The Most Dangerous Device in Your Building Isn't On Your Network.

SASE just crossed into an 18 billion dollar market this year, growing 23 percent a year through 2030. Nearly every enterprise I talk to has standardized on a SASE platform or is on the way there. The category won. Good.

Here is the part almost nobody is saying out loud.

Gartner's own definition of SASE promises secure access regardless of the user's location, the device used, or where the application lives. Read that middle part again. Regardless of the device used. And yet the one class of device growing fastest, the SIM-enabled cellular device, is the exact place that promise quietly breaks.

Look at where 5G and cellular SASE actually shows up in this year's analysis. Not in the middle of the quadrant. It shows up as an honorable mention. A footnote to the main event. That is not a knock on anyone. It tells you something about the market itself. The whole SASE category was built around traffic that rides your network. A SIM device does not ride your network. It talks to a cell tower and reaches the internet over a carrier's radio, completely around your firewall, your SD-WAN, your endpoint tools, and yes, your SASE. To your security team, that device is a rumor.

That is the cellular blind spot. And the edge has quietly moved into it.

THE EDGE IS NOT YOUR BRANCH ANYMORE

For fifteen years the edge meant a branch office. A router in a closet, a link back to headquarters, a stack of controls the traffic passed through on its way out. We got very good at securing that.

Then the edge kept walking. It walked out to the parking lot camera. The lottery kiosk. The payment terminal on the forecourt. The fixed wireless router keeping a store online when the fiber goes down. The clinical device in the exam room. The sensor on the plant floor. Most of those connect on their own radio, live outside the building, and almost never get patched. They are the softest target you own, and they are the one part of your estate your enterprise stack was never in the path of.

That is not a hardware problem you can buy your way out of by swapping boxes. It is a visibility problem at the connectivity layer.

THE BLIND SPOT IS NOT THEORETICAL ANYMORE

Over the weekend, attackers hit operational technology at more than thirty water utilities across Minnesota and knocked at least one plant offline. Investigators are still working attribution, so I am not going to put a name on it. The lesson does not need one.

Those were not laptops. They were the kind of quiet, connected, rarely watched devices that sit under every distributed operation in the country. The attack did not clear a high bar. It cleared a low one, because so much of this gear runs where traditional security simply cannot see it.

If you run stores, clinics, branches, fleets, or plants, that is not a utilities story; it is a preview. Cellular and OT visibility stopped being an engineering nice to have and became a board level question. That is not a scare tactic. It is a plain risk that now has headlines, and in Europe it already has a reporting clock attached to it. (See my recent CRA article: 'You Have 24 Hours to Report a Device You Can't See'.)

WHERE PALO ALTO AND AERIS COME IN

This is the gap Aeris and Palo Alto Networks built 5G SASE for together, and it is the part that finally answers the glaring question traditional SASE doesn't.

Because Aeris sits in the connectivity layer, Aeris IoT Watchtower sees the cellular devices your enterprise stack cannot. What they are, where they are talking, and when something looks wrong, at the network level, across 32 mobile operators and more than 203 countries. That is the awareness piece.

Palo Alto Networks Prisma SASE 5G turns that awareness into enforcement. Wireless traffic from a SIM device gets routed through Prisma SASE for the same deep inspection and policy your corporate traffic already gets, with zero trust built on the device's own SIM identity. No agent on the device. Nothing to install on a camera or a meter that was never designed to run a security client. Watchtower handles the network layer, Prisma applies the advanced policy on top, and the device that used to run around every control you own is finally sitting inside them.

Retail gets its point of sale and its fixed wireless failover under the same policy as the corporate network. Healthcare gets connected clinical devices watched without anyone touching them. Finance and manufacturing get third party wireless gateways secured without ripping out hardware. Same problem, one approach, applied right at the SIM.

WHY THE CHANNEL SHOULD BE PAYING ATTENTION

If you sell security, connectivity, or managed services, the map just got bigger. Your customers already bought SASE for their people and their offices. Almost none of them have extended it to the cellular devices multiplying across their sites. That is not a gap to apologize for. It is the next conversation, and it is one very few of your competitors are even having yet.

This is exactly the kind of expanding landscape that Black Hat exists to surface. Everyone in Las Vegas this week is talking about AI speeding up attacks against embedded and IoT firmware. Fewer are talking about the fact that a lot of that firmware phones home on a radio nobody is watching. Those two ideas belong in the same sentence.

Aeris is on the ground at Black Hat this week. Next week I will be at the Palo Alto Networks Partner Summit, digging into exactly how our two teams are closing this gap together and what it opens up for partners. If you are at either one, find me or someone from my team, (Brandon Ilkiw or Charlie Todd) who are onsite this week. This is the conversation we want to be having.

