A firewall, VPN, or secure-access gateway can hold much more than vulnerable code. It can mediate trusted sessions, store service-account credentials, expose configuration secrets, and connect external identities to internal systems. Once those artifacts leave the appliance, remediation becomes a trust-recovery problem—not only a software-maintenance task.
A lot of KEV response still collapses into one closure condition: the vulnerable system was patched. That works if exploitation never happened. It is weaker when the asset was exposed, telemetry is incomplete, or the system carries identity, remote-access, payment, or administrative authority.
AI gateways are starting to concentrate credentials, logs, routing, quotas, and policy. That makes them worth watching now.
China-linked operators are turning compromised routers into relay logistics. The defender move is behavior over bad IPs.
A malicious package can be removed. A credential harvested from the build path can keep creating risk long after the incident looks closed. That is why “cleanup” and “containment” are not the same word, even if a dashboard would very much like them to be.
Attackers do not need one specific proxy brand to survive. They need residential egress that still works: clean-looking IPs, geographic routing, rotation, and enough reliability to keep credential stuffing, scraping, fake account creation, ad fraud, and account takeover moving.
Operation Endgame gave defenders a rare clean scoreboard: servers and domains actioned, credentials recovered, crypto assets restricted, and compromised websites remediated.