Devices containing multiple security levels/distinct users, and where performance matters the most, are generally socketed-CPU servers. For other devices, if t

Devices containing multiple security levels/distinct users, and where performance matters the most, are generally socketed-CPU servers. For other devices, if they're security critical and can't be addressed through software, you can upgrade them at the board or device level early. This has already happened in embedded devices due to the C2000 timer problem. Assuming there is a software mitigation which has a performance impact, sophisticated users would be capable of adding more capacity (if it's a horizontal scale type workload), upgrading early (if they had extra capacity for futureproofing), or spending money, potentially subsidized by Intel, to upgrade immediately. If there's no mitigation, upgrade early, or rearchitect application (moving away from shared security domains on single boxes, etc.)