THE BOTTOM LINE

SASE grew into an 18 billion dollar market by securing the edge as we knew it. The edge did not wait around. It moved to the SIM-enabled device sitting in your store, your clinic, your branch, and your plant, and for most enterprises that device is still invisible.

You cannot secure what you cannot see. The good news is you no longer have to choose between the SASE you already trust and the cellular edge you have been missing. That is the whole point of Aeris and Palo Alto Networks together.

The edge moved. The real question is whether your security moved with it.

Walk into almost any chain store, clinic, bank branch, or distribution center in America and start counting the things quietly talking to the internet over a cellular signal. The backup modem in the back office. The LTE camera over the register. The card reader at the counter. The digital sign in the window. The sensor watching the walk-in freezer. The handheld the stock crew carries around. Now ask whoever runs that company's security which of those devices their firewall can actually see, and most of the time the honest answer is none of them.

That single fact is quietly rewriting what fixed wireless access means for the enterprise, and it is the reason a slice of the market everyone used to file under "backup internet" has suddenly landed at the intersection of connectivity, compliance, and cyber risk. I have spent the last few weeks in rooms full of MSPs, MSSPs, and TSD partners across the US and Canada arguing about exactly this, and I want to lay out honestly where the shift is real, where it is overhyped, and whether the combined MergeWiFi and Aeris solution people keep asking me about is the genuine article or just another box with a nicer brochure.

THE MARKET IS NOT MOVING SUBTLY

Fixed wireless used to be the thing you deployed when fiber had not shown up yet, and that framing is dead. Analyst forecasts put the global fixed wireless access market at roughly $43 billion in 2026, up from about $37 billion the year before, growing at a mid-teens compound rate that carries it past $84 billion early next decade. The Ericsson Mobility Report has global connections climbing from roughly 185 million to around 350 million by 2031, most of it now running on 5G.

And while analyst house slices the numbers differently, so treat them as directional, but the direction is not in dispute. What is driving it is not the technology; it is the math of opening and running distributed sites. A fiber install still runs 6 to 8 weeks in a lot of markets, sometimes longer, and construction does not wait, so every day a finished store sits dark is rent and payroll burning with no revenue coming in. Fixed wireless flips that. You ship a device, plug it in, power it on, and you are live in a day or two with no trench, no permit, and no truck roll. So, the first honest finding is simple. This is not hype. The center of gravity for distributed connectivity really is sliding toward cellular.

DOES FIXED WIRELESS REPLACE SD-WAN? YES AND NO

This is where the puff pieces overreach, so let me be straight about it. Fixed wireless is not about to rip out SD-WAN at a bandwidth-hungry headquarters or a big campus, and for high-throughput, latency-sensitive, data-dense environments the wired stack still wins and will for a long time. But at the distributed edge, meaning the 50 or 500 or 5,000 small sites where most of the device sprawl actually lives, the story flips. Broadband fragments across local providers with no real service guarantee. MPLS is expensive and slow to change. SD-WAN was built to make public broadband good enough, and it still needs a firewall bolted on beside it, and here is the part everyone glosses over, it cannot see cellular traffic at all.

Your SD-WAN box, your SIEM, your entire enterprise security stack, all of it watches the LAN. Every device that reaches the internet over a SIM instead of the router simply is not in the picture. It is out of band and invisible. So, the accurate verdict is that fixed wireless is not a wholesale SD-WAN killer, it is becoming the primary or co-primary link for the distributed edge, and in the process it drags a security problem into the light that the legacy stack was never built to solve.

THE ROUTER AT LEAST SHOWED UP ON THE MAP

It is tempting to wave that off as low value. Who is really coming after a freezer sensor. Plenty of people, as it turns out, because the device was never the prize, the foothold is.

Consider what happened on July 13, when 19 government agencies across 13 countries, led by the NSA, CISA, and the FBI, issued a joint advisory on Russia's FSB Center 16, the crew tracked for more than a decade as Berserk Bear, Energetic Bear, and Dragonfly. The method is the part that should stop you. They did not drop a brilliant zero-day. They scanned the internet for routers still answering SNMP with default or weak community strings, pulled the device configurations straight off the boxes over TFTP, and walked away with network maps, credentials, and VPN details. They did not break in. They logged in, to a device nobody was watching.

And here is the uncomfortable follow-on for this conversation. That router, as neglected as it was, at least lives in your world. It has an IP address. It shows up in a scan eventually. The cellular version of that same device shows up nowhere, because its traffic never touches your network, so there is no scan, no proxy, and no log that ever sees it. Layer on top of that the commodity threat that is already industrialized, with botnets built on compromised routers and cameras throwing denial-of-service attacks measured in tens of terabits per second, and the picture is clear. When something does slip in through the cellular side, nobody notices for a long time, with dwell times for cellular-connected breaches clustering around 200 days, for the simple reason that there is no tool in the traditional stack watching that path. You cannot alert on traffic you cannot see. That is the cellular blind spot in one sentence. Your perimeter security stops at the LAN, and a growing share of your devices do not live on the LAN anymore.

