A new threat intelligence report describes exploitation relevant to an exposed business-critical service. What should happen first?

1. Assume public exploitation proves the organization is already breached
2. Validate relevance to the environment and reassess the affected exposure
3. Ignore the report until an internal audit
4. Buy every product mentioned by the report