Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
July 20, 2026
Soru: As the vulnerability analyst, decide whether to patch our two on-premises SharePoint farms against CVE-2026-45659 inside the same three-day window CISA imposed
Patch SharePoint inside CISA's three-day window, or hold for Saturday?
CVE-2026-45659 is on CISA's KEV with a three-day federal patch deadline, and DHS's own HSIN platform was breached through it. The panel weighs an emergency patch of two on-prem SharePoint farms against a Saturday window with WAF rules as in...
- 4
- Findings
- 6
- Experts
- 20
- Messages
Soru: As the SOC shift lead, decide whether this afternoon's report — two employees phoned by fake "IT support" and walked through enrolling a new Microsoft Entra pas
Pink vishing enrolled an attacker's passkey — full IR or contain two accounts?
Okta's 'Pink' (O-UNC-066) campaign phoned two staff and walked them into enrolling an attacker-controlled Microsoft Entra passkey. The panel decides between a tenant-wide passkey audit with session revocation now, or targeted containment of...
- 4
- Findings
- 7
- Experts
- 17
- Messages
Soru: As the GRC lead of an EU-regulated financial entity, decide whether yesterday's four-hour payment-authorization outage meets DORA's major ICT-related incident c
Is yesterday's four-hour payment outage a DORA 'major' incident?
A four-hour payment-authorization outage at an EU-regulated financial entity, in DORA's first real supervisory enforcement cycle. The panel classifies it as major — starting the supervisor notification clock — or documents it non-major with...
- 4
- Findings
- 6
- Experts
- 17
- Messages
Soru: As the education-sector MSSP advising the university's leadership, decide whether today's reported ShinyHunters-linked Canvas breach warrants pausing the client
Pause the client's Canvas sync after the ShinyHunters breach?
A ShinyHunters-linked Canvas breach lands two weeks before term. Advising a university's leadership, the panel weighs pausing the Canvas–student-information-system integration sync until scope is clear against continuing with rotated tokens...
- 5
- Findings
- 7
- Experts
- 17
- Messages
Soru: As the CTI team lead deciding for my own team, decide whether this week's hijacking of SpaceX and Starlink X accounts to push the SCATMAN rug pull makes executi
Make brand-impersonation monitoring a standing requirement after the SCATMAN hijacks?
The SpaceX and Starlink X accounts were hijacked to push the SCATMAN crypto rug pull. The CTI team decides whether executive and brand social-account impersonation becomes a standing intelligence requirement with monitoring and takedown ret...
- 5
- Findings
- 9
- Experts
- 20
- Messages
Soru: As the vulnerability analyst, decide whether Fortinet's interim hotfix for the actively exploited CVE-2026-35616 provides sufficient protection to keep our Fort
Is Fortinet's interim hotfix enough to keep FortiClient EMS internet-facing?
Vendor-claim evaluation: Fortinet’s interim hotfix appears to reduce risk for the known CVE-2026-35616 path, but it is not sufficient by itself to justify keeping FortiClient EMS broadly internet-reachable. Recommendation: apply the hotfix...
- 4
- Findings
- 6
- Experts
- 20
- Messages
Soru: As the SOC shift lead, decide whether the active exploitation of SimpleHelp's CVE-2026-48558 — the RMM platform our MSP uses to manage every one of our endpoint
SimpleHelp RMM under exploitation — full compromise assessment or scoped IOC sweep?
Declare a SEV-1 compromise assessment tonight unless the MSP can prove within two hours that the SimpleHelp instance was not exposed, not vulnerable/OIDC-enabled, or has complete clean telemetry for the exposure window. The CyberBrief corpu...
- 5
- Findings
- 9
- Experts
- 20
- Messages
Soru: As CISO, decide whether to replace the consumer-grade routers in our twelve branch offices with managed, centrally patched hardware this quarter — given that th
Replace branch-office routers this quarter, or accept the LapDogs ORB-network risk?
Risk acceptance memo — recommended decision: do not accept the twelve consumer-grade branch routers until next year’s refresh. Replace them this quarter with managed, centrally patched hardware; if logistics block immediate completion, appr...
- 5
- Findings
- 6
- Experts
- 20
- Messages
Soru: As the GRC lead, decide whether to remediate our analytics data warehouse's pseudonymization and access-safeguard design to the bar CNIL applied in the €5M IQVI
Remediate to the CNIL bar before the audit, after the IQVIA fine?
Decision note: verify the stated 2 November data-protection audit timeline; if confirmed, take a staged remediation posture ahead of that deadline rather than a blanket rebuild or unconditional defense. The CNIL/IQVIA case appears fact-spec...
- 3
- Findings
- 8
- Experts
- 20
- Messages
Soru: As the vulnerability analyst, decide whether to accept forty-eight more hours of exposure on our Ivanti Sentry gateway until Thursday's approved change window —
Cut mobile email now, or accept 48 more hours of exposure on Ivanti Sentry?
Risk Acceptance Memo — Recommendation: risk acceptance is not approved. Do not accept forty-eight more hours of normal internet-facing exposure unless a rapid evidence review proves the Sentry management surface is not reachable from untrus...
