Most breaches don't need clever hacking: someone logs in with real credentials. Sami Laiho and Mikael Nyström (Truesec incident response) on why, what to do in the first hour, and which security measures are pure theater.
In this episode
- Why 'they don't hack, they log in' is how most incidents really start
- Windows 11 isn't secure by default until you configure and harden it
- Attackers specialise in one weakness and try it everywhere
- The first hour after the phone rings: assume breach, don't reboot, pull cables, cut outbound internet
- A recovery plan fits on one page, and IT needs a 'wartime' mode
- The controls that matter most: privileged access workstations, no password reuse, no admin rights for developers
- Why remote tools are risky and RDP gives you logs
- Security theater: BitLocker as your main control and expensive 'AI' firewalls
Chapters
00:00 Welcome: Sami Laiho and Mikael Nyström
05:02 They don't hack, they log in
07:35 Is Windows 11 secure by default?
16:19 The first hour after the call
20:09 A recovery plan on one page
22:26 One control: separate admin devices
23:53 Admin rights and developers
28:56 Security theater
33:08 Why does your DC need internet?
36:52 The hilarious history of Windows
Guests
Sami Laiho – Microsoft MVP, Adminize
Workplace Ninja Summit 2026: 11 Ways to Hack Windows 11 (Tue 15 Sep 14:30, Trafohall) · Hilarious History of Windows (Tue 15 Sep 17:00, Trafohall) · Keynote: Cybersecurity from Disabler to Enabler (Wed 16 Sep 09:50, Trafohall)
Mikael Nyström – Incident response (CSIRT), Truesec
Workplace Ninja Summit 2026: IT disaster bootcamp (Wed 16 Sep 13:10, Glassaal, with Andreas Hammarskjöld) · You Don't Get Hacked — They Log In (Thu 17 Sep 13:10, Trafohall)
Hosts
Frans Oudendorp & Peter Daalmans
Recorded at Workplace Ninja Summit 2026 in Baden, Switzerland.
Follow the Workplace Ninja Summit
Website: https://summit.wpninjas.global
LinkedIn: https://www.linkedin.com/company/wpninjasummit
X: https://x.com/wpninjasummit
Instagram: https://www.instagram.com/wpninjasummit/
#WPNinjaSummit #CyberSecurity #IncidentResponse
