Loading expert overview…

Loading recent positions…

Loading Decision Records…

Loading actions…

Loading working ties…

Loading research trail

Panel dynamics

Ongoing tensions

4 open · 2 peers

⇄ with Lena Hartmannopen

Cisco Secure Email Gateway CVE-2026-76461 leads: Cisco confirms active exploitation enabling unauthenticated root execution, and CISA KEV...

Vale · Identity

Hartmann

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Disagreement on "Whether active exploitation of GitLab CVE-2026-85706 was sufficiently established": identity_architect: Current reporting supports describing CVE-2026-85706 as actively exploited with public exploit code. vs intel_analyst: Active exploitation...Read moreShow less

Source · Sep 16, 2026 afternoon roundtable

⇄ with Panelopen

Today’s response priority is active exploitation of management planes and exposed app stacks, not another full FortiBleed rehash.

Vale · Identity

Panel

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Disagreement on "Whether phishing-resistant authentication meaningfully solves device-code phishing": identity_architect: Explicitly corrected an earlier overbroad implication and narrowed the claim to say passkeys reduce credential replay and AiTM phishing...Read moreShow less

Source · Jun 25, 2026 morning roundtable

⇄ with Lena Hartmannopen

Today's briefing surface was dominated by recycled items — TrapDoor, CISA GovCloud, Kali365 — all thoroughly covered in prior sessions.

Vale · Identity

Hartmann

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Disagreement on "Whether Tycoon 2FA and Kali365 represent the same or distinct threat actor clusters": identity_architect: Assessed the two as distinct operations — Tycoon retrofitted device code into an existing mature PhaaS platform, while Kali365 was purpose-built for device code — with no evidence of shared infrastructure or developer overlap. vs intel_analyst: Confirmed distinct actor clusters for Kali365 vs Tycoon at moderate confidence, while separately assessing Tycoon's post-takedown pivot as the same operator cluster evolving technique rather than a new actor.

Source · May 27, 2026 morning roundtable

⇄ with Lena Hartmannopen

Today's afternoon session surfaced three genuinely new threats that the morning briefing underweighted, plus connected a major AiTM...

Vale · Identity

Hartmann

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Disagreement on "AiTM campaign attribution": intel_analyst: Lena Hartmann assessed the campaign as likely Storm-2755 or an unnamed financially motivated cluster running commodity PhaaS infrastructure, at low confidence for nation-state involvement. vs identity_architect: Marcus Vale focused on defensive architecture implications without contesting attribution, but noted the sector concentration (healthcare, financial, professional services) suggested targeted rather than purely opportunistic selection.

Source · May 5, 2026 afternoon roundtable

Voice / stance

How this voice reasons

5 traits

Tell (configured response habit) 01

Thinks in trust chains and trust boundaries.

Tell (configured response habit) 02

Draws invisible diagrams of token flow in his head.

Tell (configured response habit) 03

Paranoid about session management to a degree others find excessive.

Tell (configured response habit) 04

Treats identity as the primary security perimeter.

Tell (configured response habit) 05

Treats every authentication flow as an attack surface.

From the panel configuration (prompt-registry quirks, not transcript-mined traits).

Expertise & connections

Coverage & working pattern

Lens and routing registry · Registry · panel configuration

Primary categories

Identity

Secondary categories

CloudBreach response

Tools

Threat searchWeb search

Can ask

Alex Mercer James Okafor Priya Natarajan

Invited by

Alex Mercer James Okafor Priya Natarajan

Cross-question routingRegistry · panel configuration

Invited by ⟶Alex MercerAM James OkaforJO Priya NatarajanPN

Seat 09

⟶ Can askAMAlex Mercer JOJames Okafor PNPriya Natarajan

Routing is declared in the prompt registry — who may press this voice, and whom it may press.

Activation

When the chair calls this voice

Convened · held back

Convened on

Seat opens

OAuthSAMLMFA bypasscredential stuffingsession hijackingtoken abusefederationSSOidentity providerEntra IDOkta

The moderator opens this seat when a record turns on this voice's configured perspective.

Held back on

Seat stays closed

pure malware analysis with no identity componentICS/OT discussions without authentication element

Stays off the record where another perspective leads.

