Walk into any small business after a breach and you will find a good firewall, still running, still patched, still doing its job. That detail surprises owners every time. The perimeter held. The attacker never even touched the firewall. The problem walked through the front door with a valid password.
We get called in after these incidents often enough to see the pattern clearly, and the pattern is stubbornly boring. Nobody defeated the hardware. Somebody exploited a routine.
How incidents actually start
Across the incident work we see, the opening move is almost never a defeated appliance. It is a password reused from a site that got breached two years ago. It is an email that looked enough like the bookkeeper’s to get a reply. It is the account of an employee who left in March and could still log in come October. None of those are technology failures. They are habit failures, and no box on a shelf fixes a habit.
Read almost any public breach writeup and you will find the same pattern. The initial access column says phishing, stolen credentials, or an unpatched public-facing app. It almost never says the firewall lost a fair fight. Attackers are businesspeople in a grim sort of way, and habits are the cheapest door on the market.
Your firewall is doing its job. Are you?
A modern firewall is genuinely good at what it does: blocking unsolicited inbound traffic, segmenting networks, logging who talked to what. Ours do exactly that all day long. But a firewall inspects packets, not decisions. When someone in accounting types a real password into a fake Microsoft page, the traffic looks legitimate because it is legitimate. Same story when a departed employee’s VPN account quietly keeps working for seven months.
The habits that do the work
Offboard on the day someone leaves, not at the end of the quarter. Their accounts, their VPN, their saved sessions, their shared passwords, all of it, same day. Put the steps on a checklist with a name attached, because “someone will get to it” is exactly how October logins happen.
Enforce MFA everywhere it exists, including the systems that feel too small to matter, because attackers specifically hunt for the ones you skipped. While you are at it, read our piece on MFA fatigue, because attackers have habits too. Then kill password reuse with a proper password manager so one breached shopping site cannot unlock your payroll.
Review admin rights on a calendar, not on a hunch. The number of people with domain admin should make you slightly uncomfortable and then get smaller. And rehearse the phishing conversation until reporting a click feels routine instead of shameful, because the difference between a Tuesday report and a Friday confession is often the difference between an incident and a headline.
One more habit that costs nothing: know what normal looks like. Five minutes a month glancing at login reports teaches you the rhythm of your own company, and rhythm is what makes the login from a country you have no customers in jump out. You do not need a security operations center to notice things. You need a calendar reminder and a little stubbornness.
Where the firewall fits
Keep it. Patch it. Let it do the job it is genuinely good at, which is being one layer among several. CISA’s Secure Our World guidance says the same thing in friendlier fonts: strong passwords, MFA, updates, and phishing awareness carry most of the load. The firewall is the fence. The habits are the locks people actually use.
When the budget conversation happens, remember that the cheapest security improvements available to you are behavioral: an offboarding checklist, an MFA mandate, a quarterly access review. They cost hours, not thousands. If you want help turning them into routines that survive a busy quarter, that is exactly what our defend practice exists for.
The uncomfortable summary: your network is probably defended better than your routines are. Fix the routines, and the firewall you already own gets dramatically more effective.
