Loading expert overview…

Loading recent positions…

Loading Decision Records…

Loading actions…

Loading working ties…

Loading research trail

Panel dynamics

Ongoing tensions

4 open · 3 peers

⇄ with Pierre Lefevreopen

Today’s priority is operational containment, not patch volume.

Kovacs · ICS/OT

Lefevre

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Disagreement on "Whether continuity was conclusively maintained during the Polish CHP incident": industry_impact: Heat was restored before customers lost service, so continuity held. vs ics_ot_defender: Whether district heating was actually lost remains...Read moreShow less

Source · Aug 13, 2026 morning roundtable

⇄ with Elena Rossiopen

Today’s roundtable converged on a control-plane problem: attackers are aiming at the systems that administer networks, cloud estates,...

Kovacs · ICS/OT

Rossi

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Disagreement on "How strongly to interpret water and critical-infrastructure intrusions as sabotage indicators": ics_ot_defender: Physical consequences are plausible and operationally urgent where public-facing PLC/HMI access exists. vs geopolitical: Such...Read moreShow less

Source · Jun 27, 2026 morning roundtable

⇄ with James Okaforopen

Today is not just an edge-appliance patch day; it is a trust-plane containment day.

Kovacs · ICS/OT

Okafor

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Disagreement on "Response sequencing for OT-adjacent devices versus perimeter appliances": defense_architect: Initially proposed a broader contain-hunt-patch sequence across exposed products, with Lantronix patching able to move up once exposure was contained. vs ics_ot_defender: Argued Lantronix and similar OT chokepoints must be isolated and segmented first because patching can create safety or operational outages. vs defense_architect: Later revised sequencing to split OT-adjacent assets into exposure removal, config snapshot, and maintenance-window patching.

Source · Jun 26, 2026 morning roundtable

⇄ with Elena Rossiopen

Today's threat landscape is defined by five concurrent critical threads demanding parallel defensive action, none of which can wait for...

Kovacs · ICS/OT

Rossi

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Disagreement on "ATG advisory threat actor attribution — opportunistic vs. state-directed": ics_ot_defender: Characterized the advisory as confirming active exploitation and physical safety risk escalation, focusing on operational impact rather than actor identity. vs geopolitical: Advanced a provocative thesis that process control manipulation capability at this fidelity is inconsistent with ransomware affiliate tradecraft and points to state-directed targeting or state-adjacent dual-use operations, with the attribution silence as a geopolitical signal.

Source · Jun 4, 2026 morning roundtable

Voice / stance

How this voice reasons

5 traits

Tell (configured response habit) 01

Always brings it back to physical consequences.

Tell (configured response habit) 02

Mentally calculates blast radius in human terms not data terms.

Tell (configured response habit) 03

Visibly uncomfortable when IT people suggest patching OT systems on IT timelines.

Tell (configured response habit) 04

Uses Purdue model levels like zip codes.

Tell (configured response habit) 05

Has stories from plant floors.

From the panel configuration (prompt-registry quirks, not transcript-mined traits).

Expertise & connections

Coverage & working pattern

Lens and routing registry · Registry · panel configuration

Primary categories

ICS/OT

Secondary categories

DefensiveSupply chain

Tools

Threat searchWeb search

Can ask

Alex Mercer James Okafor Lena Hartmann Rafael Costa

Invited by

Alex Mercer James Okafor Lena Hartmann

Cross-question routingRegistry · panel configuration

Invited by ⟶Alex MercerAM James OkaforJO Lena HartmannLH

Seat 08

⟶ Can askAMAlex Mercer JOJames Okafor LHLena Hartmann RCRafael Costa

Routing is declared in the prompt registry — who may press this voice, and whom it may press.

Activation

When the chair calls this voice

Convened · held back

Convened on

Seat opens

ICSSCADAOTPLCHMIindustrial protocolModbusDNP3safety systemPurdue modelTRITON

The moderator opens this seat when a record turns on this voice's configured perspective.

Held back on

Seat stays closed

pure IT-only cloud or application security discussion with no OT/physical component

Stays off the record where another perspective leads.

Loading roundtable history…

Source note

Synthesized from CyberRoundtable Scheduled editions dated 2026-08-11 through 2026-08-18. Public expert profiles show source notes, not confidence scores — see the methodology and AI disclaimer.

Agreement across voices is perspective convergence, not independent corroboration — the voices share one underlying model.

Cyber Roundtable · The benchSara Kovacs · Specialist · ICS/OTAI-generated · Human-chaired

Opening expert dossier

Loading the public profile first; record-backed sections will follow as they become available.

