Key Takeaways:

• The FCC has restricted future approvals of foreign-produced consumer routers due to security concerns
• Existing routers still work and can be purchased, but the risk profile has changed
• Routers are now viewed as a real attack vector, not just infrastructure
• Businesses should begin planning replacements rather than waiting
• Apex recommends standardizing on more secure, U.S.-aligned vendors

Routers were never supposed to be the weak point.

But here we are.

Today, the FCC added foreign-produced consumer routers to its Covered List after a national security determination that these devices could introduce supply chain vulnerabilities and be used in cyberattacks. The concern is direct. These routers may enable disruption of infrastructure, espionage, or unauthorized access into networks.

This is not a recall. You can still use what you have. You can still buy most models currently on the market.

That’s not the story.

If regulators are saying this category of device is a risk, it changes how it should be treated inside your business. Routers sit at the edge of your network. Everything flows through them. If they are compromised, attackers can gain persistent access that is difficult to detect and bypass many traditional security controls.

Most companies have not been thinking about routers this way.

They should be now.

Waiting for a forced change later is the wrong approach. This is the kind of issue where being early is safer and ultimately less disruptive. A phased replacement strategy makes sense. Start with critical locations, older hardware, and environments handling sensitive data.

From our perspective, vendor choice matters more than it used to.

Our team at Apex Technology Services recommends prioritizing vendors with strong U.S. alignment, better visibility into their supply chains, and established security track records.

Cisco is the clearest long-term option. It is widely used in enterprise and government environments and is better positioned to meet evolving compliance expectations.

For cost-sensitive or SMB environments, Ubiquiti remains a practical option today and is widely deployed, but it should be evaluated with an understanding that future policy changes could impact this segment first.

Netgear and similar vendors are acceptable for now, especially for existing deployments, but we would avoid making long-term standardization decisions there until there is more clarity.

The goal is not panic. It is control.

Know what is in your environment. Understand the risk. Start planning upgrades on your terms, not when supply or policy forces your hand.

Because this is one of those shifts where the guidance is subtle, but the implication is not.

Routers are no longer just plumbing. They are part of your security posture.