Offer a fixed-scope emergency response package covering exposure validation, configuration backup, supported hotfix deployment, log and artifact collection, compromise assessment, and post-patch verification. When evidence or uncertainty warrants it, deliver an escalation package for appliance rebuilding, directory credential rotation, session invalidation, and validation of domain-controller activity. Start as an expert-led managed service, then productize repeatable collection scripts, checklists, evidence bundles, and response retainers for additional edge-security appliances.

Repeated exploitation waves against the same appliance family show that patch-only responses are insufficient and that attackers can operationalize public techniques quickly. The absence or delay of complete vendor indicators creates immediate demand for an independent, repeatable containment workflow.