The thread installs the SolarWinds-signed Orion update as a case in which the recommended security action — apply the vendor-signed patch — was the delivery path for SUNBURST. The unresolved question is which repair would have closed that channel in March 2020. Disconnect-first, as in Emergency Directive 21-01, treats the update channel as untrusted until a party other than the vendor has looked at the bits. Requiring the signed binary to correspond to reviewed source is a different first rule: the 8-K already says the source repository was clean. Taking network-management software off the domain as a patch-trusted host is a third. Those are not substitutes. FireEye found the implant by reversing the signed DLL. SUNSPOT is why a source review would have missed it. Neuberger's later count of about 100 companies and nine agencies is the follow-on, not the channel. The live question is which of those three, required when Hotfix 5 shipped, would have turned a SolarWinds signature back into a non-decision.