Attackers don t have time to look at every asset in depth the number of which can run in the tens of thousands for a large enterprise. Attackers assess criticality before acting, in order to focus their efforts on targets that are likely to lead them closer to their objectives. The more information an attacker can gather about a piece of technology used, the more confidently they can plan a next phase of attack, so they can more confidently invade a network. Security appliances like VPNs and firewalls are proverbial keys to the kingdom.
Source: https://threatpost.com/6-questions-attackers-ask-exploit/162651/