Review SMA1000 access logs for unauthenticated requests to unusual Work Place paths, and investigate unexpected connections from the appliance to internal services. Rotate credentials for anything reachable through the appliance's trust context.