Your rule base is your biggest hidden risk

Originally posted on LinkedIn — Leader Series · 2026-05-21

Your firewall rule base is your biggest hidden risk.

Not ransomware. Not phishing. The thing your team built — and stopped reviewing.

Here’s what happens in every organization I’ve seen:

Year 1 — Clean rule base. Every rule has a purpose. Year 2 — A few “temporary” rules added for a project. Year 3 — Nobody remembers what half the rules do. Year 5 — 800+ rules. Engineers afraid to delete anything.

This is technical debt with a security price tag.

What broad, forgotten rules actually cost you:

🔴 Attack surface you can’t measure
🔴 Compliance failures during audits
🔴 Slower incident response (more rules to check)
🔴 Engineers who guess instead of know
🔴 Real risk hiding in “we’ll fix it later”

The questions that will tell you where you stand:

1️⃣ How many rules do we have today?
2️⃣ How many were last modified more than 2 years ago?
3️⃣ How many use “any” as source or destination?
4️⃣ Do we know which rules have never matched a single packet?

If you can’t answer #4 — your firewall has rules doing nothing. Or worse, doing something nobody intended.

A quarterly rule review isn’t paperwork. It’s risk reduction.

When did your team last clean house?