Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
July 20, 2026
Soru: As CISO, decide whether to issue hardened travel-only devices to our executive team for upcoming EU and Middle East trips — after Citizen Lab confirmed that a m
Hardened travel devices or Lockdown Mode — the Pegasus finding?
The panel’s decision is not to accept blanket residual risk for executive primary devices on EU and Middle East travel. For the next 90 days, primary-device use is acceptable only for lower-risk travel with verified hardening, Lockdown Mode...
- 4
- Findings
- 7
- Experts
- 21
- Messages
Soru: As the CTI lead of a digital-asset platform deciding for my own team, decide whether TRM's finding that North Korea-linked groups took roughly $643 million — tw
Build DPRK tracking in-house, or trust the tracing vendor — the $643M share?
TRM’s reported H1 2026 figure — about $643M in North Korea-linked crypto theft out of roughly $972M total losses — is strong enough to justify a DPRK-focused validation capability, but not a full in-house replacement for a blockchain tracin...
- 5
- Findings
- 8
- Experts
- 22
- Messages
Soru: As the SOC shift lead, decide whether the in-the-wild exploitation of CVE-2026-20896 in the official Gitea Docker image — the same image running our internet-re
Offline rebuild tonight or VPN-restrict — the published Gitea/Docker auth bypass?
SOC decision: do not keep this Gitea CI server operating normally behind VPN while you “look around.” Based on the briefing and panel review, CVE-2026-20896 is reported as an auth-bypass issue in affected official Gitea Docker deployments w...
- 5
- Findings
- 8
- Experts
- 19
- Messages
Soru: As the DevOps lead deciding for my own team, decide whether to prioritize pinning every GitHub Action to a commit SHA and migrating CI to OIDC-scoped short-live
Pin every GitHub Action to a SHA this sprint — the TeamPCP harvest?
Patch prioritization decision: use a risk-based hybrid, not an all-repo freeze and not a quarter-long deferral. Pause Tier-0 release, deploy, signing, package-publishing, and production cloud workflows for up to seven days unless complete l...
- 4
- Findings
- 8
- Experts
- 18
- Messages
Soru: As the vulnerability analyst, re-evaluate last week's decision to emergency-patch our NetScaler Gateways against CVE-2026-8451 in light of the exploitation and
Does last week's NetScaler patch call still stand — re-evaluating the CitrixBleed-again decision?
Last week’s emergency patch decision for NetScaler Gateway CVE-2026-8451 still holds. The panel found credible reporting of exploitation attempts, but the DragonForce linkage for this specific CVE remains low-confidence and should not drive...
- 4
- Findings
- 7
- Experts
- 17
- Messages
Soru: As the CISO briefing the board of an energy operator, decide whether to pull the OT network-segmentation capital programme approved for 2027 forward into the se
Pull the OT segmentation capex forward — Armored Likho and the FSB advisories?
Board memo recommendation: do not pull the entire 2027 OT segmentation programme into H2 2026; approve a targeted H2 2026 acceleration of OT boundary segmentation, OT DMZ/remote-access control, network-device management-plane isolation, and...
- 5
- Findings
- 8
- Experts
- 25
- Messages
Soru: As CISO, decide whether JADEPUFFER — the first documented ransomware intrusion run end-to-end by an autonomous LLM agent — invalidates the human-speed assumptio
Re-baseline SLAs for machine-speed intrusions — the JADEPUFFER wargame?
Risk acceptance memo — do not accept a 90-day wait on containment automation as-is; fund targeted automated containment this quarter for JADEPUFFER-class paths that are relevant and internally verified, while deferring broad fleet-wide auto...
- 4
- Findings
- 7
- Experts
- 28
- Messages
Soru: As the CTI analyst, decide whether to keep submitting TLP:AMBER indicators and victim context through government information-sharing platforms after DHS's own H
Keep sharing through government platforms, after the HSIN breach?
Risk acceptance memo: For the next 30 days, adopt a controlled-sharing posture rather than normal full-context submission through government information-sharing platforms. Continue sending sanitized, machine-actionable indicators and defens...
- 5
- Findings
- 7
- Experts
- 21
- Messages
Soru: As the GRC lead of a university running Oracle PeopleSoft Campus Solutions, decide whether ShinyHunters' active exploitation of CVE-2026-35273 and the 455,000-r
Pre-notify the regulator or assess first — the PeopleSoft zero-day fallout?
Apply emergency compensating controls now, but do not file a formal data-protection breach notification unless local evidence shows unauthorised access to personal data or critical logging gaps make such access reasonably likely. Treat this...
- 4
- Findings
- 6
- Experts
- 23
- Messages
Soru: As CISO, decide whether to revoke every GitHub token exposed to the Hades PyPI campaign immediately — accepting the campaign's explicit "gh-token-monitor" threa
Revoke the PyPI tokens now despite the retaliation threat — the Hades extortion?
Recommended CISO decision: do not perform blind global GitHub token revocation as the first click. Revocation and rotation are mandatory tonight, but the panel recommends a controlled 30–45 minute containment sprint first because researcher...
- 5
- Findings
- 8
- Experts
- 24
- Messages
Soru: As the CISO briefing the board, decide whether to move board and executive communications to a company-managed end-to-end-encrypted channel with governed retent
Move executive comms to E2EE — after Salt Typhoon reached the wiretaps?
Board memo: approve a 90-day controlled migration of board and executive sensitive communications to a company-managed, enterprise E2EE channel with governed retention. Do not approve consumer messaging or unmanaged encrypted apps as the co...
- 4
- Findings
- 7
- Experts
- 21
- Messages
Soru: As CISO, decide whether to re-enable Microsoft 365 Copilot Enterprise Search for the executive team on the strength of Microsoft's server-side fix for the Searc
Re-enable Copilot for the exec team — after the SearchLeak finding?
Verdict: do not re-enable Microsoft 365 Copilot Enterprise Search for the executive team on Microsoft’s server-side fix alone. Treat Microsoft’s fix as closure of the reported product chain, not proof that executive tenant data, permissions...
- 4
- Findings
- 8
- Experts
- 29
- Messages
Reported ServiceNow Exploits Push Exposed Instances Past Patch-Only
A workflow system can sit near approvals, credentials and payments, so CVE-2026-6875 does not close on patch status alone. The evidence is still reporting-led; the question is whether your instance shows it was touched.
- 5
- Findings
- 12
- Experts
- 21
- Messages
SonicWall SMA 1000 Jumps SharePoint On Credential Theft Reports
An internet-facing VPN box can hand attackers sessions, not just a CVE score. With SharePoint offering no fresh defender change, exposed SMA 1000 appliances drew the harder call: preserve evidence before calling the patch done.
- 5
- Findings
- 12
- Experts
- 20
- Messages