Imagine you are part of a team managing the IT infrastructure for a financial institution. The organization relies heavily on its production servers to process financial transactions each evening at $11$ pm Central Time, and any downtime or disruption could have significant financial repercussions. A critical security vulnerability $($with remote code execution$)$ has been identified in the operating system of the core transaction systems, and a patch has been released by the software vendor. A security researcher shared proof of concept code with the vendor during vulnerability disclosure; however, exploit code was not publicly available at the time of the vulnerability announcement.

Describe at least two tactics that the financial institution could employ to balance their concerns over vulnerability exploits and the need for system availability and reliability.