THE COMPLIANCE CLOCK IS ALREADY RUNNING

If the risk argument does not move a buyer, the compliance calendar will, and that is the strongest reason to act now.

In the US, PCI DSS 4.0 became fully mandatory on March 31, 2025, and it landed harder than anything before it, with something like 80 to 90% of the requirements new, segmentation that now has to be tested every six months rather than assumed, and penetration tests that have to actively try to defeat it. Cleanly separating cellular point-of-sale and IoT off the payment environment has become one of the cheapest ways to shrink audit scope, and most operators cannot answer on the spot how their cellular devices are segmented today. That silence is the opening.

In Europe the Cyber Resilience Act is already law, and it phases in on two dates. The one everyone quotes is December 11, 2027, when the full rulebook applies, meaning secure by default, security updates across the whole support life of the product, a software bill of materials, and CE marking. The date that actually matters more is September 11, 2026, when the reporting obligation goes live, because from that day, if a connected product you make or ship into Europe has a vulnerability that is being actively exploited, you have 24 hours to file an early warning with EU authorities, 72 hours for a fuller report, and 14 days for the final one. 24 hours. You cannot cram for that date, because you cannot report an incident you never detected. The CRA does not treat every device the same either, it pushes higher-risk gear like routers, modems, cameras, and alarms into tougher important and critical tiers, and the manufacturer stays on the hook for the entire support life of the product. It reaches well past Europe too, since a manufacturer in California or Toronto is bound the moment its product hits EU customers through normal commercial channels. Miss the essential requirements and the penalty runs to €15 million or 2.5% of global revenue, whichever is higher, and regulators can pull the product from the EU market entirely, which for a lot of vendors stings worse than the fine. Compliance deadlines are the one thing that reliably turns a security nice-to-have into a funded purchase, and there are two hard ones sitting right in front of us.

THE OLD WAY KEEPS GETTING MORE EXPENSIVE

Here is the kicker that is pushing partners to look for something new. The incumbent hardware path is not just leaving the security gap open; it is getting more expensive while doing it. Distributor notices this summer put Cradlepoint's price increases at roughly 10 to 15%, effective July 1, 2026, across its enterprise router lines, which is worth confirming against your own quotes but points clearly in one direction. And that is before you have solved a single thing, because with the traditional approach you are still typically buying a single or dual-carrier device, then licensing a firewall or security layer separately, then standing up management on top of both. 3 line items, 3 vendors, 3 renewals, and your cellular devices still sit outside whatever security you bolted on. Call it the stack tax. You pay more every year for an architecture that structurally cannot see the fastest growing part of your fleet.

WHAT THE MERGEWIFI AND AERIS BUNDLE ACTUALLY IS

Strip away the marketing and it is two layers sold as one motion. The connectivity layer is the MergeWiFi hardware, with the 5G MAX as the enterprise workhorse, an IQMC-class gateway running 5G alongside LTE-Advanced and carrier-aggregating up to multi-gigabit peaks. What matters operationally is not the spec sheet, it is the behavior. All 3 major US carriers live inside a single device, it ships preconfigured and truly plug and play no matter where it lands, it constantly hunts for the strongest available signal, and it fails over to a second or third carrier within seconds when the first one drops. That is real multi-carrier resilience, a genuinely different network and not just a different tower on the same one that just failed, and for a site where an outage costs real money by the minute that distinction is the whole point. The security layer is Aeris IoT Watchtower, and this is the part competitors genuinely cannot quote. Watchtower is agentless, meaning nothing gets installed on the device, which is the only approach that works for headless gear like cameras, terminals, and sensors that cannot run software. It sits in the connectivity layer and runs in line with the normal cellular data path at the SIM level, in two halves, with Watchtower Awareness giving you real-time visibility into every device and where its traffic is going, and Watchtower Enforcement applying zero-trust policy, anomaly detection, and blocking of malicious destinations right there in the mobile core, and it generates the audit-ready reporting that a 24-hour obligation makes survivable instead of theoretical. Put the two together and you get one device, one bill, and one pane of glass at a bundle price of $299 per site each month, all 3 carriers, the gateway, and the security platform included. The claim worth sitting with is that this often lands below what companies already pay for a single or dual-carrier solution that comes with no security at all.

