A method of managing compromised devices in a communication network, the method performed by one or more network nodes implementing a Network Exposure Function in the communication network, and the method comprising: communicatively coupling with an Application Server that supports one or more application services used by a communication device that communicatively couples with the AS via a first network slice provided by the communication network; determining that the communication device is compromised, based on detecting a device anomaly regarding the communication device, the device anomaly being an anomalous state or behavior of the communication device, or based on receiving signaling incoming from the AS, indicating that the communication device is compromised; and responsive to determining that the communication device is compromised, performing quarantine operations to move the communication device from the first network slice to a second network slice, for management of the communication device as a compromised device, the second network slice referred to as a quarantine network slice and the quarantine operations including sending a request to a Network Slice Selection Function (NSSF) and forcing re-registration of the communication device with the communication network, for reconnection of the communication device to the communication network via the quarantine network slice, wherein the NEF comprises at least one of a first NEF or a second NEF that is associated with the quarantine network slice, the method comprising: receiving an indication from the AS that the compromise of the communication device is ended; and responsive to receiving the indication, performing recovery operations to return the communication device to the first network slice, for management of the communication device as an uncompromised device, the recovery operations including sending a further request to the NSSF and forcing reregistration of the communication device with the communication network, for re-connection of the communication device to the communication network via the first network slice. communicatively coupling with an Application Server that supports one or more application services used by a communication device that communicatively couples with the AS via a first network slice provided by the communication network; determining that the communication device is compromised, based on detecting a device anomaly regarding the communication device, the device anomaly being an anomalous state or behavior of the communication device, or based on receiving signaling incoming from the AS, indicating that the communication device is compromised; and responsive to determining that the communication device is compromised, performing quarantine operations to move the communication device from the first network slice to a second network slice, for management of the communication device as a compromised device, the second network slice referred to as a quarantine network slice and the quarantine operations including sending a request to a Network Slice Selection Function (NSSF) and forcing re-registration of the communication device with the communication network, for reconnection of the communication device to the communication network via the quarantine network slice, wherein the NEF comprises at least one of a first NEF or a second NEF that is associated with the quarantine network slice, the method comprising: receiving an indication from the AS that the compromise of the communication device is ended; and responsive to receiving the indication, performing recovery operations to return the communication device to the first network slice, for management of the communication device as an uncompromised device, the recovery operations including sending a further request to the NSSF and forcing reregistration of the communication device with the communication network, for re-connection of the communication device to the communication network via the first network slice. receiving an indication from the AS that the compromise of the communication device is ended; and responsive to receiving the indication, performing recovery operations to return the communication device to the first network slice, for management of the communication device as an uncompromised device, the recovery operations including sending a further request to the NSSF and forcing reregistration of the communication device with the communication network, for re-connection of the communication device to the communication network via the first network slice.