Blog | 13 November 2025
The hacker's perspective – organisations' most common mistakes
Linus Kvarnhammar is a security specialist and professional hacker. For over fifteen years, he has been helping organisations understand how attackers think, before they get there themselves. Here he shares his insights on the most common mistakes he sees and how you can avoid them.
What is the most common mistake companies make when it comes to cybersecurity?
One of the biggest mistakes is an over-reliance on technology and purchased products. Many people think that security is about tools and systems. But it is at least as much about culture, processes and awareness.
Security has to come from the top. I find that balance a bit skewed today. When it is driven from below, there are often ad hoc solutions and quick product purchases. If, on the other hand, it comes from management, the entire organisation's processes follow. It becomes a more routine work that is followed at all levels.
What is the 'password123' of cybersecurity?
Ironically, passwords. They remain one of the most common weaknesses. Many people use the same password everywhere, even those in IT. When hacking an organisation, weak passwords on privileged accounts are often encountered and can have serious consequences.
What should you do immediately after a suspected attack?
- Disconnect the computer from the network
- Don't turn it off, investigators need it running
- Contact a security specialist immediately
Of course, how much time and resources you want to spend on the aftermath is up to the organisation, but quick first actions can be crucial.
During the eGovernment Days, our lecture is called "Who really has the power over our digital systems?", so... who is it?
Those who understand the systems best. And those who can exploit them. The platform always has some power, as does the provider and any third-party software we use. But also the people behind the systems, such as IT operations staff and developers.
The more you know, the more control you have.