THE PART THAT REFRAMES THE CATEGORY

Here is where I think it crosses from nice bundle into something that reframes the category. Most solutions solve one slice. A Cradlepoint solves connectivity and leaves you to bolt on security. A firewall vendor secures the LAN and never touches cellular. An SD-WAN box optimizes wired transport and stays blind to the SIM. Every one of them hands you a piece. This combines the pieces and closes the one gap none of them can reach, because it connects and protects what is inside the perimeter and then pulls every SIM-enabled device that used to live outside the perimeter, the cameras, the terminals, the sensors, the backup modems, onto the same monitored, policy-controlled network. For the first time you can see and secure all of it across 3 carrier networks from a single platform. The devices that were invisible become the devices you are watching, and that is not a feature, that is the blind spot disappearing.

THE HONEST SCORECARD

Because this should not read like a sales sheet, here is what a buyer ought to press on. Cellular data economics still deserve scrutiny at very high-bandwidth sites, since unlimited always has fine print. Multi-carrier failover is resilience, not link bonding, so latency-critical or throughput-heavy workloads still need a hard look. And any agentless, network-layer security model should be tested against your own threat model rather than taken on faith. No product hands you a compliance certificate either, the CRA obligations sit with manufacturers, importers, and distributors, and you still own your program. Ask the hard questions. But weigh all of that against what it replaces, which is 3 vendors, a widening security gap, a rising hardware bill, and a compliance clock that is already ticking, and for distributed, device-heavy, multi-site operations like retail, quick service, healthcare, banking, logistics, and the public sector, the convergence story holds up under scrutiny in a way most revolutionary pitches never do. For MSPs, MSSPs, and TSDs the takeaway is even simpler. This is a faster sales cycle wrapped around a differentiator your competitors literally cannot put on a quote, cellular-layer security, with recurring and sticky economics underneath it.

THE BOTTOM LINE

The FSB did not need a masterpiece, they needed one device nobody was watching, and most enterprises have hundreds of those humming along on cellular right now. The market is moving to the cellular edge whether the industry is ready or not, and the only real question left is who is watching that edge when it does. So, it is worth asking out loud, what is living on your cellular network right now that your firewall has never seen, because that is the conversation worth having this quarter.

If your cellular fleet is a blind spot, that is exactly the gap MergeWiFi and Aeris IoT Watchtower were built to close. Happy to compare notes. See how it works: https://www.aeris.com/partner-ecosystem/

Here is the sentence that should get your attention.

Starting September 11, 2026, if a connected product you make or ship into Europe has a vulnerability that is actively being exploited, you have 24 hours to file an early warning with EU authorities. A fuller report is due in 72 hours. A final report inside 14 days.

Twenty-four hours.

Now ask yourself a simple question. If one of your cellular-connected devices got popped tomorrow, a camera, a kiosk, a payment terminal, an FWA router in a branch, would you even know? Most companies would not. And that is the real story of the EU's Cyber Resilience Act.

WHAT THE CRA ACTUALLY IS, IN PLAIN ENGLISH

The Cyber Resilience Act is Europe's law for the security of "products with digital elements." That phrase is broad on purpose. If it is hardware or software and it connects to a network or another device, it is in scope. Sensors, gateways, routers, cameras, medical devices, industrial gear, the firmware inside them, and the cloud services behind them.

It phases in over two dates that matter.

September 11, 2026. Vulnerability and incident reporting goes live. Manufacturers must report actively exploited vulnerabilities and severe incidents on that 24 / 72 / 14-day timeline.

December 11, 2027. The full rulebook applies. Secure by default. Security updates across the product's whole support period. A software bill of materials. CE marking and conformity assessment.

The 2027 date gets the headlines. The 2026 date is the one you cannot cram for, because you cannot report an incident you never detected.

WHY CELLULAR IOT IS THE HARD PART

Here is where most security programs have a hole they do not talk about.

Your firewall, your SASE, your endpoint tools, your SD-WAN, all of it watches traffic that rides your network. But a SIM-enabled device does not ride your network. It talks to a cell tower. It reaches the internet over a carrier's radio, completely around your stack. To your security team, that device is a rumor.

That is the cellular blind spot. And the CRA just turned it into a compliance problem with a deadline.

It gets sharper. The CRA does not treat every device the same. It puts higher-risk gear into "important" and "critical" tiers with tougher assessment. Routers and modems built to connect to the internet sit in that important tier. So do security cameras, alarms, and network interfaces. A lot of the cellular hardware sitting in retail sites, clinics, and warehouses is not in the easy category. It is in the one that carries a heavier burden, and the manufacturer stays responsible for the whole support life of the product, not just the day it shipped.

THE INDUSTRIES THAT SHOULD NOT SLEEP ON THIS

If you deploy SIM-enabled devices at scale, this is your fight.

Retail and multi-site operators running point-of-sale, digital signage, and fixed wireless failover across hundreds of locations. Healthcare, where connected clinical devices and clinic connectivity carry both patient safety and regulatory weight. Logistics and fleet, where telematics units live in the field for years. Utilities and energy, with smart meters and grid sensors. Manufacturing and industrial. Connected vehicles. Physical security, where the CRA literally names cameras and alarms.

