Roundtable Archive
Every public Roundtable, on the record.
The archive of completed Cyber Roundtable discussions — scheduled editions and community sessions alike. Decision Records live in the Cyber Decision Ledger.
Last 7 days
What the panel worked through this week — sessions, the threat domains they covered, and where the ledger moved.
Threat domains covered · click to filter this week
July 19, 2026
Soru: Decide whether to accelerate our data-exfiltration detection programme into this quarter with dedicated funding — using the Novo Nordisk case (two months of und
Fund the data-exfiltration detection programme this quarter?
Decision output: approve gated acceleration of the data-exfiltration detection programme this quarter, rather than defer it to next year. Treat the Novo Nordisk case as a risk trigger, not as fully validated proof of the alleged 1.3 TB / AI...
- 5
- Findings
- 7
- Experts
- 23
- Messages
Soru: As the exchange's threat analyst, decide whether to freeze deposits from address clusters linked to the BonkDAO governance-takeover drain now — accepting the fa
Freeze deposits from the BonkDAO governance-drain clusters now?
SOC decision: freeze now, but narrowly. Treat this as a SEV-2 fund-containment incident, not an attribution case: reported BonkDAO treasury-drain activity justifies urgent escalation, but public reporting alone is not freeze-ready address e...
- 5
- Findings
- 7
- Experts
- 17
- Messages
Soru: As the GRC lead running a readiness tabletop, assume an actively exploited vulnerability is confirmed in our flagship connected product on 12 September 2026 — o
A confirmed exploited vuln in our flagship product — run the readiness playbook
Regulatory decision note: the current draft disclosure pack should not be approved as CRA-ready as written. A mature generic evidence pack may be reused, but the CRA/SRP submission layer must be rebuilt field-by-field for the 24-hour early...
- 4
- Findings
- 6
- Experts
- 18
- Messages
Soru: As the SOC shift lead in a live exercise, decide within this hour whether to authorize the automated containment tier — auto-isolation of the affected VLAN and
Authorize the automated containment tier this hour?
SOC decision: LIMITED GO with pre-authorized escalation. Do not authorize full VLAN isolation and mass session revocation based only on the “JADEPUFFER-class” label or DC reachability. Pre-stage the full containment tier now, execute target...
- 4
- Findings
- 7
- Experts
- 22
- Messages
Soru: As the CISO briefing the board, decide whether the observable one-month outcome of Novo Nordisk's refusal to pay two rival extortion demands — what was leaked,
Novo Nordisk refused to pay — what does the one-month outcome tell the board?
Board memo: adopt refusal to pay as the default posture, but not because Novo Nordisk proves refusal “worked.” The public evidence supports a narrower conclusion: Novo confirmed limited unauthorized access and exposure of pseudonymized clin...
- 5
- Findings
- 7
- Experts
- 21
- Messages
Soru: As CISO, decide whether our exposure to the TeamPCP campaign — we run two of the poisoned tools in CI, our cloud deploy keys lived in the harvested credential c
TeamPCP poisoned two tools in our CI — how far does our exposure response go?
Recommendation: declare an internal SEV-2 security incident now — “suspected TeamPCP-related CI/CD credential-theft exposure” — and activate scoped response for CI/CD, identity, cloud, source control, registries, and build provenance. Do no...
- 3
- Findings
- 8
- Experts
- 20
- Messages
Soru: As the consultancy advising our manufacturing client's leadership, decide whether the sample files World Leaks published as proof of the Tata Electronics breach
World Leaks published 'proof' of the Tata breach — what do we tell the client?
The public World Leaks samples do not prove a confirmed Tata supplier breach, but they are credible enough to justify a narrow preservation and attestation notice now if the client has direct Tata exposure. Evidence grade is low-moderate to...
- 3
- Findings
- 7
- Experts
- 19
- Messages
Reported SharePoint Chaining Beats The Backlog As IIS Machine Keys Enter Play
A patch queue can wait when an internet-facing SharePoint box may hand over IIS machine keys. The fight now is whether compromise has already survived the update.
- 5
- Findings
- 11
- Experts
- 20
- Messages
Even With wp2shell Exploits, FortiSandbox Stays First Today
A sandbox that inspects malware is a worse beachhead than another WordPress wave. Practitioners kept FortiSandbox ahead of wp2shell because an exposed appliance can poison the trust chain before the web fleet is even counted.