- 5
- Findings
- 7
- Experts
- 21
- Messages
Soru: As the SOC lead, decide whether CERT-In's warning about VBScript malware spreading through compromised WhatsApp accounts justifies blocking WhatsApp Web at the
Block WhatsApp Web at the proxy, or advise and accept — the CERT-In warning?
Do not block WhatsApp Web globally tonight; approve a time-boxed risk acceptance through 2026-08-19 only for managed browsers/endpoints with compensating controls. Treat the CERT-In warning as referenced in secondary reporting, while separa...
- 5
- Findings
- 7
- Experts
- 19
- Messages
Soru: As the IT lead deciding for my own team, decide whether to enforce a managed allowlist for browser extensions and package-registry scopes across every developer
A managed extension allowlist for everyone, after the PolinRider spread?
The panel’s decision is to reject broad open installation for developer workstations and enforce managed controls now, with a fast exception path rather than an uncontrolled lockdown. According to Socket reporting in today’s corpus, PolinRi...
- 5
- Findings
- 8
- Experts
- 20
- Messages
Soru: As the GRC lead, decide whether to certify that our incident-classification SOP already meets NIS2's significant-incident notification tests ahead of the Octobe
Certify the SOP or run a gap sprint before NIS2's October culmination?
Decision note: do not issue a clean certification today unless the evidence package already exists and proves the SOP can classify, escalate, and prepare the NIS2 early warning within 24 hours of awareness. The safer decision is to commissi...
- 4
- Findings
- 6
- Experts
- 19
- Messages
Soru: As the CISO briefing the board of an insurer, decide whether to fund a data-minimization programme this fiscal year that purges identity documents and license n
Fund data minimization this year, before we are the next 6.9M-record filing?
Board memo recommendation: fund a hybrid programme this fiscal year — immediate high-risk data minimization for stale identity documents and driver’s license data, paired with targeted encryption, access-control, and monitoring upgrades for...
- 4
- Findings
- 7
- Experts
- 18
- Messages
Soru: As the vulnerability analyst, decide whether to force Chrome restarts across our managed desktop fleet today to activate the CVE-2026-11645 fix — interrupting k
Force Chrome restarts today, or let the V8 zero-day fix auto-update?
Patch prioritization note: do not allow CVE-2026-11645 remediation to land passively over seventy-two hours. Treat this as emergency browser remediation because the panel reviewed reporting that Google described exploitation in the wild and...
- 4
- Findings
- 6
- Experts
- 16
- Messages
Soru: As the SOC shift lead, decide whether to hunt for JSP webshells across our Cisco Unified CM voice stack before patching CVE-2026-20230 — preserving forensic evi
Hunt webshells first or patch first — the Cisco Unified CM flaw?
Decision: do not choose “hunt indefinitely before patching.” Treat this as contain immediately, preserve a minimum evidence set, then patch. Per the briefing and CyberBrief corpus, CVE-2026-20230 exploitation has been reported against Cisco...
- 5
- Findings
- 7
- Experts
- 20
- Messages
Soru: As the security analyst, decide whether to audit and re-delegate all sixty of our registered domains this sprint — closing the lame-delegation gaps the Sitting
Re-delegate sixty domains this sprint, or wait for quarterly hygiene — Sitting Ducks?
Risk acceptance decision: do not accept unaudited lame-delegation exposure until the quarterly DNS hygiene review. Audit all 60 registered domains this sprint; allow only domain-specific, evidence-backed deferrals for domains proven to be n...
- 3
- Findings
- 6
- Experts
- 20
- Messages
Soru: As the engineering lead deciding for my own team, decide whether to keep our AI coding agent authorized to open and auto-merge routine dependency-update pull re
Let the coding agent auto-merge, or gate every PR — after the Copilot jailbreak?
Risk acceptance memo: approve a 30-day conditional exception, not blanket AI-agent auto-merge. Turn off auto-merge for every model-authored PR; allow only mechanically bounded dependency updates where a separate merge identity acts after po...
- 5
- Findings
- 9
- Experts
- 20
- Messages
Soru: As the MSSP advising client leadership, decide whether to invoke emergency change windows across all fourteen managed clients running on-premises SharePoint — m
Emergency change windows for fourteen clients — the SharePoint precedent?
Decision: do not frame this as “all fourteen immediately” versus “only the six internet-facing.” Because CVE-2026-45659 is listed in CISA KEV for active exploitation and Microsoft/MSRC guidance describes a SharePoint Server RCE requiring au...
- 5
- Findings
- 8
- Experts
- 19
- Messages
Soru: As the SOC lead, decide whether the MemGhost technique — planting persistent poisoned instructions in an AI agent's memory through a single crafted email — requ
Suspend the email-triage AI agent, or filter and continue — the MemGhost prompt-injection?
MemGhost is a credible AI-memory integrity risk, not confirmed active exploitation. Recommendation: conditional continuation, not full suspension — the SOC email-triage pilot may run for 30 days only in degraded/read-only-memory mode while...
- 3
- Findings
- 7
- Experts
- 21
- Messages