Firepower

Firepower is Cisco's next-generation firewall (NGFW) product line, encompassing the Firepower Threat Defence (FTD) software platform and associated hardware appliances. Firepower products are widely deployed in enterprise, service provider, and government environments as perimeter and internal network security controls. The FIRESTARTER implant, documented in prior Lowdown cyber-threats-and-defences events (see event ID 2911), is a persistent threat associated with Cisco Firepower appliances — representing the class of perimeter-device compromise threats that also underpins the May 2026 PAN-OS exploits.

Firepower was developed through Cisco's 2013 acquisition of Sourcefire, the company behind the Snort intrusion detection system and FireSIGHT network visibility platform. The integration of Sourcefire's technology gave Cisco a competitive threat-detection layer within the firewall itself. Firepower Management Centre (FMC) is the centralised management console for Firepower deployments.

The relevance of Firepower in the U#3 cyber-threats context is as a comparator and precedent: the pattern of state actors targeting firewall operating systems (PAN-OS via CL-STA-1132, Cisco Firepower via FIRESTARTER) underscores that network perimeter devices are a primary nation-state attack surface globally, regardless of vendor. Network defenders managing mixed firewall estates must treat both product lines as high-priority patching targets.