The common thread is simple. These are devices that connect on their own radio, live outside the building, and rarely get patched. That is exactly the profile attackers love, and exactly what the CRA now expects you to watch.

THIS IS NOT JUST EUROPE'S PROBLEM

A lot of North American companies read "EU regulation" and turn the page. Do not.

The CRA reaches beyond EU borders. A manufacturer in California, Toronto, or anywhere else is bound by the same rules the moment its product reaches EU customers through normal commercial channels. Ship connected products into Europe and you are in scope. Run a multinational retail or logistics footprint with SIM devices across EU sites and you are in scope. Location of your headquarters does not get you out of it.

WHAT NON-COMPLIANCE COSTS

The penalties are structured in three tiers, and they are not symbolic.

Up to 15 million euros or 2.5% of global annual revenue, whichever is higher, for missing the essential security requirements or the core manufacturer duties. Up to 10 million euros or 2% for other obligations. Up to 5 million euros or 1% for feeding regulators bad or misleading information.

And regulators can pull a non-compliant product from the EU market. For a lot of vendors, losing market access hurts worse than the fine.

WHERE TO ACTUALLY START

You cannot report what you cannot see, so visibility is step one. Before December 2027 asks you for SBOMs and conformity paperwork, September 2026 asks you a blunter question. Can you detect a compromised cellular device and act on it inside a day?

This is the gap we built Aeris IoT Watchtower to close. Because Aeris sits in the connectivity layer, Watchtower sees the cellular devices your enterprise stack cannot: what they are doing, where they are talking, and when something looks wrong. That is the detection and awareness that makes a 24-hour reporting obligation survivable instead of theoretical.

Paired with Palo Alto Networks Prisma SASE 5G, that visibility turns into enforcement. You can spot the anomaly on the cellular device and apply security policy to the traffic that used to run around your controls entirely. Agentless, at the network layer, without touching the device.

To be clear, no product hands you a compliance certificate. The CRA obligations sit with manufacturers, importers, and distributors, and you own your program. But the piece almost everyone is missing is the same one they have always missed. The devices that phone home on cellular. The regulation just put a deadline on it.

THE BOTTOM LINE

The CRA did not create the cellular blind spot. It just made it expensive.

September 11 is not far off. If your connected products or your operations touch Europe, the question is not whether you have a policy. It is whether you can see the device long enough to know you have a problem.

Can you?

Here's the part of the FSB router story that should keep you up at night, and it isn't the part everyone's talking about.

On July 13, nineteen government agencies across thirteen countries, led by NSA, CISA and the FBI, put out a joint advisory (AA26-194A) about Russia's FSB Center 16. This is the same crew tracked over the years as Berserk Bear, Energetic Bear and Dragonfly. They've been quietly compromising networking gear inside critical infrastructure, and they've been doing it for more than a decade.

The method is what gets me. They didn't drop some genius zero-day. They scanned the internet for routers still answering SNMP with default or weak community strings, then used that access to copy the device configuration straight off the box and haul it back over TFTP. Network maps. Credentials. VPN details. All of it.

They didn't break in. They logged in. To a device nobody was watching.

So now every security team on the planet is going to go audit their routers. Good. They should. But I want to push on something, because if you stop at "patch the routers," you've missed the bigger lesson.

The router at least shows up on the map

Think about what actually happened. An asset that was sitting in a blind spot got owned because no one had eyes on it. The fix everyone's rushing toward is basically "go look at the thing you weren't looking at."

Fair enough. But that router, as neglected as it was, still lives in your world. It has an IP. It shows up in a scan eventually. Somebody, somewhere, could have caught it.

Now picture the version of this problem that doesn't show up in any scan at all. The cellular one.

Walk into a retail chain, a bank branch, a clinic, a logistics yard. Count the things running over 4G and 5G. The FWA router keeping the store online. The security cameras. The self-checkout kiosk. The pallet of sensors nobody's touched since install day. The tablet the field tech carries. Every one of those is pushing traffic straight out through a carrier network and onto the internet.

That traffic never touches your corporate network. It never hits your cloud proxy. Which means your SASE stack, the thing you spent real money on to inspect everything and enforce zero trust, sees exactly none of it.

That's not a bug in your SASE deployment. It's the architecture. SASE was built for a wired world, for users and sites and cloud apps. Cellular devices route around all of it by design. And the classic answer, "just put an agent on the endpoint," falls apart the second you're dealing with a headless sensor that can't run software, or a BYOD user who disabled the agent the day it was installed.

So you end up with a growing fleet of business-critical devices operating out of band. No visibility. No policy. No enforcement. If the FSB story teaches us anything, it's that attackers love exactly this kind of terrain.

