# Edge Device and Admin Laptop Hardening Kit

This kit helps a small business with a VPN or firewall appliance and a handful of admin or banking users do two things in 30 days: find and patch internet-facing devices, and separate the machines that hold the keys to money and domains from everyday work. It is written for owners who work with an outsourced or part-time IT person. Print it, fill in the worksheets by hand, and keep it with your insurance papers. Nothing here replaces a vendor advisory, so always check the vendor's own notice for each device.

## Why this matters, in three lines

- Reporting says an open-source AI penetration-testing framework was pointed at more than 200 organizations. That is a target count, not confirmed breaches.
- US government patch deadlines do not apply to private companies. Set your own, such as 14 days.
- A compromised privileged laptop was cited in a very large crypto theft. Your version is one laptop that does everything.

## Checklist

- [ ] List every device or service reachable from the internet (VPN, firewall, remote-access gateway, self-hosted code or file server, virtualization host).
- [ ] For each one, record vendor, model and current version in the inventory worksheet below.
- [ ] Check each item against CISA's Known Exploited Vulnerabilities catalog and the vendor's own advisory page.
- [ ] Patch Ivanti, Cisco, GitLab and VMware entries first, within your own 14-day deadline.
- [ ] Turn on automatic updates or set a monthly patch window for every edge device.
- [ ] Identify any appliance the vendor no longer supports and put a replacement date on it.
- [ ] Write down everyone who holds admin, banking, registrar, payroll, cloud console or code-hosting access.
- [ ] Give those people a separate, locked-down device or browser profile used only for those tasks.
- [ ] Put hardware security keys or passkeys on admin, banking, email and registrar accounts, with a spare key stored safely.
- [ ] Remove standing admin rights from everyday user accounts.
- [ ] Ask your insurer or IT provider, in writing, what patching and MFA they require.
- [ ] Turn on alerts for new logins and new MFA devices on admin accounts.
- [ ] Write the one-page lost or compromised admin laptop plan and run through it once.

## Worksheet 1: Internet-facing asset inventory

Fill in one row per device or service. Add rows as needed.

| Device or service | Vendor | Model | Version now | Owner (person) | Last patched | On CISA KEV? (yes/no/unknown) | Patch by (date) |
|---|---|---|---|---|---|---|---|
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |

## Worksheet 2: 14-day patch priority

Order rows by this rule: known-exploited first, then vendor-critical, then everything else. Write the date you finish each.

| Priority | Item | Why it ranks here | Maintenance window | Rollback step | Done (date) |
|---|---|---|---|---|---|
| 1 | | | | | |
| 2 | | | | | |
| 3 | | | | | |
| 4 | | | | | |

## Worksheet 3: Privileged-access register

| Person | Accounts with admin or money access | Device used for these tasks | Hardware key issued (yes/no) | Standing admin on daily account removed (yes/no) |
|---|---|---|---|---|
| | | | | |
| | | | | |
| | | | | |

Rules for the separate admin device or profile:

- Used only for banking, registrar, payroll, cloud console and code-hosting logins.
- No personal email, no general web browsing, no downloads from unknown sources.
- Operating system and browser kept on automatic updates.
- Stored locked when not in use. Spare security key stored somewhere other than the laptop bag.

## Worksheet 4: MFA rollout tracker

| Account | Owner | Current MFA type | Target (security key or passkey) | Spare key registered | Date done |
|---|---|---|---|---|---|
| Business email | | | | | |
| Bank portal | | | | | |
| Domain registrar | | | | | |
| Cloud console | | | | | |
| Payroll | | | | | |
| Code hosting | | | | | |

## Worksheet 5: 30-day calendar

| Week | Task | Who (owner / IT provider / staff) | Hours | Done |
|---|---|---|---|---|
| 1 | Inventory internet-facing devices | | | |
| 1 | Check inventory against KEV and vendor advisories | | | |
| 2 | Patch known-exploited items | | | |
| 2 | Turn on automatic updates or monthly window | | | |
| 3 | Buy or assign admin device; issue security keys | | | |
| 3 | Move admin, bank, email and registrar to keys | | | |
| 4 | Set login and new-MFA-device alerts | | | |
| 4 | Run the lost-laptop drill once | | | |

