Recent advancements in medical and industrial Internet of Things have raised security concerns, as vulnerabilities can impact critical systems, workflows, privacy, and safety. The window of vulnerability, ranging from days to months, allows attackers to exploit weaknesses before patches are applied. Manual mitigation is time-consuming, especially when specific component versions are affected.To address this, a multi-modal security architecture was developed, dividing complex systems into operational modes with different risks. A mode-switching framework enables security engineers to mitigate threats by sharing information and trigger manual or automated contingency responses, adapting system behavior, configuration, and functionality to reduce exposure. Model-driven techniques and a domain-specific language facilitate the definition of mitigation strategies as mode switches.