They Don't Hack, They Log In | With Sami Laiho & Mikael Nyström

Most breaches don't need clever hacking: someone logs in with real credentials. Sami Laiho and Mikael Nyström (Truesec incident response) on why, what to do in the first hour, and which security measures are pure theater.

In this episode

- Why 'they don't hack, they log in' is how most incidents really start

- Windows 11 isn't secure by default until you configure and harden it

- Attackers specialise in one weakness and try it everywhere

- The first hour after the phone rings: assume breach, don't reboot, pull cables, cut outbound internet

- A recovery plan fits on one page, and IT needs a 'wartime' mode

- The controls that matter most: privileged access workstations, no password reuse, no admin rights for developers

- Why remote tools are risky and RDP gives you logs

- Security theater: BitLocker as your main control and expensive 'AI' firewalls

Chapters

00:00 Welcome: Sami Laiho and Mikael Nyström

05:02 They don't hack, they log in

07:35 Is Windows 11 secure by default?

16:19 The first hour after the call

20:09 A recovery plan on one page

22:26 One control: separate admin devices

23:53 Admin rights and developers

28:56 Security theater

33:08 Why does your DC need internet?

36:52 The hilarious history of Windows

Guests

Sami Laiho – Microsoft MVP, Adminize

Workplace Ninja Summit 2026: 11 Ways to Hack Windows 11 (Tue 15 Sep 14:30, Trafohall) · Hilarious History of Windows (Tue 15 Sep 17:00, Trafohall) · Keynote: Cybersecurity from Disabler to Enabler (Wed 16 Sep 09:50, Trafohall)

Mikael Nyström – Incident response (CSIRT), Truesec

Workplace Ninja Summit 2026: IT disaster bootcamp (Wed 16 Sep 13:10, Glassaal, with Andreas Hammarskjöld) · You Don't Get Hacked — They Log In (Thu 17 Sep 13:10, Trafohall)

Hosts

Frans Oudendorp & Peter Daalmans

Recorded at Workplace Ninja Summit 2026 in Baden, Switzerland.

Follow the Workplace Ninja Summit

Website: https://summit.wpninjas.global

LinkedIn: https://www.linkedin.com/company/wpninjasummit

X: https://x.com/wpninjasummit

Instagram: https://www.instagram.com/wpninjasummit/

#WPNinjaSummit #CyberSecurity #IncidentResponse