Blog

Keeping a cyberattack under control starts before anything happens

Lessons from the Ctac Security Event: from phishing email to boardroom

Cyber resilience doesn’t come from a single tool, but from the interplay between technology, people, processes and governance. That was the common thread of the Ctac Security Event, where experts walked through the full lifecycle of a cyber incident. Modern phishing is so convincing that awareness alone isn’t enough: you also need phishing-resistant authentication and properly configured conditional access. A SOC can only stop an attack quickly if it’s agreed in advance which actions it may take on its own. Safe AI use requires clear agreements about data and a secure alternative for employees. And since the Dutch Cybersecurity Act took effect on August 15, 2026, cybersecurity is explicitly a board-level responsibility. So start by gaining insight into your attack surface, and practice before things go wrong for real.

It’s not the attack, but the preparation that makes the difference

Cybercriminals are becoming more professional, attacks smarter and the potential impact greater. Yet the deciding factor often isn’t the attack itself, but how well an organization is prepared for it. During the Ctac Security Event “Cyberattack under control: from threat to responsibility”, security experts took participants through the full lifecycle of a cyber incident. From the first phishing email and the attacker’s methods to detection by a Security Operations Center (SOC), safe AI use and the responsibility of the board and executive management. The key takeaway of the morning? Cyber resilience doesn’t come from one tool or measure, but from the interplay between technology, people, processes and executive decision-making.

One attack, seen from two perspectives

What does your organization look like through the eyes of an attacker? And what happens when that attacker actually gains access to an account? Anass Ali of Ethical Hacker Groep Nederland showed how cybercriminals combine information from different sources. Public company information, leaked personal data and convincing phishing techniques are often enough together to deceive an employee.

In a live demonstration, participants saw how an attacker uses a fake Microsoft login environment to take over an account and an active session. With that, the attacker tries to gain access to email, files, SharePoint and Teams, and then spread through the organization from that single account. Above all, the demonstration showed how credible modern phishing is. A familiar corporate identity, a recognizable login screen and a normal MFA prompt don’t guarantee that an environment is safe. Awareness remains important, but it needs technical support, such as properly configured conditional access and phishing-resistant authentication with passkeys, FIDO keys or Windows Hello for Business.

From detection to immediate action

Next, the Ctac SOC team examined the same attack from the defender’s perspective. In the Microsoft security portal, various signals came together, such as unusual sign-in activity, abnormal API usage and access to files and collaboration environments. A Security Operations Center always looks at three questions:

What do we know?

Which signals are there, and what do they tell us about the attack?

What information is still missing?

What do we still need to find out to get the full picture?

What action is needed?

What needs to happen right now to stop the attack?

With a compromised account, quick intervention is often essential. Think of blocking the account, revoking active sessions, resetting authentication methods and isolating an affected device. Then the investigation into the actual impact begins. The sooner you detect and contain an attack, the smaller the chance that an attacker moves further through the organization.

Technology alone isn’t enough, though. A SOC needs to know in advance which actions it may take on its own, when consultation is needed and who can be reached outside office hours. Can an individual account be blocked immediately? Can a laptop be isolated without consultation? And what happens if a business-critical production environment appears to be hit? During an incident, there’s simply no time left to divide those responsibilities.

Do you know what an attacker sees from the outside?

During the event, participating organizations received a condensed outcome of the Ctac Security Assessment. This gave them a first indication of their external digital footprint, such as visible systems, potential vulnerabilities, email security and certificates. An assessment like this shows what a potential attacker sees before making a first attempt to get in. It’s not a full audit, but it is a practical starting point for recognizing, validating and specifically reducing risks. Compare it to your house. A well-secured front door is of little use if a window at the back is open. In the same way, digital resilience requires an overview of your entire attack surface, not just the systems that get the most attention internally.

AI offers opportunities, but requires clear boundaries

AI tools and agents are rapidly finding their way into the workplace. Employees use generative AI to write texts, create analyses, develop software and automate processes. That offers great opportunities, but also brings new risks. During the AI & Security session, Harro Kras showed that the risk usually doesn’t lie in the AI model itself. It mainly arises from the data employees enter, the permissions applications are given and a lack of clear ownership.

Customer data, contracts, intellectual property, financial information, source code and API keys don’t belong in public or private AI tools. At the same time, simply banning them usually doesn’t work, because employees need a safe and workable alternative. A practical traffic-light model makes the agreements easy to understand:

Red: do not enter
No personal data, confidential information, source code or other sensitive data in public AI tools.
Amber: only within agreements
Business AI use within approved applications, terms and processes.
Green: free to use
Applications and information you can use without additional risk.