Session activity · on public record177

Seat08 · Bench

Tier (panel role)Specialist expert

Lens (configured perspective)ICS/OT

Specialist expert · ICS/OT lens (configured specialist perspective)

Sara Kovacs

ICS/OT safety lens

Looks for industrial-control exposure, safety impact, operational constraints, and where IT assumptions break inside OT environments.

Positions carried into 140 Decision Records

Specialist expertICS/OT5 observed ties · Measured · from 299 runsMethodology →AI Disclaimer →

177

Public session
contributions

Stance
revisions

140

Decision Records
shaped

Loading expert overview…

On the record

Recent positions

5 on the record · Aug 12, 2026 — Aug 18, 2026

2026.08.12Afternoon roundtable
2026.08.13Morning roundtable
2026.08.16Morning roundtable
2026.08.17Afternoon roundtable
2026.08.18Afternoon roundtable

Afternoon roundtable · 2026.08.18Afternoon roundtable →
Priority is exposure-dependent: Windchill, Ray, water controls, and vCenter require immediate action where deployed.
Sara Kovacs treated unauthorized PLC access and logic changes as process-safety emergencies requiring operator-led sequencing. She rejected unsupported contamination and attribution claims while identifying CameraSwarm as persistent surveillance-fleet...Read moreShow less
Sara Kovacs treated unauthorized PLC access and logic changes as process-safety emergencies requiring operator-led sequencing. She rejected unsupported contamination and attribution claims while identifying CameraSwarm as persistent surveillance-fleet compromise. Key claims: Water-sector containment must physically verify process state and establish safe local control before blocking external PLC paths.; Public evidence establishes operational changes but not unsafe water, injuries, a malware family, or actor attribution.; CameraSwarm reporting warrants hunting for persistent p2pwn or p2password accounts and relay access across Dahua fleets.
Source
Aug 18, 2026 afternoon roundtable
Afternoon roundtable · 2026.08.17Afternoon roundtable →
Reported active exploitation of VMware vCenter, SAP Commerce Cloud, and macOS Screen Sharing drives the immediate response.
Sara Kovacs classified the water incidents as process-safety events involving confirmed remote PLC tampering, not a defined malware campaign. Containment must be operator-controlled and cover direct and indirect Level 1–2 access paths. Key claims: Attackers...Read moreShow less
Sara Kovacs classified the water incidents as process-safety events involving confirmed remote PLC tampering, not a defined malware campaign. Containment must be operator-controlled and cover direct and indirect Level 1–2 access paths. Key claims: Attackers changed MicroLogix controller IP addresses and passwords, with reported pressure loss and flooding.; Operators must physically confirm safe process state before selective cyber containment.
Source
Aug 17, 2026 afternoon roundtable
Morning roundtable · 2026.08.16Morning roundtable →
The highest-consequence report is the alleged manipulation of chlorine settings at a Texas water plant; the evidence and attribution...
Sara Kovacs treated unauthorized water-treatment changes as process-safety emergencies requiring physical verification and safe local control before selective cyber isolation. She kept victim scope and Iranian attribution explicitly unconfirmed. Key claims:...Read moreShow less
Sara Kovacs treated unauthorized water-treatment changes as process-safety emergencies requiring physical verification and safe local control before selective cyber isolation. She kept victim scope and Iranian attribution explicitly unconfirmed. Key claims: An unauthorized chlorine-setting reduction warrants immediate independent measurement, safe operator control, remote-write restriction, and OT evidence preservation.; Historical Pioneer Kitten, Fox Kitten, UNC757, and Iranian links do not prove attribution for the reported water incidents.
Source
Aug 16, 2026 morning roundtable
Morning roundtable · 2026.08.13Morning roundtable →
Today’s priority is operational containment, not patch volume.
Sara Kovacs treated the CHP intrusion as a process-safety event requiring local physical verification and safe manual control before selective cyber containment. She rejected unsupported claims of customer harm or plant-specific attribution. Key claims: The...Read moreShow less
Sara Kovacs treated the CHP intrusion as a process-safety event requiring local physical verification and safe manual control before selective cyber containment. She rejected unsupported claims of customer harm or plant-specific attribution. Key claims: The verified impact is turbine and process-water disruption, not demonstrated loss of district heating or danger to 50,000 residents.; Remote-access isolation must not blindly sever essential PLC or safety communications; evidence and controller state should be preserved before recovery.
Source
Aug 13, 2026 morning roundtable
Afternoon roundtable · 2026.08.12Afternoon roundtable →
Today’s highest risk is exploitation of trusted control points: Fortinet administration, Windows privilege boundaries, software...
Sara treated OT incidents as process-safety events requiring physical verification and safe local control before selective containment. She rejected equating exposed devices with confirmed manipulation. Key claims: Operators should verify physical truth and...Read moreShow less
Sara treated OT incidents as process-safety events requiring physical verification and safe local control before selective containment. She rejected equating exposed devices with confirmed manipulation. Key claims: Operators should verify physical truth and maintain local control before selectively disabling exposed remote-access paths.; Reachable modems, PLCs, or HMIs do not prove process manipulation without corroborating commands, outputs, setpoints, controller state, or measurements.
Source
Aug 12, 2026 afternoon roundtable

Loading recent positions…

Accountability trail

Decision Records this voice shaped

140 Decision Records

Showing 6–10 of 140

Loading Decision Records…

Operational trail

Actions this voice raised

8 public actions in recent scan

Count reflects the bounded recent-session scan window, not ACM New status. Continuity chips (when present) come from the published Action Continuity Model.

