EN 
For the last decade, cybersecurity has responded to an evolving threat landscape by adding new layers of defense.
Organizations invested in endpoint security, identity, cloud security, vulnerability management, detection and response, and more recently, AI-powered security tools. Those investments were necessary. The attack surface changed, and security teams changed with it.
But underneath those controls, something much older continued to accumulate: network access.
Applications migrated. Servers were replaced. Companies moved workloads to the cloud. Acquisitions brought new infrastructure into the environment. Temporary firewall changes became permanent. Exceptions remained because removing them carried the risk of disruption.
The result is a reality many security teams know all too well:
We didn’t deliberately design today’s enterprise access model. We inherited it.
For years, the complexity that came with that inheritance could be treated as firewall hygiene or technical debt. Clean it up when there is time. Review old rules during the next audit. Don’t touch the policy nobody understands unless you absolutely have to.
AI-assisted vulnerability discovery, attack path analysis, and exposure identification are changing that calculation.
The issue isn’t simply whether your firewall policies are clean. It’s whether years of accumulated access provide attackers with paths the business no longer needs, and whether your security team can confidently eliminate those paths when it matters.
The Numbers Tell the Story of How We Got Here
FireMon Insights data provides a window into the scale of the problem across real enterprise environments.
The individual statistics are striking. Together, they tell a bigger story about how network access accumulates and why it becomes so difficult to remove.
69% of Firewall Rules Are Unused
Start with one of the clearest indicators: FireMon Insights finds that 69% of firewall rules are unused.
It is easy to look at that number and see a cleanup problem. But ask a more important question: How did organizations end up with so much access they apparently aren’t using?
Most rules were presumably created for a reason. An application needed to reach a database. A team launched a project. Infrastructure was migrated. Someone needed temporary access to troubleshoot a problem. A business unit needed to connect to a new service.
Then something changed.
The project ended. The application moved. The server was decommissioned. The employee changed roles. The temporary requirement disappeared.
The rule remained.
Enterprise security has become very good at creating access. Historically, it has been much less effective at retiring it.
Multiply that behavior across years of changes, thousands of rules and increasingly hybrid infrastructure, and unused access stops looking like a handful of forgotten firewall rules. It becomes accumulated network-access debt.
45% Lack an Owner or Documentation
Another FireMon Insights finding helps explain why that debt is so difficult to eliminate: 45% of firewall rules lack an owner or documentation.
Imagine being the engineer responsible for cleaning up an unused rule.
You can see that it hasn’t been used. But you don’t know who requested it. There is no documented business justification. The application owner isn’t clear. You can’t immediately determine what will happen if you remove it.
What is the operationally safer decision?
Often, it is to leave the rule alone.
That decision makes sense in isolation. Breaking production because you removed an unexplained firewall rule is a much more immediate problem than leaving unused access in place.
But repeat that decision across an enterprise for years and the consequence becomes significant. Organizations inherit access that nobody fully understands, yet nobody feels confident enough to remove.
Complexity Goes Deeper Than the Rulebase
The same pattern appears below the individual rule level. FireMon Insights finds that 95% of firewall application objects are unused.
Again, the point isn’t that unused objects are inherently dangerous.
The number shows how much historical infrastructure can accumulate inside network policy. Rules, objects, applications and access requirements remain even as the environment around them changes.
Over time, the distance grows between what the network permits and what the business actually requires.
And that is where a policy-management problem becomes a security problem.
Unused Access Is Latent Attack Surface
Historically, unused firewall rules were often treated as hygiene.
If a rule wasn’t causing an outage, triggering an audit finding or creating an obvious vulnerability, removing it had to compete with dozens of more urgent priorities.
But an attacker doesn’t care whether the business has used a rule recently.
They care whether the network will allow the traffic. That changes how we need to think about unused access.
Consider what happens when a new vulnerability is discovered.
Vulnerability management can help answer:
Where are we vulnerable?
Network policy determines something different:
What can reach that vulnerability?
And if the vulnerable system is compromised:
What can it reach next?
Those questions determine whether a vulnerability is isolated behind tightly controlled access or sits along a path that can help an attacker move deeper into the environment.
The more unnecessary connectivity an organization carries, the more potential paths exist.
This is why what used to be considered network hygiene is increasingly attack-surface reduction.
Cleaning up an unused rule isn’t valuable simply because the firewall configuration becomes easier to manage. Removing unnecessary access reduces the amount of connectivity available to anyone who compromises something inside the environment.
Removing a Rule Isn’t the Same Thing as Removing Access
Unused access is only one side of the problem. FireMon Insights also finds that 17% of firewall rules are redundant or shadowed.
That can sound like another rule-cleanup statistic. But redundancy and policy complexity create a more subtle security risk: they can undermine remediation itself.
Imagine a security team discovers a critical vulnerability in an application.
The team investigates and determines that the vulnerable application is reachable through a firewall rule. The access isn’t necessary, so an engineer removes the rule.
The change is successful. The rule is gone. The remediation ticket gets closed.
There is only one problem: the access may still exist.
