Will The Police Ever Catch Your Attacker?

You report a breach. Does anyone ever get arrested?

Stan Duijf, Head of Operations at the NIS, the Dutch National Police unit for national and international investigations, sits down with Lieuwe Jan Koning, Co-founder & CTO at ON2IT, to explain what actually happens on the other side of a cyberattack. One case can span 5 to 20 countries. Arrests are rare, so his team measures something else: how expensive they make crime to run. Takedowns, seized servers, 35 million euros in seized crypto, sanctions, and Operation Endgame, a campaign that hits the same criminal infrastructure twice a year. Arrests still happen, often the moment a suspect travels.

You leave knowing why arrests are the wrong metric, what threat intel the police want from your security team, and how AI is speeding up both sides of the fight.

Timestamps

(00:00) - Who is really on the other side of a breach

(01:07) - Why one cybercrime case spans 5 to 20 countries

(04:23) - Inside Operation Endgame: the recurring takedown campaign

(16:03) - The Dutch specialty: technical skill and the broad intervention strategy

(17:07) - Takedowns, seized servers, and 35 million euros in crypto

(24:10) - AI is making cybercrime faster, and investigations too

(29:29) - What companies can do: sharing threat intel and joint takedowns

Key Topics Covered