Show Notes
Most breaches don't need clever hacking: someone logs in with real credentials. Sami Laiho and Mikael Nyström (Truesec incident response) on why, what to do in the first hour, and which security measures are pure theater.
In this episode - Why 'they don't hack, they log in' is how most incidents really start - Windows 11 isn't secure by default until you configure and harden it - Attackers specialise in one weakness and try it everywhere - The first hour after the phone rings: assume breach, don't reboot, pull cables, cut outbound internet - A recovery plan fits on one page, and IT needs a 'wartime' mode - The controls that matter most: privileged access workstations, no password reuse, no admin rights for developers - Why remote tools are risky and RDP gives you logs - Security theater: BitLocker as your main control and expensive 'AI' firewalls
Chapters 00:00 Welcome: Sami Laiho and Mikael Nyström 05:02 They don't hack, they log in 07:35 Is Windows 11 secure by default? 16:19 The first hour after the call 20:09 A recovery plan on one page 22:26 One control: separate admin devices 23:53 Admin rights and developers 28:56 Security theater 33:08 Why does your DC need internet? 36:52 The hilarious history of Windows
Guests Sami Laiho – Microsoft MVP, Adminize Workplace Ninja Summit 2026: 11 Ways to Hack Windows 11 (Tue 15 Sep 14:30, Trafohall) · Hilarious History of Windows (Tue 15 Sep 17:00, Trafohall) · Keynote: Cybersecurity from Disabler to Enabler (Wed 16 Sep 09:50, Trafohall)
Mikael Nyström – Incident response (CSIRT), Truesec Workplace Ninja Summit 2026: IT disaster bootcamp (Wed 16 Sep 13:10, Glassaal, with Andreas Hammarskjöld) · You Don't Get Hacked — They Log In (Thu 17 Sep 13:10, Trafohall)
Hosts Frans Oudendorp & Peter Daalmans
Recorded at Workplace Ninja Summit 2026 in Baden, Switzerland.
Follow the Workplace Ninja Summit Website: https://summit.wpninjas.global LinkedIn: https://www.linkedin.com/company/wpninjasummit X: https://x.com/wpninjasummit Instagram: https://www.instagram.com/wpninjasummit/
#WPNinjaSummit #CyberSecurity #IncidentResponse
More from Workplace Ninja Summit
Why does a commercial vendor keep giving tools away? Ben Ward, Field CTO UK & Ireland at Recast Software, on Right Click Tools Community, OSDCloud and why application management is still the hard part.
Why do Windows updates and device recovery belong in one conversation? Lia Vargas (Windows recovery) and Mounica Battula (Windows Autopatch) from Microsoft explain how they keep devices current, and what happens when an update goes wrong.
Itay Peled (Project Perception) and Yuri Diogenes (Defender for Cloud) on the two sides of AI in security: using AI to defend, and securing the AI everyone is deploying. Recorded live at Workplace Ninja Summit 2026 with Frans Oudendorp and Alex Verboon.
The Ninja BE organizing team — Nicky, Kenny, and Dieter — take the stage to explain what the Ninja BE user group is all about: its mission, community, and what members can expect from future events. 📍 Recorded live at the Ninja BE User Group Event, June 4, 2026 (Belgium) #NinjaBE #UserGroup #Community #ITCommunity #Belgium
Joeri Kumbruck and Jon Jarvis explore the world of Windows 365 and Azure Virtual Desktop (AVD), covering the latest features, use cases, and best practices for deploying cloud PCs and virtual desktop environments in the modern workplace. 📍 Recorded live at the Ninja BE User Group Event, June 4, 2026 (Belgium) #Windows365 #AVD #AzureVirtualDesktop #CloudPC #Microsoft365 #NinjaBE