Why September matters

If you sell into Europe, or your customers do, there's a clock on this too. The EU's Cyber Resilience Act starts its mandatory incident and vulnerability reporting obligations on September 11, 2026. You can't report on what you can't see. A cellular device you have no visibility into isn't just a security gap, it's a compliance one. That's worth raising with customers now, not in the fall.

You don't fix a network problem with a better agent

Here's where I'll take a side. The endpoint approach to cellular is a dead end. You cannot agent your way out of a fleet you don't physically own and can't install software on. Stop trying.

The answer is to secure the traffic at the network, before it ever reaches the device. That's the whole idea behind what we've built with Palo Alto Networks.

It works like this. Aeris routes cellular traffic through the mobile core and hands it to Palo Alto's Prisma SASE 5G for full Layer 7 inspection. Policy gets applied to the SIM identity itself, using the IMSI and IMEI, so you get device-level enforcement without a single agent on a single device. Aeris IoT Watchtower provides the agentless visibility and control across the whole device lifecycle, and Aeris brings the global reach, close to 30 tier-one mobile operators worldwide.

The point I'd stress to any CISO: this is not rip and replace. You already bought SASE. This extends the policies you're already running to the one place they couldn't reach. Same zero trust that protects your laptops and offices, now covering the cellular edge too. One of the reasons Palo Alto is the right dance partner here is that they're a Leader on Gartner's SASE Magic Quadrant and they don't run a captive cellular stack, so the fit is clean.

The channel opportunity hiding in plain sight

If you're an MSP, MSSP or systems integrator, read the FSB advisory as a sales map.

Your customers who run SASE have this gap right now, whether they know it or not. Your customers running cellular routers and gateways have it too. And most of them have no idea, because the tools they trust are telling them everything's green while an entire class of devices sits outside the frame.

That's your opening. Not a fear pitch, a real one. Go ask a customer a simple question: "Can your SASE platform see the traffic from your cellular devices?" Watch them realize they don't know. Then you're not selling a box, you're selling visibility, compliance readiness and peace of mind, wrapped in a managed service you can actually put margin on.

The FSB didn't need a masterpiece to get in. They needed one device nobody was watching. Most enterprises have hundreds of those, humming along on cellular, completely invisible to the security stack they're paying for.

The router hygiene advisory is a wake-up call. The smart move is to answer the bigger question it raises: what else can't you see?

If you want to see how we close the cellular blind spot with Palo Alto, start here: https://www.aeris.com/wireless-sase/

Robert Holley is Head of Channel and New Routes to Market at Aeris.

This week gave us two stories that no one in the security industry is connecting. They should be.

Story One. Russell Cellular, one of the largest Verizon authorized retailers in the country, (750+ locations, more than 2,000 employees), lost data on 6.3 million customers and employees. The threat actor pulled 61 gigabytes off their network and listed it for sale on a hacker forum for $1,200. Customer names, phone numbers, account numbers, device identifiers, contract details, employee credentials, employee access roles. Verizon notified individuals on April 10th. Class action investigations opened the following week.

Story Two. Cato Networks announced today that they are unbundling SASE. You can now buy AI security, SD-WAN, SSE, or Universal ZTNA as standalone modules and stack them over time. Trade press is calling it 'redrawing the SASE adoption map.' It is a smart commercial move. It also tells you exactly where the SASE category thinks the fightin is right now: how to package what's already in the box.

Here is the problem. The box has a hole in it.

The breach you should be reading twice.

Read the Russell Cellular incident again with a channel lens, because this is what every multi-site retailer in American actually looks like.

Hundreds of locations. Cellular connectivity at every site, primary in some, backup in others, increasingly both. POS systems, surveillance cameras, environmental sensors, digital signage, building management. Each location an entry point. Each cellular modem a path that bypasses the corporate firewall, the SASE edge, the SSE inspection point, the EDR agent, the entire stack the CISO has been buying for ten years.

We don't yet have the full forensics on Russell Cellular. The point isn't whether cellular was the entry vector in this specific case. The point is that the 6.3 million records walked out of a company built around cellular connectivity, and nobody in the broader security conversation is asking the obvious question: when the breach hits the next multi-site enterprise, and it will, what part of the security stack was supposed to see the cellular traffic? In most enterprises today, the honest answer is: none of it.

That's the blind spot.

SASE is fragmenting on the wrong axis.

When Cato announces modular adoption, what they are really saying is that the SASE category has matured to the point where customers want to buy components, no platforms. That is normal. Every enterprise software category fragments eventually. SD-WAN did. EDR did. Identity did.

But fragmentation only matters if it happens along the right axis.

