Threat Talks - Your Gateway to Cybersecurity Insights
Threat Talks is your cybersecurity knowledge hub. Unpack the latest threats and explore industry trends with top experts as they break down the complexities of cyber threats. We make complex cybersecurity topics accessible and engaging for everyone, from IT professionals to every day internet users by providing in-depth and first-hand experiences from leading cybersecurity professionals. Join us for monthly deep dives into the dynamic world of cybersecurity, so you can stay informed, and stay secure!
10
How to Prove to Your Board That Zero Trust Is Working
<p>Your board wants to know one thing: are we safer than last year? Alert counts can't answer that. Twice as many events can mean twice as many attacks, or a sensor that finally works. Lieuwe Jan Koning, Co-founder & CTO at ON2IT, asks Rob Maas, Field CTO at ON2IT, what to report instead: one score from one to five that shows whether the business is aligned behind Zero Trust and whether the controls are really in place. Black-and-white criteria, so nobody can polish the number before the board meeting.</p><p></p>(00:00) - The one metric worth reporting...
Citrix NetScaler Zero-Day: Three Weeks Without a Patch
<p>Citrix left customers exposed to two live zero-days for three and a half weeks. Rob Maas sits down with ON2IT CTI specialist Lars Nobelen to break down how attackers exploited CVE-2026-88771 and CVE-2026-88772 on Citrix NetScaler appliances, why a single log injection bug let them run arbitrary commands, and what actually stopped the attacks before the patch ever arrived.</p><p></p>(00:00) - Cold open: three and a half weeks without a patch (00:19) - Meet CTI specialist Lars Nobelen (01:28) - Exploitation timeline: fingerprinting in August to the patch in September (03:09) - Two zero-days: how the log...
Stolen iPhone, Tracked Live, Thief Caught
<p>Fifteen minutes after Lars Nobelen's iPhone was stolen at a scrapyard, it was already useless to the men holding it. An hour after that, police had all three of them in custody. Lieuwe Jan Koning talks with Lars Nobelen, ON2IT's Information Security Officer, and Robbert van der Linden, Site Reliability Engineer, about the mobile device management commands that turned a stolen phone into the evidence that caught its own thief.</p><p>Key Topics Covered</p>How mobile device management (MDM) locks and tracks a stolen iPhone through Apple's Lost ModeWhy police can act on a stationary phone...
When to call the Police when you're hacked
<p>Do first you call the police when you're hacked, or a lawyer?</p><p>In this episode of Threat Talks, host Lieuwe Jan Koning sits down with Stan Duijf, Head of Operations at the NIS (National Investigations Special Operations) of the Dutch National Police, to break down what actually happens after a data breach. Stan reveals that only 20% of the 150+ reported Dutch data breaches each year ever reach the police, and explains why that gap puts both companies and their customers at risk.</p><p>They cover when a breach is serious enough to call the police, why paying...
Will The Police Ever Catch Your Attacker?
<p>You report a breach. Does anyone ever get arrested?</p><p>Stan Duijf, Head of Operations at the NIS, the Dutch National Police unit for national and international investigations, sits down with Lieuwe Jan Koning, Co-founder & CTO at ON2IT, to explain what actually happens on the other side of a cyberattack. One case can span 5 to 20 countries. Arrests are rare, so his team measures something else: how expensive they make crime to run. Takedowns, seized servers, 35 million euros in seized crypto, sanctions, and Operation Endgame, a campaign that hits the same criminal infrastructure twice a year. Arrests still...
MDR Has To Stop Mopping The Floor
<p>A CISO got breached and could not say how. No entry point, no list of what walked out, nothing to take to the board. He paid the ransom blind. Then he bought MDR.</p><p>The next time, he had all of it. Who clicked, which data was touched, when it left. He still got breached.</p><p>So what did the M in MDR actually buy him?</p><p>Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down at RSA Conference with Nicholai Piagentini, Technical Enablement Engineer at ON2IT and twenty years deep in the Bay...
Lapsus$:Teenagers Hacked Microsoft.
<p>A group of teenagers walked into Microsoft, NVIDIA and Okta. No zero-days. No custom malware. No command and control infrastructure. They bought leaked credentials, or they called the service desk and asked for a password reset.</p><p>Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with threat researcher Yuri Wit and Field CTO Rob Maas to take Lapsus$ apart step by step: bought credentials, MFA fatigue, over-permissioned accounts, and the extortion payday at the end.</p><p>The uncomfortable part is not how clever the attack was. It is how basic it was. If your help...
How a 19-Year-Old Hacked the NEWS Without Breaking In
<p>Your Outlook account recovery will accept an authenticator code on its own. No password, no inbox, no phone number. <br>Anyone holding that TOTP secret owns the account, and the second factor you bought to survive credential theft becomes the only thing in the way.</p><p>Koen Kandelaars found one sitting in a PDF on a public help page at the NOS, the largest news organization in the Netherlands. He scanned a QR code out of an onboarding manual and had a real employee's second factor on his phone. </p><p>Rob Maas, Field CTO at ON2IT, wa...
The End of Reactive Security
<p>You already had the threat intel. The IP was on your blocklist, the file hash was known bad. So why did your MDR only raise an alert instead of blocking it? Lieuwe Jan Koning, Co-founder & CTO at ON2IT, and colleague Nicholai Piagentini, Technical Enablement Engineer at ON2IT, make the case for preemptive cybersecurity: the shift from detect-and-clean-up to block-first, and what it means for the future of MDR.</p><p><br>Timestamps:</p><p></p>(00:00) - Preemptive cybersecurity: what it means for MDR (00:59) - Why detect-and-clean-up is not enough (the leaking tap) (01:42) - You knew the threat...
NIST CSF 2.0: No CISO, No Excuse
<p>The new NIST Cybersecurity Framework 2.0 is out, and most teams still ask the same question: what do I do tomorrow? Lieuwe Jan Koning sits down with NIST's Amy Mahn and Daniel Elliott to turn the framework into a concrete next step. Governance is now its own function. Profiles tell you where you are and where you need to be. And the Quick Start Guides give a 15-page answer to a problem most people think needs 300 pages.</p><p>If you run security with limited resources, this episode shows you where to start and why the whole thing is free.<...