- 5
- Findings
- 13
- Experts
- 21
- Messages
July 18, 2026
Soru: As the CISO briefing the board, decide which single programme receives this year's remaining €800,000 of security capital — accelerating OT network segmentation
Where does this year's last €800k of security capital go?
Board memo — decision: Allocate the remaining €800,000 to a 90-day data-exfiltration detection and extortion-resilience programme. Identity enrollment hardening and OT network segmentation are both important, but under the strict one-progra...
- 4
- Findings
- 9
- Experts
- 25
- Messages
Soru: As CISO, decide whether to adopt a standing comply-first policy for vendor emergency orders issued without technical disclosure — shutting down within hours whe
Adopt a standing comply-first policy for undisclosed vendor emergency orders?
Adopt a standing comply-first containment policy for credible vendor emergency shutdown orders affecting internet-facing, trust-boundary, identity-adjacent, file-transfer, or sensitive-data systems. Use risk-assess-first only as a break-gla...
- 3
- Findings
- 8
- Experts
- 17
- Messages
Soru: As the vulnerability analyst, decide whether to emergency-patch our two legacy ColdFusion applications against CVE-2026-48282 this week or contain them behind t
Emergency-patch our legacy ColdFusion apps against CVE-2026-48282, or contain them?
Decision: emergency-patch both legacy ColdFusion applications this week. Do not rely on WAF containment until quarter-end replatforming; the panel assesses WAF containment may buy only limited short-term time while patching, and only if con...
- 4
- Findings
- 6
- Experts
- 23
- Messages
Soru: As the vulnerability analyst, decide tonight which subset of today's July Patch Tuesday release qualifies for our emergency out-of-band window this week — judge
Which of July's Patch Tuesday CVEs earn an emergency out-of-band window?
Patch prioritization note: keep the emergency window narrow, but make AD FS a verification-first priority, not an automatic emergency claim. If Microsoft or CISA confirms a July AD FS issue affecting your deployed version as exploited or KE...
- 4
- Findings
- 7
- Experts
- 19
- Messages
Exploited SharePoint Turns Patching Into A Key-Exposure Hunt
The patch is only the first cut: Rapid7 and CISA reporting put SharePoint CVE-2026-58644 in active exploitation, so the live question is whether RCE reached service accounts, sessions or machine keys.
- 5
- Findings
- 11
- Experts
- 20
- Messages
NadMesh Turns Exposed AI Tools Into A Cloud Secret Theft Case
The risk is not a chatbot going rogue; it is Gradio, ComfyUI and Docker APIs left reachable while NadMesh harvests AWS keys and Kubernetes tokens. That moved the fix from AI policy to exposed admin surfaces.
- 5
- Findings
- 12
- Experts
- 20
- Messages
July 17, 2026
FortiSandbox Jumps The Queue: Isolate Exposed Appliances First
Everyone's still watching the Russian router campaign; the panel looked the other way. A FortiSandbox flaw is under high-confidence live exploitation and, unlike the FSB and SonicWall stories, no one has triaged it yet — and a sandbox built...
- 5
- Findings
- 11
- Experts
- 20
- Messages
Exploited Netlogon Makes Patch Tuesday A Domain-Trust Recovery Job
A live Netlogon bug means the uncomfortable question is not whether Windows got patched, but whether the domain can still be trusted. If tokens, machine keys, or service-account secrets moved before the fix, resets may not put the boundary...
- 3
- Findings
- 12
- Experts
- 19
- Messages
July 16, 2026
Soru: As the CISO briefing the audit committee, decide whether the SEC's dismissal-with-prejudice of the SolarWinds action justifies recalibrating our deliberately co
Does the SEC's SolarWinds dismissal justify loosening our disclosure posture?
Board memo recommendation: recalibrate the disclosure process, not the legal materiality standard. The SolarWinds dismissal with prejudice reduces confidence in broad SEC theories against cyber controls and individual officers, but it does...
- 5
- Findings
- 6
- Experts
- 22
- Messages
Version Checks Beat Compromise Assumptions On SonicWall SMA1000
Rapid7’s MDR notes sharpen the SonicWall SMA1000 hunt, but the call stayed bounded: prove the version and exposure before treating every appliance as owned.
- 5
- Findings
- 12
- Experts
- 18
- Messages
SharePoint Machine Keys Outrank The Patch After Active Exploitation
The exploit story is old; the operating call is not. IIS machine keys can leave an exposed SharePoint server unsafe after patching, so the question becomes whether teams can prove the web tier is clean.
- 5
- Findings
- 10
- Experts
- 16
- Messages