As cyberattacks against the cloud become more frequent, operators must define efficient maintenance strategies to safeguard data centers. Existing maintenance strategies strive to minimize the maintenance duration and the number of migrations. However, such solutions overlook the period that servers wait for their update, which represents a vulnerability window that attackers can exploit. Accordingly, this study introduces a novel metric, Vulnerability Surface, which assesses maintenance strategies regarding servers' exposure. In addition, we present Salus, a heuristic that minimizes servers' exposure during maintenance. Experimental results show that Salus reduces the Vulnerability Surface by 19.44% compared to baseline strategies.