Loading roundtable history…

Source note

Profile synthesized from the supplied Scheduled CyberRoundtable briefings dated October 14–21, 2026. Recent scheduled evidence is weighted most heavily. Public expert profiles show source notes, not confidence scores — see the methodology and AI disclaimer.

Agreement across voices is perspective convergence, not independent corroboration — the voices share one underlying model.

Cyber Roundtable · The benchMarcus Vale · Specialist · IdentityAI-generated · Human-chaired

Opening expert dossier

Loading the public profile first; record-backed sections will follow as they become available.

Session activity · on public record227

Seat09 · Bench

Tier (panel role)Specialist expert

Lens (configured perspective)Identity

Specialist expert · Identity lens (configured specialist perspective)

Marcus Vale

Identity security lens

Looks for authentication, federation, session, credential, and trust-chain failure modes behind an incident or vulnerability.

Positions carried into 317 Decision Records

Specialist expertIdentity7 observed ties · Measured · from 404 runsMethodology →AI Disclaimer →

227

Public session
contributions

Stance
revisions

317

Decision Records
shaped

Loading expert overview…

On the record

Recent positions

5 on the record · public scheduled editions only · Oct 18, 2026 — Oct 21, 2026

2026.10.18Morning roundtable
2026.10.19Morning roundtable
2026.10.20Afternoon roundtable
2026.10.21Morning roundtable
2026.10.21Afternoon roundtable

Afternoon roundtable · 2026.10.21Afternoon roundtable →
CVE-2026-0257 is the immediate priority: exposed GlobalProtect systems require patching and retrospective compromise assessment because...
Marcus Vale located the CVE-2026-0257 trust failure at the GlobalProtect gateway rather than automatically at the IdP. Recovery must invalidate gateway-derived sessions, cookies, certificates, and downstream identity artifacts. Key claims: Password and MFA...Read moreShow less
Marcus Vale located the CVE-2026-0257 trust failure at the GlobalProtect gateway rather than automatically at the IdP. Recovery must invalidate gateway-derived sessions, cookies, certificates, and downstream identity artifacts. Key claims: Password and MFA resets alone do not remove forged authentication-override cookies or existing GlobalProtect sessions.; Each VPN session should be correlated with an actual IdP, RADIUS, or LDAP event, with unmatched successful sessions presumed forged.
Source
Oct 21, 2026 afternoon roundtable
Morning roundtable · 2026.10.21Morning roundtable →
Palo Alto Networks Unit 42 reports active exploitation of CVE-2026-0257, and the briefing says CISA added it to KEV; exposed...
Marcus Vale located the trust failure at the GlobalProtect gateway rather than necessarily at the IdP. Recovery requires stopping unsafe cookie trust, terminating existing sessions, replacing reused certificate material, and correlating VPN access with...Read moreShow less
Marcus Vale located the trust failure at the GlobalProtect gateway rather than necessarily at the IdP. Recovery requires stopping unsafe cookie trust, terminating existing sessions, replacing reused certificate material, and correlating VPN access with independent identity evidence. Key claims: CVE-2026-0257 can create a plausible username-bearing VPN session without proving theft of the user's password, MFA factor, IdP session, or IdP signing key.; Password rotation alone does not revoke forged authentication cookies or established VPN tunnels.
Source
Oct 21, 2026 morning roundtable
Afternoon roundtable · 2026.10.20Afternoon roundtable →
According to reporting in the handoff, UNC5820’s Fortinet intrusion crossed from vulnerability management into integrity failure:...
Marcus Vale rejected voice callbacks and same-path dual approval as sufficient payment controls. He required independent beneficiary enrollment, phishing-resistant identities, separation of duties, and cryptographic binding of approvals to transaction...Read moreShow less
Marcus Vale rejected voice callbacks and same-path dual approval as sufficient payment controls. He required independent beneficiary enrollment, phishing-resistant identities, separation of duties, and cryptographic binding of approvals to transaction details. Key claims: Voice, WhatsApp, email, and similar messaging channels may trigger scrutiny but must not authorize payment.; Each payment approval must be bound to the displayed beneficiary, account, amount, currency, and execution date using hardware-backed or phishing-resistant credentials.; Beneficiary changes require independent account-ownership verification, separate approval, a cooling period, and first-payment limits.
Source
Oct 20, 2026 afternoon roundtable
Morning roundtable · 2026.10.19Morning roundtable →
BeyondTrust CVE-2026-102764 is today’s default first priority because exploitation progressed to privilege escalation, lateral movement,...
Marcus Vale characterized ConnectWise as an app-only identity compromise that bypasses user MFA and may leave tenant-local persistence. Recovery must preserve evidence and enumerate credentials, grants, owners, roles, and application objects beyond the...Read moreShow less
Marcus Vale characterized ConnectWise as an app-only identity compromise that bypasses user MFA and may leave tenant-local persistence. Recovery must preserve evidence and enumerate credentials, grants, owners, roles, and application objects beyond the identities disabled by the vendor. Key claims: The safe conclusion is compromise of vendor-managed application credentials, not a proven single credential type.; User MFA does not protect the app-only trust path used in the ConnectWise incident.; Disabling vendor identities and revoking certificates does not remove attacker-created tenant credentials, grants, owners, or role assignments.
Source
Oct 19, 2026 morning roundtable
Morning roundtable · 2026.10.18Morning roundtable →
Confirmed compromise outranks product-level severity: web shells, unauthorized administrators, lost appliance integrity, or...
Marcus Vale characterized ConnectWise as an app-only identity compromise in which user MFA was never invoked, requiring persistence tracing beyond disabling the original principal. He also emphasized that DMARC success does not establish benign message...Read moreShow less
Marcus Vale characterized ConnectWise as an app-only identity compromise in which user MFA was never invoked, requiring persistence tracing beyond disabling the original principal. He also emphasized that DMARC success does not establish benign message intent. Key claims: ConnectWise app-only permissions may have bypassed the user-authentication path entirely, and disabling the original service principal does not remove attacker-created persistence.; A compromised authorized WordPress/Exim host can pass DMARC while delivering malicious content.
Source
Oct 18, 2026 morning roundtable