A broader rule could independently permit the same communication. An overlapping policy could allow the traffic. Another firewall could provide a different path. In a cloud environment, another enforcement point or microsegmentation policy could still permit the connection.
The team successfully removed a configuration.
That doesn’t necessarily mean it removed the access.
This distinction is critical because an organization can believe it has eliminated an exposure while the communication path an attacker needs remains available.
Poor policy quality doesn’t simply increase attack surface. It can undermine the effectiveness of remediation itself.
Effective Access is the Outcome That Matters
This is why security teams need to think beyond individual firewall configurations and understand effective access.
A rule tells you what that particular configuration permits. It does not necessarily tell you whether two assets can actually communicate across the complete environment.
Modern network access can depend on the interaction between firewall policies, rule ordering, network objects, routing, cloud controls, microsegmentation policies and multiple enforcement points from different vendors.
Security teams therefore need to answer a more consequential question than “Did we remove the rule?”
They need to know:
Can the unwanted communication still occur?
That shifts remediation from configuration management to security outcome.
A remediation isn’t successful because a firewall rule was deleted. It’s successful when the unwanted access no longer exists.
That sounds like a small distinction. In complex enterprise networks, it is anything but.
AI Compresses the Time Defenders Have to Get This Right
None of these problems were created by AI. Unused rules, missing ownership, and redundant policies are not new.
What’s changing is the threat model around them.
AI is reducing the time and expertise required to discover vulnerabilities, understand systems and develop exploitation techniques. Tasks that once required significant manual effort can increasingly be accelerated or automated.
That compresses the time defenders have between vulnerability discovery and potential exploitation.
In that environment, two forms of accumulated network debt become more consequential.
The first is excess access. If attackers compromise an asset, unnecessary connectivity potentially gives them more places to go than the business requires.
The second is policy complexity. When defenders need to respond quickly, they may have to untangle years of rules and policy interactions to determine what is actually allowing the communication and whether a proposed change will truly eliminate it.
Faster exploitation makes both problems harder to tolerate.
The answer isn’t simply to remediate faster. It’s to enter that race with less unnecessary access to remediate in the first place.
Apply Least Privilege to the Network
The security industry already understands this principle when it comes to identity.
Organizations have spent years asking what applications, systems and data a user actually needs to access. Privileges beyond those requirements create unnecessary risk.
The same discipline needs to apply to network communication.
Every application and workload requires some connectivity to operate. The objective isn’t to eliminate access. It is to make actual access reflect what the business requires and remove what it doesn’t.
Operationally, that means security teams should be able to answer:
- What access actually exists?
- Why does it exist?
- Is it still required?
- Which policies and enforcement points provide it?
- What will happen if we remove or modify it?
- After remediation, can we verify that the unwanted access is truly gone?
This isn’t about achieving a perfectly tidy firewall rulebase. It’s about right-sizing network access.
The fewer unnecessary paths that exist, the fewer opportunities attackers have to reach vulnerable systems or expand their blast radius after compromise.
That’s the value of microsegmentation. But still just as important? Continuous policy control.
Why NSPM Matters More than Ever
Cybersecurity has spent the last decade responding to new problems with new security categories.
Sometimes that’s exactly what’s required.
But a changing threat model can also make existing security fundamentals strategically important again.
Network Security Policy Management was built to help organizations understand and control effective access across complex environments. That includes identifying unused and overly permissive access, finding redundant or overlapping policies, establishing ownership and business justification, analyzing policy usage, modeling changes, and safely removing access that is no longer required.
Critically, it also means understanding policies as part of a larger access model rather than treating individual rules in isolation.
These capabilities aren’t suddenly novel because of AI.
Their importance has changed because the threat environment has changed.
When attackers can identify and exploit weaknesses faster, organizations have less room for access they don’t need, don’t understand or can’t confidently remove.
The Goal Isn’t Cleaner Policies. It’s Less Unnecessary Access.
New security technologies will continue to emerge, and organizations will continue investing in them.
But those controls operate on top of networks shaped by years of infrastructure changes, application migrations, exceptions, acquisitions and business decisions.
That history has consequences.
Access accumulates. Context disappears. Complexity grows.
Eventually, security teams can reach a point where they don’t fully understand what can communicate, why that communication is allowed or whether a remediation actually eliminated it.
AI didn’t create that problem. It is making the cost of carrying it harder to ignore.
The path forward is grounded in fundamentals:
Know what access exists.
Know why it exists.
Know whether it’s necessary.
Know what actually provides it.
Remove what isn’t needed.
Verify that it’s truly gone.
NSPM doesn’t need to be reinvented for the AI era. The changing threat environment is reminding us why these capabilities mattered in the first place.
Turn Policy Complexity Into Policy Control
FireMon helps security teams move beyond managing individual rules to understand and control effective access across on-prem networks, cloud environments, and microsegmentation technologies.
With continuous policy analysis, path analysis, rule optimization, change modeling and policy governance, teams can identify unnecessary connectivity, reduce unintended access paths, and instill greater confidence that firewall policy is working as intended.
Because the objective isn’t simply a cleaner rulebase.
It’s less unnecessary access.
Policy is Power.