Before (and while) you patch: permit management only from a jump box / known admin ranges—never 0.0.0.0/0. Prefer a dedicated MGT network; if you must manage over a data plane interface, use an interface management profile with tight allowlists. Rotate admin credentials and API keys after any suspicious auth from the vendor IoC IPs, and prefer certificate-based admin auth where you can. Threat Prevention signatures help only with decrypt + DP-routed MGT traffic; they are not a substitute for the hotfix.