A handy check question is: “Would I email this information in this way?” If the answer is no, the information probably doesn’t belong in an AI tool either. Safe AI use also requires a policy backed by the board and management, business licenses, a clear owner and periodic review. And self-built apps and agents shouldn’t just be tested for functionality, but also assessed on data usage, access rights, logging and vulnerabilities.

Cybersecurity is not an IT project

The closing session on NIS2 and the Dutch Cybersecurity Act brought the discussion into the boardroom. This act, the Dutch implementation of the European NIS2 Directive, took effect on August 15, 2026. Hakan Vurel stressed that cybersecurity isn’t only the responsibility of IT or the CISO. Board members and executives need to know which risks the organization faces, which measures have been taken and how the organization acts in the event of an incident. It’s not just about compliance, but above all about demonstrable control. Key areas of attention are:

Policy and supply chain risks

Risk management, information security policy and the security of suppliers and supply chain partners.

Incidents and crisis

Incident management, practiced crisis procedures and clear reporting, escalation and availability procedures.

Technology and people

Patch and vulnerability management, access management with strong authentication, and awareness for employees and board members alike.

Organizations that don’t fall directly under NIS2 will also face these requirements. Large customers and clients increasingly expect their suppliers to have demonstrable control over cyber risks. Cyber resilience thus becomes not only a security issue, but also a prerequisite for continuing to do business.

Can you keep operating when everything goes dark?

An incident response plan on paper is important, but only an exercise shows whether it really works. Can the right contacts be reached outside office hours? Who is authorized to decide to shut down systems? How do you inform customers, employees and suppliers? And do you still have important phone numbers at hand if the normal IT environment is unavailable? These seemingly simple questions make all the difference during a crisis. Technical recovery is only one part of the approach, because decision-making, communication, legal coordination and business continuity also need to be organized and practiced in advance.

Five steps from incident-driven to demonstrably in control

The Security Event showed that cyber resilience isn’t a one-off project. It’s an ongoing process of gaining insight, taking measures, monitoring, practicing and improving. A logical approach consists of five steps:

Map your digital attack surface
Investigate what’s visible from the internet and which vulnerabilities take priority.
Test how far an attacker can get
Don’t just look at the outside, but also investigate what happens when someone gains access to your environment.
Strengthen detection and response
Make sure you quickly recognize abnormal behavior, and document which actions the SOC may take on its own.
Embed security in policy and governance
Document responsibilities, incident procedures, AI agreements and supply chain risks.
Practice before things go wrong for real
Test not only the technology, but also decision-making, availability, recovery and communication.

How does Ctac help with cyber resilience?

We support organizations at every step. From Security Assessments, App Assessments and automated red teaming to SOC and MDR services, AI governance, NIS2 gap analyses, incident response and crisis exercises. We don’t see cybersecurity as a standalone domain, but look at how it connects with your infrastructure, applications, employees and business processes. Because the real question isn’t whether you’ve taken security measures, but whether your organization recognizes an attack in time, acts quickly and keeps demonstrable control over the consequences.

Do you know what an attacker sees of your organization?

With a Ctac Security Assessment, you get a first picture of your digital attack surface and concrete starting points for strengthening your resilience.

Schedule a meeting →

Frequently asked questions about cyber resilience

Cyber resilience is an organization’s ability to prevent cyberattacks, detect them in time, contain them quickly and recover from them. It requires the interplay between technology, people, processes and governance.

The SOC blocks the account, revokes active sessions, resets authentication methods and isolates the affected device where needed. An investigation into the impact follows. Agree in advance which actions the SOC may take on its own.

Signing in with methods an attacker can’t intercept via a fake login page, such as passkeys, FIDO keys or Windows Hello for Business. A standard MFA prompt doesn’t always offer that protection.

On August 15, 2026. The act is the Dutch implementation of the European NIS2 Directive and makes the board ultimately responsible for managing cyber risks.

Often, yes. Organizations covered by NIS2 must also manage the risks in their supply chain. That’s why they increasingly expect their suppliers to have demonstrable control over cyber risks.

An examination of your external digital footprint: visible systems, potential vulnerabilities, email security and certificates. It’s not a full audit, but a practical starting point for specifically reducing risks.

Keeping a cyberattack under control starts before anything happens

Summary