The opening keynote at the first Experts Live Sweden in Stockholm on 13 October 2026 was “Forward to the Past and Back to the Future: Cybercrime in 2026 and Beyond” by Sami Laiho. He introduced himself as a self-employed security consultant from Finland and a Microsoft MVP who has taught Windows troubleshooting and internals courses in Sweden for about 14 years, and whose money now comes mostly from security architecture and auditing. His official title is Chief Research Officer, and he admitted he printed it on his business cards because Mikko Hyppönen always had it. This is my recap. The numbers and the stories are his; the summary and any mistakes are mine.
Three magic numbers
He opened with numbers from 2025. The first was two hours: the time an attacker needs from initial breach, for example a vulnerable edge device, to full compromise, meaning domain admin on-premises or global admin in the tenant. The second was the dwell time, 120 to 230 days on average, which attackers spend in the environment before they act. In his words, that time goes into working out how much money you make per day, so they know how much ransom to ask.
“We can’t stop them, but we have to try and slow them down.”
His practical takeaway from the dwell time was logging. Incident response needs at least six months of logs, and when he is asked about retention, his answer is a year. Without that history you cannot tell what happened, and you cannot tell whether the attacker is really gone. For comparison he pointed out that the Defender for Endpoint default is 30 days, so a longer history usually costs extra effort or money.
The third number was the one he called horrible: under five percent of victims go public. If you follow breach news daily, you see roughly one in twenty. That makes budgets harder to justify, because the volume of the problem stays invisible. He blamed a stigma: nobody writes that a bank was stupid for getting robbed, yet executives still hide breaches.
He also showed zerodayclock.com, which tracks the time from a vulnerability being found to it being used against companies. A few years ago that was measured in years. In 2026, for the first time, it went negative: zero-days are exploited before anyone has information about them. His explanation was one word: AI.
Ransomware is an industry, not two guys on the floor
Ransomware is still the biggest problem, he said, and people picture it wrong. Ask an AI to draw a ransomware gang being arrested and you get two guys in cable ties in a one-bedroom apartment with gold bars. The real gangs can employ 200 people, have HR, and in his words better service desks than yours. The ones who actually attack you are ransomware-as-a-service affiliates, sometimes one- or two-person shops, who pay 20 to 30 percent of the ransom back to the gang in exchange for tools, access and knowledge.
There is even licensing. In a Finnish case where a whole city lost its systems, the attackers used an old LockBit version, and the reason turned out to be that the affiliate had not paid for the yearly upgrade to the newest one. Every computer was encrypted except those with a Russian keyboard layout. The count of victims keeps growing: 7,515 in 2025 and 4,440 in the first half of 2026. His point about the Jaguar Land Rover attack was that the company itself can survive a hit of a few billion; the human catastrophe was the estimated thousand small suppliers pushed toward bankruptcy when their only customer stopped paying for a month.
Wipers, and the attack that needed no malware
The second category was wipers: the same encryption technology, but with no way to restore anything. They are weapons. His examples ran from NotPetya, which took Maersk down along with what he described as 15 percent of global trade while asking for a 300 dollar ransom, to HermeticWiper, which wiped Ukraine’s border control systems on the day the invasion started.
The example closest to this audience was Stryker, which lost a few hundred thousand devices because Intune was used to wipe the fleet. There was no malware, only privileged access used against the company: living off the land. After the incident he was bombarded with questions about whether multi-admin approval would fix this. His answer was no. Attackers with access at that level could have created another account and approved their own action. What would have helped was privileged access workstations. “There’s no secret sauce to save you,” he said.
For perspective he pointed to destroyedbybreach.com, an index of companies that ceased to exist because of a cyber attack. Companies do not go bankrupt from breaches on the scale some people try to scare you with, he said, but they do exist.
We all click links
On identity he started with himself. He clicked a fake DHL delivery link, and what stopped him was the rule he teaches everyone: the moment money appears in the conversation, whether you get it or pay it, you stop. The page asked for two euros.
He told how a friend who speaks about protecting identity with MFA was caught by device code phishing and noticed only after 48 hours without a single email. The friend was afraid of losing his credibility. Laiho offered him the keynote at his own conference in Orlando instead, because people learn from someone who admits clicking the link, not from someone who claims to be perfect. “We all will get breached,” he said.
Patch more, test less
Statistically, though, last year’s compromises came mostly from unpatched vulnerabilities, not identity theft. The biggest single thing you can do is patch faster, and he knows how hard that is: he has a Finnish oil refinery customer with servers last rebooted 17 years ago. The volume explains why it has to change. Microsoft published a steady 100 or so vulnerabilities a month for six years. This year June had 200, July 570, August 400 and September 966. Palo Alto went from about five patches a month to 75 over the summer. By his count you would need to patch Windows every 45 minutes to keep up. With 35,000 CVEs published in the first three quarters of 2026, his conclusion was blunt: patch more, test less. The cause is again AI, which does not create more vulnerabilities but finds them much faster.
The money and the targets
The economics were the last warning. The average payment peaked in 2024 at 2.7 million dollars per hit, while a zero-day, which he called the nuclear weapon of our industry, costs around 1 to 1.5 million and used to be affordable only for nation states. The average has since dropped to about one million, which he attributes to ransomware gangs forming cartels and agreeing on price levels. And the targets are not only big companies: in the Swedish source he showed, half of the victims had between 1 and 50 employees.
He closed with AI-generated video made with free tools from a ten-second webcam clip, and side-by-side versions of the same prompt a year apart, to show how fast the quality has improved and how easily it could fool most people. His comfort for the room came from Mikko Hyppönen: your security does not have to be perfect, only better than your neighbours’.
