FisherKing
The devices you can’t patch are the ones you have to budget for.
Most IT teams track end-of-life in one place and vulnerabilities in another. The riskiest devices sit in the overlap: hardware or firmware that’s past or near end-of-life and still carrying known CVEs. We call it double jeopardy. FisherKing finds it, ranks it by what’s actually being exploited, and carries it through to a costed replacement.
Sample tenant from the interactive dashboard.
Why now
On February 5, 2026, CISA issued Binding Operational Directive 26-02, Mitigating Risk From End-of-Support Edge Devices. Firewalls, routers, switches, VPN gateways and load balancers sit on the perimeter, are slow to patch, and often stay in service long after the vendor stops supporting them. CISA now treats that as an unacceptable risk, and it spells out the fix as inventory, lifecycle management and continuous discovery. That’s what FisherKing does.
- 3 monthsInventory every end-of-support edge device on CISA’s list and report it.
- 12 monthsDecommission those devices, and inventory anything reaching end of support in the next year.
- 18 monthsFinish replacing them with vendor-supported equipment.
- 24 monthsRun continuous discovery and a lifecycle program that retires devices before support ends.
The directive binds US federal civilian agencies, but CISA, the FBI and the UK’s NCSC urge every organization to follow it. Sources: CISA BOD 26-02; VulnCheck, 2026 State of Exploitation: Exploring the Network Edge.
Discover what you actually have
Import a CSV of the assets you already track, or let a lightweight collector inventory your network over SNMP, down to individual stack members, serial numbers, models, and firmware versions.
Join lifecycle and vulnerabilities on one record
Vendor end-of-life dates and the national CVE feed are matched to each asset on CPE identifiers, not fuzzy name strings, so both answers describe the same device at the same moment.
Rank by what’s actually exploited
Known exploitation first, then EPSS exploit prediction, then CVSS severity. The ranking reruns on a schedule, not when someone remembers.
Carry it through to a budget line
Devices that can only be replaced are scoped by end-of-life quarter, costed, and tracked from first quote through to delivery.
Most tools stop at “no fixed version available.” FisherKing keeps going, into a scoped replacement, a costed quarter, and a purchase order.
How it works
- Ingest a CSV of assets, or deploy a collector for live discovery. Collectors enroll with the platform using mutual TLS certificates and scan the networks you point them at.
- Review what comes in. Imported and discovered devices land in a review queue, and you choose what goes into your matching inventory. Once a device is in inventory, CVE and lifecycle matching is automatic.
- Act on the overlap. Lifecycle dates and matched CVEs come together on each asset and roll up into a single risk view.
See it in action
A look at three FisherKing screens: the risk overview, what the collector finds on your network, and the lifecycle and vulnerability picture for a single device.
Risk overview
Demo tenant, 612 managed assets across 4 sites
Highest-risk assets
| Asset | Model | Lifecycle | Worst CVE | CVSS |
|---|---|---|---|---|
| akl-core-sw01 | Cisco C3850-48P | Past end of sale | CVE-2023-20198 | 10.0 |
| akl-dist-sw02 | Cisco C2960X-48FPD-L | Past end of sale | CVE-2018-0171 | 9.8 |
| wlg-br-fw01 | FortiGate 60E | OS past support | CVE-2024-21762 | 9.6 |
| chc-wan-rt01 | Cisco ISR 4331 | Past end of sale | CVE-2023-20198 | 10.0 |
Double jeopardy by vendor
Every asset that's both aging out and exposed, ranked, so refresh and patching budgets go where the risk actually is. Try the live dashboard
Discovered assets
Last scan by collector sg-col-01, 42 devices found, 9 new
| Device | Address | Model | Serial | Firmware | Status | |
|---|---|---|---|---|---|---|
| akl-dist-sw02 (stack of 2) | 10.20.4.2 | C2960X-48FPD-L | IOS 15.2(2)E7 | Ready to add | Add to inventory | |
| Member 1 | C2960X-48FPD-L | FOC2231X0A1 | IOS 15.2(2)E7 | |||
| Member 2 | C2960X-48FPD-L | FOC2231X0B7 | IOS 15.2(2)E7 | |||
| akl-core-sw01 | 10.20.0.1 | C3850-48P | FCW2144G0C9 | IOS XE 16.12.4 | In inventory | View |
| wlg-br-fw01 | 10.40.0.254 | FortiGate 60E | FGT60E4Q17001234 | FortiOS 6.4.9 | In inventory | View |
| akl-gw-ucg | 10.20.9.1 | UCG-Ultra | Not reported | UniFi OS 4.1 | Needs review | Review |
| chc-ap-17 | 10.60.3.17 | Aruba AP-515 | CNR7K2Z0QD | AOS 8.10.0.6 | Ready to add | Add to inventory |
The collector inventories devices over SNMP down to individual stack members, then lets you review and add them to your inventory.
akl-dist-sw02
Access switch stack, Auckland distribution room
Asset facts
- Vendor
- Cisco
- Model
- WS-C2960X-48FPD-L
- Stack
- 2 members
- Serials
- FOC2231X0A1, FOC2231X0B7
- Firmware
- IOS 15.2(2)E7
- Discovered by
- SNMPv3, collector sg-col-01
- Last seen
- Today, 06:12
Lifecycle
- End of saleOct 2022
- End of SW maintenanceOct 2023
- Last day of supportOct 2027
Matched vulnerabilities
| CVE | Issue | CVSS |
|---|---|---|
| CVE-2018-0171 | Smart Install remote code execution | 9.8 |
| CVE-2017-3881 | Cluster Management Protocol code execution | 9.8 |
| + 9 more matched to this firmware | ||
Vendor lifecycle dates and matched CVEs side by side for the exact model and firmware running on each device.
Screens shown with sample data.
Built for enterprise IT
FisherKing is multi-tenant from the ground up. Each customer's data is kept separate, access is role-based, people sign in through single sign-on, and collectors authenticate with their own certificates. It's built to serve enterprise IT teams directly and through reseller partners.
It isn't a rip-and-replace. FisherKing sits alongside the scanners, asset inventory and CMDB you already run, and covers the overlap they leave open.