ecosystems. Attackers are leaner, faster and more efficient while many companies still think of their defences as boundaries – single strong walls between the business and everything outside it. However, that model made sense when people, devices and data all sat in the same building. Today, they rarely do and the gap between where that wall stands and where the business operates is exactly where attackers squeeze their way in. And one of the most commonly used walls, one that does its job well within limits, is the firewall.
The firewall controls the traffic moving in and out of the network it protects but the problem is that a growing percentage of that traffic is moving outside of its protection. When employees take their laptops home, to a client site or to an airport lounge, the device leaves the firewall’s protection behind and the organisation’s most important asset – a connected user with access to company systems – is now operating outside the one control the business relies on the most.
Even inside the office, the firewall only sees part of the threat. It controls network connections according to predefined rules, but it cannot determine whether every permitted connection is being used for a legitimate purpose. When criminals sign in with valid credentials, reuse an authenticated session or abuse approved admin tools, their activity looks like authorised traffic to a firewall. It hasn’t necessarily failed, it has simply been bypassed by more sophisticated methods as attackers find ways to operate within the access your business already allows.
This isn’t the end of the firewall. It is, like all other forms of security, simply a tool that has its limitations and so you need to approach its use cases with those limitations in mind. And this is why a layered defence to security has become possibly the best way to ensure that your business remains secure with a separate control assigned to each route into the business. Email security inspects messages before they reach your inbox, filtering out the links, attachments and impersonation attempts a firewall was never built to read. Endpoint protection guards laptops, desktops and servers, regardless of their location, and watches for an attacker trying to take control of the device.
The most useful way to picture layered defence is as a set of Russian dolls. Open one, and there is another inside, and another inside that. An attacker who gets past the first control meets a second, then a third, and each one is designed to stop what the previous one missed. The value of this approach is that you are not reliant on one or two controls so if they fail, your whole defence doesn’t fail with them. You are building an intelligent, layered system that responds to threats intelligently.
It is important to note that every control will fail at some point. For weeks at a time, a known weakness in one layer may stay open and, during that window, the remaining layers will be all that stand between your business and the attacker. Knowing that you have multiple layers puts your business in a far stronger position to tackle the constantly changing threat environment.
Building this level of defence starts with an honest look at where your business stands today. Do you know where your people log in from and what devices they use? How does email reach them? Where is your data stored? For each route in, ask yourself what stops the attacker at this point and what stops them next if that fails? The more layers there are between the attacker and your data, the harder the path becomes and the more chances you have to catch them along the way.
So no, the firewall isn’t dead or outdated. It is one part of many cogs in a security machine that work together to protect your systems and people from threats that are changing at an extraordinary rate.