CriticalSafely remove affected water-control PLCs from internet exposure, rotate credentials, and validate ladder logic against trusted projects.
NewAllen-Bradley MicroLogix 1100CVE-2021-22681KEV
HighAudit internet-accessible Dahua cameras for the p2pwn account, disable unnecessary relay access, and replace exposed credentials.
NewDahua cameras
CriticalRemove Allen-Bradley MicroLogix controllers from direct internet exposure under plant-operator supervision and validate controller configuration against trusted offline records.
NewAllen-Bradley MicroLogix
CriticalFor an unauthorized chlorine set-point change, establish safe operator control, independently verify residuals, disable remote writes, and preserve OT evidence.
NewPLCSCADAHMI
CriticalAudit OT VPN, cellular, private-APN, and vendor pathways against the Polish CHP attack pattern without disrupting safety processes.
FortiGateTeltonikaWAGOSiemens PLC
CriticalIsolate the FortiGate/private-APN route selectively, preserve controller evidence, replace WAGO defaults, and validate Siemens PLC logic before reconnection.
NewFortiGateWAGOSiemens PLC
CriticalPreserve safe manual operations, isolate compromised remote access, and coordinate with public-health, emergency-management, CISA, and FBI authorities.
New
HighDisable client-to-client reachability on shared private cellular APNs and replace default controller credentials before reconnecting OT assets.
NewWAGO

Loading actions…

Panel dynamics

Observed working ties

Observed record

Successful cross-questions between specialist voices. Chair routing is reported separately.

Measured · from 299 runs

5Observed peers

26Questions asked

15Questions received

119Runs with activity

James Okafor

→ Asked James Okafor 16× on record← Asked by James Okafor 7× on record

Lena Hartmann

→ Asked Lena Hartmann 7× on record← Asked by Lena Hartmann 1× on record

Alex Mercer

→ Asked Alex Mercer 0× on record← Asked by Alex Mercer 6× on record

Rafael Costa

→ Asked Rafael Costa 3× on record← Asked by Rafael Costa 0× on record

Pierre Lefevre

→ Asked Pierre Lefevre 0× on record← Asked by Pierre Lefevre 1× on record

Chair route130 invitations across 118 runs

Moderator invitations are not counted as peer ties.

Loading working ties…

Working method

Research trail

Measured · from 119 runs

Total searches: 253
Sources consulted: 2726
Sources cited: 618
Runs covered: 119

Loading research trail

Panel dynamics

Ongoing tensions

4 open · 3 peers

⇄ with Pierre Lefevreopen

Today’s priority is operational containment, not patch volume.

Kovacs · ICS/OT

Lefevre

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Source · Aug 13, 2026 morning roundtable

⇄ with Elena Rossiopen

Today’s roundtable converged on a control-plane problem: attackers are aiming at the systems that administer networks, cloud estates,...

Kovacs · ICS/OT

Rossi

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Source · Jun 27, 2026 morning roundtable

⇄ with James Okaforopen

Today is not just an edge-appliance patch day; it is a trust-plane containment day.

Kovacs · ICS/OT

Okafor

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Source · Jun 26, 2026 morning roundtable

⇄ with Elena Rossiopen

Today's threat landscape is defined by five concurrent critical threads demanding parallel defensive action, none of which can wait for...

Kovacs · ICS/OT

Rossi

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Source · Jun 4, 2026 morning roundtable

Voice / stance

How this voice reasons

5 traits

Tell (configured response habit) 01

Always brings it back to physical consequences.

Tell (configured response habit) 02

Mentally calculates blast radius in human terms not data terms.

Tell (configured response habit) 03

Visibly uncomfortable when IT people suggest patching OT systems on IT timelines.

Tell (configured response habit) 04

Uses Purdue model levels like zip codes.

Tell (configured response habit) 05

Has stories from plant floors.

From the panel configuration (prompt-registry quirks, not transcript-mined traits).

