Make Your Business a Hard Target for Cybercriminals - ThreatLocker
Overview
In this CISO Inspired Summit 2026 masterclass, Seamus Lennon, Vice President of Operations EMEA at ThreatLocker, argues that cybercrime is now industrialised: attackers don't so much hack as select, and they select the easiest targets.
Seamus explains how attackers gain initial access through stolen credentials, default configurations and living-off-the-land binaries, why alert fatigue lets real attacks blend in, and how a zero trust approach of trusting nothing by default, verifying explicitly and assuming breach can contain an attack before data leaves the environment.
Key takeaways
- A US hospital previously shut down for two weeks with 6,000 devices offline; attacked again with ThreatLocker in place, even with domain admin credentials only 200 devices were affected and the hospital stayed open.
- Default configurations, such as a networked printer with an unchanged username and password, give attackers an easy way in.
- Living-off-the-land techniques abuse genuine tools like PowerShell, so blocking known-bad software alone is not enough.
- By the time encryption starts it is too late; as little as 1 MB of exfiltrated data can be enough to hold an organisation to ransom.
- Application allowlisting, controls on data access and storage devices, and host-based network controls block reconnaissance and payloads: if there's no payload, there's no ransom.
Watch the full session on YouTube: Make Your Business a Hard Target for Cybercriminals - ThreatLocker | CISO Inspired Summit 2026