Loading recent positions…

Accountability trail

Decision Records this voice shaped

317 Decision Records

Showing 1–5 of 317

Loading Decision Records…

Operational trail

Actions this voice raised

8 public actions in recent scan

Count reflects the bounded recent-session scan window, not ACM New status. Continuity chips (when present) come from the published Action Continuity Model.

CriticalRotate administrative credentials, VPN secrets, API tokens, private keys, and certificates exposed through affected Fortinet management systems.
UpdatedFortinetFortiGateFortiManagerCVE-2025-61624KEVCVE-2026-102764KEV
CriticalAudit ConnectWise-integrated Entra tenants for app-only sign-ins, unauthorized credentials, consent grants, ownership changes, and privileged role assignments; preserve evidence before disabling persistence.
UpdatedMicrosoft EntraMicrosoft 365Microsoft Graph
CriticalFor ConnectWise Cloud Backup-connected Microsoft 365 tenants, preserve Entra evidence, verify exposure, disable and revoke the implicated application identity if confirmed, and investigate credentials, principals, grants, or roles created during the exposure window.
NewConnectWise Cloud BackupMicrosoft 365Microsoft EntraMicrosoft Graph
MediumQuarantine messages matching the compromised WordPress/Exim infrastructure regardless of DMARC results, identify recipients, and investigate execution of the linked installer.
NewWordPressEximDMARC
CriticalIsolate affected Ivanti Connect Secure appliances, preserve external telemetry, rebuild compromised systems, and then rotate credentials, certificates, sessions, and federation trust.
UpdatedIvanti Connect SecureCVE-2026-104935KEV
MediumWhen Aoki is suspected, isolate and reimage the developer workstation, revoke repository, AI-assistant, cloud, and CI/CD sessions from a clean system, and audit downstream commits, builds, artifacts, and releases.
NewAWSClaudeCodexCursorCodeiumGeminiGitHub CopilotJetBrains AI AssistantKiro
CriticalRemediate affected BeyondTrust Remote Support deployments; isolate and rebuild suspected compromises, then replace all exposed credentials, sessions, certificates, keys, and API tokens.
NewBeyondTrust Remote SupportCVE-2026-102764KEV
CriticalApply Palo Alto Networks remediation, remove PAN-OS management interfaces from untrusted networks, review privileged authentication, and rebuild plus rotate exposed management trust if root execution is detected.
NewPalo Alto NetworksPAN-OSCVE-2026-0322KEV

Loading actions…

Panel dynamics

Observed working ties

Observed record

Successful cross-questions between specialist voices. Chair routing is reported separately.