The axis SASE vendors are competing on right now is delivery model; full stack vs. modules, single vendor vs. best-of-breed, all-in-one vs. start-where-you-are. That is a procurement conversation. It is not a security conversation.

The axis the threat is actually moving on is which traffic gets inspected at all. And on that axis, every full-stack SASE platform on the market (Cato, Zscaler, Palo Alto, Versa, Netskope, Fortinet) has the same architectural blind spot. The agent is on the laptop. The policy is at the edge. The inspection happens when the traffic crosses into the enterprise. None of that reaches the device sitting at a retail location, talking to a private APN over LTE, sending data to a backend the SOC has never seen.

You cannot fix that gap by selling SSE in a smaller box.

And by the way, this is already being weaponized

While the SASE industry sorts out packaging, US agencies issued a joint advisory on Iranian-affiliated nation-state actors actively exploiting internet-facing Rockwell Automation and Allen Bradley PLCs. The campaign has been running since March. The detail buried in the threat reporting that almost no one is highlighting: a disproportionate share of these compromised devices sit on cellular carrier ASNs. Field-deployed devices. Cellular modems. Critical infrastructure.

This is the blind spot, weaponized in production. By a state actor. Today.

If you are running a national retail footprint, a manufacturing operation, a logistics fleet, an energy utility, a healthcare network, any business where devices live at the edge and connect over cellular, your threat model is no longer theoretical. The doorway is already being walked through.

The fix isn't a smaller SASE. It's a longer SASE.

Closing the cellular blind spot is not a packaging exercise. It is an architecture exercise. Three layers have to work together.

Connectivity at every site. You need FWA hardware at the edge that doesn't care which carrier is best on which day. Single-carrier is FWA is a single point of failure dressed up as a feature. Multi-carrier devices, with intelligent failover and build-in security at the device level, are now table stakes for distributed enterprise. MergeWiFi is the cleanest play I've seen in this space; purpose-build for multi-site enterprise, multi-carrier from day one, and designed to be deployed by a field tech in minutes rather than configured by a network engineer over a week.

Intelligence at the SIM. This is the layer most security architects have never though about, because for two decades the cellular network has been treated as a black box owned by carriers. That model is over. With things like SGP.32, virtual SIM technology and cellular IoT management platforms, every connected device can be authenticated at the SIM, assigned policy based on identity rather than IP, monitored for behavioral anomalies, and quarantined if it goes off-pattern. This is what Aeris IoT Watchtower does. It treats cellular like the rest of the enterprise network; visible, governed, inspected.

Security at the cellular layer. This is the integration the industry is just starting to wake up to. Aeris and Palo Alto Networks announced earlier this year a Prisma SASE 5G integration that extends Palo Alto's full SASE stack, (Zero Trust, threat prevention, policy enforcement) down to the SIM. Agentless. Global. Inline. The traffic gets inspected before it touches the enterprise network, not after.

Stack those three layers and you have some the SASE-only vendors cannot deliver and the cellular-only vendors cannot deliver; a security architecture that travels with the device, regardless of carrier, regardless of location, regardless of whether it ever talks to a 'corporate' network.

The next twelve months

The Russell Cellular breach is going to be a study cited in board meetings for the next year. The Iranian APT campaign on cellular-connected PLCs is going to drive at least one major US compliance update. And the SASE industry is going to spend the next several quarters arguing about modular vs. best of breed, AI security vs. ZTNA.

Meanwhile the cellular layer will keep being the path of least resistance. Until enterprises stop treating cellular as someone else's problem.

If your SASE story stops at the laptop, your enterprise has a cellular door it cannot see. That door is already being knocked on.

Robert Holley is Head of Channel & New Routes to Market at Aeris Communications. Aeris secures the cellular layer for distributed enterprise; IoT Watchtower for visibility and control, the Aeris IoTA platform for connectivity orchestration, and Prisma SASE 5G with Palo Alto Networks to extend SASE to the SIM. Operation Retail Connected is Aeris's go-to-market for multi-site enterprise retail. Channel partners interested in adding integrated FWA + cellular security to their line card can reach out directly.

I've been off LinkedIn for a week dealing with some personal matters.

I came back to this.

Security cameras turned into attack tools. AI-powered ransomware disabling 300+ EDR systems in a single campaign. One in three cellular connections on the planet carrying IoT traffic that your firewall, your SASE platform, and your endpoint tools have never seen, and never will.

We're four days from Channel Partners Events in Las Vegas. And the threat landscape just handed us the most important conversation we could walk onto that expo floor carrying.

Let's talk about what's actually happening.

Your Devices Are Being Turned Against You — Right Now

This week, Security Boulevard published something every channel professional needs to read.

Compromised security cameras and IoT/OT devices are now being weaponized against the organizations that deployed them.

Not taken offline. Not held for ransom, yet. Silently flipped. Running as attack infrastructure inside your own network, against your own people.

