Discussion points for the staff meeting
- Out-of-support systems. Do we have anything still running past its support date, the way Fjordnett ran FN-SRV03? Who owns the decision to retire it, and is there a real date for it, or only a someday?
- Service and admin accounts. Do we know every automated account and every admin account we have, why each one exists, and when its password was last changed? Which ones would we struggle to explain?
- Patch latency. How long does it actually take us to install a security update after it is released, and what, honestly, gets in the way?
- Tampered alarms. If someone quietly silenced our security alerts (a mailbox rule, a disabled check), how long would it take anyone to notice? Who watches the watchers?
- Surviving without the system. If our systems went dark tomorrow, how would our customers, and our own work, cope for a day? Is there a paper fallback, and have we ever actually tested it?
- What we ship and install. How much do we trust the components and updates that flow into what we build or run? Could a malicious change ride into a release without a human ever noticing?
- AI-enabled deception. Would we recognise an AI-written phishing message, or a too-patient stranger offering help at exactly the right moment? What would make us stop and get suspicious?
- Room to ask for help. Would a colleague in financial or personal trouble feel able to say so here, before someone outside the company found out first, and offered to help with strings attached?