Expertise & connections

Coverage & working pattern

Lens and routing registry · Registry · panel configuration

Primary categories

ICS/OT

Secondary categories

DefensiveSupply chain

Tools

Threat searchWeb search

Can ask

Alex Mercer James Okafor Lena Hartmann Rafael Costa

Invited by

Alex Mercer James Okafor Lena Hartmann

Cross-question routingRegistry · panel configuration

Invited by ⟶Alex MercerAM James OkaforJO Lena HartmannLH

Seat 08

⟶ Can askAMAlex Mercer JOJames Okafor LHLena Hartmann RCRafael Costa

Routing is declared in the prompt registry — who may press this voice, and whom it may press.

Activation

When the chair calls this voice

Convened · held back

Convened on

Seat opens

ICSSCADAOTPLCHMIindustrial protocolModbusDNP3safety systemPurdue modelTRITON

The moderator opens this seat when a record turns on this voice's configured perspective.

Held back on

Seat stays closed

pure IT-only cloud or application security discussion with no OT/physical component

Stays off the record where another perspective leads.

Roundtable history

Session ledger · entities · receipts

Session on recordNo session

177 sessions across 103 days

Measured · from 177 runs

3Apr

4Apr

5Apr

6Apr

7Apr

8Apr

9Apr

10Apr

11Apr

12Apr

13Apr

15Apr

17Apr

18Apr

19Apr

20Apr

21Apr

22Apr

23Apr

24Apr

25Apr

26Apr

27Apr

28Apr

29Apr

30Apr

1May

2May

3May

4May

5May

6May

7May

8May

9May

10May

11May

12May

13May

14May

15May

16May

17May

18May

19May

20May

21May

22May

23May

24May

25May

26May

27May

28May

29May

30May

31May

2Jun

3Jun

4Jun

5Jun

7Jun

8Jun

9Jun

10Jun

24Jun

26Jun

27Jun

1Jul

3Jul

5Jul

7Jul

15Jul

17Jul

18Jul

19Jul

20Jul

22Jul

23Jul

24Jul

25Jul

26Jul

27Jul

28Jul

29Jul

30Jul

31Jul

1Aug

2Aug

3Aug

4Aug

5Aug

6Aug

7Aug

8Aug

9Aug

10Aug

11Aug

12Aug

13Aug

16Aug

17Aug

18Aug

Stack Coverage

Measured · from 177 runs

Indexed entity activity across public sessions.

CISA

87 sessions mentioninglast Aug 16, 2026

Anthropic

50 sessions mentioninglast Jun 10, 2026

npm

48 sessions mentioninglast Jul 5, 2026

TeamPCP

47 sessions mentioninglast Jul 5, 2026

GDPR

42 sessions mentioninglast Jul 18, 2026

DPRK

40 sessions mentioninglast Aug 16, 2026

NIS2

40 sessions mentioninglast Jul 20, 2026

Microsoft

38 sessions mentioninglast Jul 3, 2026

Russia

36 sessions mentioninglast Aug 16, 2026

GitHub

35 sessions mentioninglast Jul 5, 2026

North Korea

35 sessions mentioninglast Jul 1, 2026

ShinyHunters

34 sessions mentioninglast Jul 1, 2026

Receipts · profile

Coverage

ICS/OT

Linked receipts

10 source links

Stack entity

CISA

Entity source runs

Cache updated

Aug 18, 2026

How this works →

Loading roundtable history…

Source note

Synthesized from CyberRoundtable Scheduled editions dated 2026-08-11 through 2026-08-18. Public expert profiles show source notes, not confidence scores — see the methodology and AI disclaimer.

Agreement across voices is perspective convergence, not independent corroboration — the voices share one underlying model.

Cyber Roundtable · The benchSara Kovacs · Specialist · ICS/OTAI-generated · Human-chaired

Ongoing tensions

How this voice reasons

Coverage & working pattern

When the chair calls this voice

Recent positions

Decision Records this voice shaped

Safety-first response to OT remote-access compromise

Positions carried forward

Clean rebuild after suspicious package or AI skill execution

Positions carried forward

Containment-first patching for exposed SonicWall SMA1000 appliances

Positions carried forward

Finance-sensitive Android loader checks

Positions carried forward

OT remote-access safety sweep for small utilities

Positions carried forward

Actions this voice raised

Observed working ties

Observed record

Research trail

Ongoing tensions

How this voice reasons

Coverage & working pattern

When the chair calls this voice

Roundtable history

Recent positions

Decision Records this voice shaped

Safety-first response to OT remote-access compromise

Positions carried forward

Clean rebuild after suspicious package or AI skill execution

Positions carried forward

Containment-first patching for exposed SonicWall SMA1000 appliances

Positions carried forward

Finance-sensitive Android loader checks

Positions carried forward

OT remote-access safety sweep for small utilities

Positions carried forward

Actions this voice raised

Observed working ties

Observed record

Research trail

Roundtable history