## Template: one-page lost or compromised admin laptop response

```text
ADMIN LAPTOP LOST OR SUSPECTED COMPROMISED

Call first: [name, phone] (owner)      Then: [name, phone] (IT provider)

Within 15 minutes:
1. Lock or revoke sessions on: bank portal, registrar, cloud console, payroll, code hosting, email.
2. Remove the laptop's security key from each account using the spare key.
3. Change passwords for those accounts from a different, trusted device.

Within 1 hour:
4. Call the bank's business fraud line: [number]. Ask for a hold on new payees and wires.
5. Check each account's recent login history and list of registered MFA devices. Remove anything unfamiliar.
6. Tell [insurer / broker contact] if there is any sign of unauthorised access.

Within 24 hours:
7. Preserve the device (do not wipe it) until the IT provider has looked at it.
8. Write down what was on it, who used it last, and when it was last updated.

Spare security key is kept at: [location]
Account list is kept at: [location]
```

## Template: email to your insurance broker

```text
Subject: Questions about security requirements on our cyber policy

Hello [name],

Ahead of our renewal on [date], could you tell me in writing:
1. What patching expectations the policy has for internet-facing devices (VPN, firewall, remote-access gateway), including any time limits.
2. What multi-factor authentication the policy requires, and for which accounts.
3. Whether a compromised admin laptop affects coverage, and what we would need to show we had in place.
4. Whether any controls are conditions of coverage as opposed to recommendations.

If any of this is in the policy wording, please point me to the section.

Thank you,
[name, business]
```

## Prompts (paste into your AI assistant with your own documents; tell it to say when it is unsure)

```text
Act as a cautious IT consultant for a small business with about [number] employees. Below I will paste a list of our internet-facing devices and software versions, copied from our own inventory. Rank them by patch urgency, tell me which vendor advisories I should look up myself, and give me a two-week patch schedule with a rollback step for each item. Only use the list I give you. If you are unsure whether a version is vulnerable, say so plainly instead of guessing, and tell me where to verify it.

[paste inventory here]
```

```text
Write a plain-English one-page policy for our business that separates privileged work (banking, domain registrar, cloud admin, payroll) from everyday browsing and email. Base it on the account list and device list I paste below. Include which devices, which accounts, MFA rules, and what to do if a privileged laptop is lost or suspected compromised. Keep it under 400 words. Flag any account or device on my list that you can't classify and ask me about it rather than assuming.

[paste account list and device list here]
```

```text
I run a business with a VPN appliance from [vendor] and a self-hosted [GitLab/file server/other]. Using the notes I paste below about how our IT provider currently handles updates, give me a checklist of questions to ask them about patch timing, logging, MFA and backups, and describe what a good answer sounds like for each. Where my notes are silent on something, list it as an unknown to ask about instead of assuming it's fine.

[paste your notes about current IT arrangements]
```

```text
Draft a short, polite email to my insurance broker. I will paste the relevant parts of our cyber insurance policy below. Ask what edge-device patching, MFA and endpoint controls the policy expects, and whether a compromised admin laptop would affect coverage. Quote the policy language I give you where it matters. If the pasted text doesn't answer a point, say that it's unclear and turn it into a question for the broker.

[paste policy excerpts here]
```

```text
Create a 30-day calendar for a small business to inventory internet-facing systems, patch them, move admin accounts to hardware keys, and test a lost-laptop recovery drill. Use the staff list and hours I paste below. Assign each task to 'owner', 'IT provider' or 'staff' and estimate hours per task. Mark any estimate you are unsure about.

[paste staff list, available hours and any existing IT contract details]
```

## Sources

- https://apprised.news/desk/tech/2026-11-03
- https://www.bleepingcomputer.com/news/security/chinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs/
- https://securityaffairs.com/202281/malware/volta-the-infostealer-that-asks-an-ai-which-victims-are-worth-the-effort.html
- https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years
- https://research.checkpoint.com/2026/2nd-november-threat-intelligence-report/
- https://www.rte.ie/news/world/2026/1103/1597715-korea-binance-world/
- https://www.nextgov.com/cybersecurity/2026/11/industry-groups-urge-congress-renew-cyber-threat-sharing-law-through-defense-authorization/416985/