During an internal code review, software called 'ACE' was discovered to have a vulnerability that allows the execution of arbitrary code. Which of the following is the first action to take?

While informing customers is important, it is not the first action to take. Before external communications, internal assessment and remediation steps should be prioritized to limit the vulnerability's impact and prevent potential breaches.

Removing the affected vendor resource may be a necessary step in addressing the vulnerability, but it should not be the initial action. Understanding the extent of the vulnerability and its implications through IoC analysis takes precedence in the early stages of incident response.

Developing compensating controls is a valid strategy in response to vulnerabilities, but it should follow the identification of IoCs. Implementing temporary measures without a clear understanding of the threat landscape may lead to inadequate protection or ineffective mitigation.