Ransomware attacks against OT systems surged 46% in 2025. In the majority of cases, the entry point was an IoT device. Not a misconfigured firewall. Not a phishing email. An IoT device.

Here's what makes this particularly brutal right now: the Qilin and Warlock ransomware groups are actively using vulnerable drivers to disable 300+ EDR tools before deploying their payloads. Your endpoint protection. Gone, before you ever know the attack started.

And the FunkSec group has now embedded generative AI directly into their malware; attack code that adapts in real time to the specific defenses it encounters.

Your EDR tool doesn't protect a device it can't reach. Your firewall doesn't inspect traffic it can't see. And your SASE platform secures the corporate network edge. But cellular IoT devices don't route through the corporate network. They route through the carrier network; direct, agentless, invisible to your entire security stack.

That's not a theoretical gap. That's 820,000 IoT attacks per day hitting devices that 88% of organizations confirmed they cannot fully protect with the tools they have.

This Isn't a Small Problem. It's 35% of All Connections.

A market report published April 8 that every channel professional should carry into their next enterprise conversation:

IoT SIM connections now represent more than 35% of all global cellular connections.

One in three cellular connections on the planet is an IoT device. Most of them are in enterprise environments. Most of them are operating outside traditional IT visibility. And thanks to everything I just described, most of them represent an active, unmonitored attack surface.

AI is now compressing the entire attack kill chain, reconnaissance to exfiltration, down to minutes. Not hours. Minutes.

Your team cannot respond to what they cannot see. And they cannot see what bypasses the stack entirely.

This is the cellular blind spot. And in 2026, it is the attack vector.

Hardware-Layer SASE Is Not the Answer

I want to be direct about something.

This week Ericsson and Cradlepoint announced the R2400; a new 5G router positioned with "integrated NetCloud SASE." They're pitching cellular WAN plus security as a bundled hardware solution.

Solid hardware. Wrong architecture.

When you build security at the device layer, you inherit every constraint that comes with it. A device per location. A hardware refresh cycle. Coverage that ends at the edge of whatever carrier that router is provisioned on. Security policy that's as portable as the box it runs on.

That's not enterprise-grade IoT security. That's point protection masquerading as a platform.

Enterprise IoT security, real enterprise IoT security, has to be built at the network layer, not the hardware layer. It has to travel with the SIM, not the device. It has to operate across every carrier, every region, every device type, regardless of form factor.

That's Aeris IoT Watchtower.

And it doesn't stand alone.

Aeris IoT Watchtower is built on top of IoTA; a single platform ecosystem spanning 32 MNOs across 203 countries. It integrates natively with Palo Alto Networks Prisma SASE 5G, delivering agentless Layer 7 security including DPI and DLP across that entire global footprint.

No hardware dependency. No device agent. Security enforced at the SIM and carrier layer where the traffic actually lives.

We've also built this alongside MergeWiFi, combining IoT Watchtower with secure, multi-carrier FWA for enterprise retail and distributed enterprise environments.

One ecosystem. 32 carriers. 203 countries. Two category-defining partners. That is not a bolt-on. That is an integrated platform.

MSPs: This Is Your Missing Module

The channel is moving to platform-based security. We all know it.

MSPs are abandoning point-tool assembly and moving toward platforms that bundle endpoint, identity, cloud, and managed detection into a single operational model. MDR and outsourced SOC are becoming table stakes. Platform-based is where recurring revenue lives.

But here's the gap in every one of those platforms: cellular IoT.

Not a single major MSP security stack today covers the cellular SIM layer. Not Fortinet. Not Zscaler. Not Cato. Not Versa. They're all competing for the same square footage of the enterprise security stack; the part that faces the internet and the LAN.

None of them see the cellular IoT traffic running right past all of it.

Aeris IoT Watchtower is the module that closes that gap. Drop it into any managed security platform. Deliver it as a managed service. Add visibility and control over every cellular IoT device in your customer's environment without touching their hardware, without deploying agents, without adding complexity.

If you're building a managed security practice in 2026, you cannot afford to leave 35% of your customer's connections unprotected.

We're in Las Vegas Next Week. Come Find Us.

We'll be at Channel Partners 2026, Booth #2644 with our partners at MergeWiFi. Come find us on the floor.

And if you want a real conversation, we're hosting an invitation-only evening event on Tuesday, April 14 from 6:30–8:30 PM at Sala inside the Venetian — with MergeWiFi and WanAware . The conversation will be real, the bar will be open, and the guest list is intentionally small.

Space is limited. To get on the list, send a DM to me, Jason Heina , John Atchison , Charlie Todd, or Marcus Schmidt from Aeris and we'll get you added.

The threat landscape didn't wait for me to get back.

It never does.