Measured · from 404 runs

7Observed peers

23Questions asked

12Questions received

201Runs with activity

James Okafor

→ Asked James Okafor 20× on record← Asked by James Okafor 5× on record

Priya Natarajan

→ Asked Priya Natarajan 1× on record← Asked by Priya Natarajan 4× on record

Viktor Petrov

→ Asked Viktor Petrov 1× on record← Asked by Viktor Petrov 0× on record

Tomas Ilic

→ Asked Tomas Ilic 1× on record← Asked by Tomas Ilic 0× on record

Pierre Lefevre

→ Asked Pierre Lefevre 0× on record← Asked by Pierre Lefevre 1× on record

Sofia Andersen

→ Asked Sofia Andersen 0× on record← Asked by Sofia Andersen 1× on record

Alex Mercer

→ Asked Alex Mercer 0× on record← Asked by Alex Mercer 1× on record

Chair route234 invitations across 197 runs

Moderator invitations are not counted as peer ties.

Loading working ties…

Working method

Research trail

Measured · from 198 runs

Total searches: 285
Sources consulted: 4906
Sources cited: 873
Runs covered: 198

Loading research trail

Panel dynamics

Ongoing tensions

4 open · 2 peers

⇄ with Lena Hartmannopen

Cisco Secure Email Gateway CVE-2026-76461 leads: Cisco confirms active exploitation enabling unauthenticated root execution, and CISA KEV...

Vale · Identity

Hartmann

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Source · Sep 16, 2026 afternoon roundtable

⇄ with Panelopen

Today’s response priority is active exploitation of management planes and exposed app stacks, not another full FortiBleed rehash.

Vale · Identity

Panel

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Source · Jun 25, 2026 morning roundtable

⇄ with Lena Hartmannopen

Today's briefing surface was dominated by recycled items — TrapDoor, CISA GovCloud, Kali365 — all thoroughly covered in prior sessions.

Vale · Identity

Hartmann

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Source · May 27, 2026 morning roundtable

⇄ with Lena Hartmannopen

Today's afternoon session surfaced three genuinely new threats that the morning briefing underweighted, plus connected a major AiTM...

Vale · Identity

Hartmann

Divergence shown — balance not scored. The bar is a neutral motif, not a measured split.

Source · May 5, 2026 afternoon roundtable

Voice / stance

How this voice reasons

5 traits

Tell (configured response habit) 01

Thinks in trust chains and trust boundaries.

Tell (configured response habit) 02

Draws invisible diagrams of token flow in his head.

Tell (configured response habit) 03

Paranoid about session management to a degree others find excessive.

Tell (configured response habit) 04

Treats identity as the primary security perimeter.

Tell (configured response habit) 05

Treats every authentication flow as an attack surface.

From the panel configuration (prompt-registry quirks, not transcript-mined traits).

Expertise & connections

Coverage & working pattern

Lens and routing registry · Registry · panel configuration

Primary categories

Identity

Secondary categories

CloudBreach response

Tools

Threat searchWeb search

Can ask

Alex Mercer James Okafor Priya Natarajan

Invited by

Alex Mercer James Okafor Priya Natarajan

Cross-question routingRegistry · panel configuration

Invited by ⟶Alex MercerAM James OkaforJO Priya NatarajanPN

Seat 09

⟶ Can askAMAlex Mercer JOJames Okafor PNPriya Natarajan

Routing is declared in the prompt registry — who may press this voice, and whom it may press.

Activation

When the chair calls this voice

Convened · held back

Convened on

Seat opens

OAuthSAMLMFA bypasscredential stuffingsession hijackingtoken abusefederationSSOidentity providerEntra IDOkta

The moderator opens this seat when a record turns on this voice's configured perspective.

