Your Business Will Be Hacked. The Real Question Is When

Dr. Niklas Richter · 2026-07-02

Let's be honest: cybersecurity feels like a topic for IT departments, not for CEOs. But after talking with Keanu Nys, Head of Offensive Security at Spotit, I realized that's exactly the mindset hackers are counting on. Keanu didn't study IT. He taught himself to hack. Today, companies pay him to break into their systems before real criminals do. In 2025, he stood on the main stage at DEF CON in Las Vegas, the world's largest hacking conference, speaking to 3,000 people about a security flaw he found in Microsoft's own login page. ### What a Pentest Actually Looks Like A penetration test (pentest) isn't some abstract exercise. It's a simulated attack where ethical hackers try every trick in the book to get inside your network. Keanu's approach is both technical and psychological. "Technology is rarely the weakest link," he told me. "The weakest link is usually the person who clicks 'allow' because the CEO needs a document opened urgently." He described how IT staff sometimes disable security measures themselves when pressured by leadership. That's not incompetence. It's human nature. And hackers know it. ### The Fake Inspector Trick That Worked One of Keanu's most eye-opening stories involves pretending to be a social security inspector. He walked into a company, asked for the CFO, and within minutes had compromised both the CFO and the entire IT team. - He used official-looking documents and a confident tone - The CFO handed over credentials without hesitation - The IT team never questioned the "inspection" This wasn't a movie scene. It happened in a real office, with real people who thought they were being compliant. Keanu also nearly logged into former Belgian Prime Minister Alexander De Croo's Facebook account during a legal project, and once received an official police report after a legitimate hack. ### The $500,000 Question Every Business Owner Must Answer Here's the question Keanu says every entrepreneur should be able to answer today: If you walk into your office Monday morning and all your systems are encrypted, and criminals demand 5% of your annual revenue, do you pay or not? For a company making $10 million a year, that's $500,000. Most businesses don't have that cash sitting around. And even if they do, paying doesn't guarantee you'll get your data back. ### AI Is Changing the Game Artificial intelligence is making attacks faster and more convincing. Phishing emails that used to have spelling errors are now nearly perfect. AI can mimic a CEO's writing style in seconds. Keanu developed a tool called GraphSpy that thousands of ethical hackers use worldwide. Unfortunately, real attackers sometimes use it too. That's the double-edged sword of offensive security: the same tools that protect you can be weaponized against you. ### Your First Step: Not a Tool, But a Test Keanu's most important advice isn't to buy a specific software or hire a consultant tomorrow. It's simpler than that. "Run a basic vulnerability scan on your own network," he said. "You'll be shocked at how many open doors you have." Start with one machine. Then another. Then ask someone to try to break in. You don't need a $50,000 security audit to know you're exposed. You just need the courage to look. ### What This Means for You After this conversation, I'll never look at an email, a link, or a scheduled meeting the same way again. Cybersecurity isn't about paranoia. It's about preparation. - Test your systems before someone else does - Train your people to spot social engineering - Have a plan for when (not if) an attack happens Keanu Nys proves that the best defense is a good offense. And the best time to start is now.