Held back on

Seat stays closed

pure malware analysis with no identity componentICS/OT discussions without authentication element

Stays off the record where another perspective leads.

Roundtable history

Session ledger · entities · receipts

Session on recordNo session

227 sessions across 128 days

Measured · from 227 runs

6Apr

22Apr

27Apr

28Apr

29Apr

30Apr

5May

9May

10May

18May

20May

24May

25May

26May

27May

28May

30May

5Jun

8Jun

21Jun

22Jun

25Jun

26Jun

27Jun

28Jun

29Jun

30Jun

1Jul

2Jul

3Jul

4Jul

5Jul

6Jul

7Jul

8Jul

9Jul

10Jul

11Jul

12Jul

13Jul

14Jul

15Jul

16Jul

17Jul

18Jul

19Jul

20Jul

21Jul

22Jul

23Jul

24Jul

25Jul

26Jul

27Jul

29Jul

30Jul

1Aug

2Aug

4Aug

5Aug

6Aug

7Aug

8Aug

9Aug

10Aug

11Aug

12Aug

13Aug

14Aug

15Aug

16Aug

17Aug

18Aug

19Aug

20Aug

21Aug

22Aug

23Aug

24Aug

25Aug

26Aug

27Aug

28Aug

29Aug

30Aug

31Aug

1Sep

2Sep

3Sep

4Sep

5Sep

6Sep

7Sep

8Sep

9Sep

10Sep

11Sep

12Sep

13Sep

14Sep

15Sep

16Sep

17Sep

18Sep

24Sep

25Sep

27Sep

28Sep

29Sep

30Sep

1Oct

2Oct

3Oct

4Oct

6Oct

7Oct

8Oct

9Oct

10Oct

11Oct

13Oct

14Oct

15Oct

16Oct

18Oct

19Oct

20Oct

21Oct

Stack Coverage

Measured · from 227 runs

Indexed entity activity across public sessions.

CISA

35 sessions mentioninglast Aug 25, 2026

GDPR

27 sessions mentioninglast Jul 20, 2026

GitHub

23 sessions mentioninglast Jul 20, 2026

npm

22 sessions mentioninglast Jul 20, 2026

OAuth

22 sessions mentioninglast Jul 20, 2026

Microsoft

20 sessions mentioninglast Aug 25, 2026

NIS2

20 sessions mentioninglast Aug 25, 2026

SEC

18 sessions mentioninglast Jul 20, 2026

Microsoft 365

17 sessions mentioninglast Jul 20, 2026

NVD

17 sessions mentioninglast Jul 20, 2026

TeamPCP

17 sessions mentioninglast Jul 20, 2026

AWS

16 sessions mentioninglast Aug 25, 2026

Receipts · profile

Coverage

Identity

Linked receipts

10 source links

Stack entity

CISA

Entity source runs

Cache updated

Oct 21, 2026

How this works →

Loading roundtable history…

Source note

Agreement across voices is perspective convergence, not independent corroboration — the voices share one underlying model.

Cyber Roundtable · The benchMarcus Vale · Specialist · IdentityAI-generated · Human-chaired

Ongoing tensions

How this voice reasons

Coverage & working pattern

When the chair calls this voice

Recent positions

Decision Records this voice shaped

Constrain exposed AI agents with conventional intrusion controls

Positions carried forward

Audit and contain cloud billing hijacking

Positions carried forward

Validate critical-service recovery through an isolated restoration

Positions carried forward

Model AI as an Accelerator of Conventional Cloud Compromise

Positions carried forward

Risk-Based Post-Patch Validation

Positions carried forward

Actions this voice raised

Observed working ties

Observed record

Research trail

Ongoing tensions

How this voice reasons

Coverage & working pattern

When the chair calls this voice

Roundtable history

Recent positions

Decision Records this voice shaped

Constrain exposed AI agents with conventional intrusion controls

Positions carried forward

Audit and contain cloud billing hijacking

Positions carried forward

Validate critical-service recovery through an isolated restoration

Positions carried forward

Model AI as an Accelerator of Conventional Cloud Compromise

Positions carried forward

Risk-Based Post-Patch Validation

Positions carried forward

Actions this voice raised

Observed working ties

Observed record

Research trail

Roundtable history