Talks I give.
Pick one, or ask for a mix. All of them work in Dutch or English, on a stage, in a webinar or as a hands on workshop.
Pick one, or ask for a mix. All of them work in Dutch or English, on a stage, in a webinar or as a hands on workshop.
😄🚦🛡️ Conditional Access, but make it readable
Open the Conditional Access blade in a random tenant and you get forty policies called "CA001 - Block legacy", "CA001 - Block legacy (new)" and "test do not delete". Nobody knows what they do. Nobody dares to touch them. 😬 Mine are full of emojis, and that is not a joke. A policy you can read at a glance is a policy you can maintain. After the naming system we get to the part that really keeps you safe: device settings, compliance and Conditional Access as one chain. Settings harden the device, compliance proves it, Conditional Access enforces it at every sign in. Break one link and the rest is decoration. Live, in a real tenant. 🚦
Your MFA just got phished: stopping AiTM attacks
You rolled out MFA. Everybody got the app. You felt safe. 🔐 Then an adversary in the middle kit sits between your user and the real sign in page, lets MFA succeed like a polite doorman, and walks off with the session cookie. Wait. What. I show the attack live, then close the doors one by one: authentication strengths, a compliant device requirement, token protection, risk based policies and continuous access evaluation. And then the fun part: why passkeys make the whole trick fall apart, and how to roll them out without starting a help desk riot. 🔑
🏰 The modern secure workplace: stop building castles
Your users work from the kitchen table, the train and that one coffee place with suspiciously good WiFi. ☕ The office network stopped being your perimeter years ago. Identity is. So stop building castles and start checking every door: who is signing in, from which device, and is that device actually healthy? I show how Entra ID, Intune and Conditional Access click together into a workplace that is secure by default and still nice to work in, using the baseline I deploy at customers. And yes, the mistakes too. Especially the ones that page you at 2AM. 🧯
Axios got owned: from supply chain attack to unified SOC
One compromised npm package. More than 100 million systems. And not a single firewall rule that cared. 📦 I walk through how the attackers got in through Axios, step by step, from the poisoned release to the first foothold on a developer machine. Then the question that actually matters: how could we have stopped this inside a Microsoft environment? The right set of policies, awareness that sticks longer than the quarterly phishing test, and Defender with a unified SOC that connects the dots before the attacker does. You leave with a list of things to turn on tomorrow. 🛠️
🤖 Cybersecurity in the age of AI: the bad guys got Copilot too
Remember when you could spot a phishing mail by the spelling? Those days are gone. 📨 Attackers use AI too: flawless phishing in perfect Dutch, faster reconnaissance, and more attempts than any human could type. So what changes for small and midsize organisations? Less than the vendors want you to believe, and more than your current setup can handle. I show what these attacks look like today, why yet another tool on the shelf will not save you, and why detection and response around the clock is the part you cannot skip. 🌙
☁️ Azure as your security foundation: start small, build it right
Most Azure environments I meet started with one quick VM "just for testing". Three years later it runs payroll. 😅 In this session we do it the other way around. Landing zones, identity and governance first, the boring bits that save you later. Then workloads like Azure Virtual Desktop and migrations on top, without tearing everything down in two years. A practical path to Azure for organisations that want to start small and still sleep at night. 🧱
📂 Get your data AI ready before Copilot reads everything
Here is the thing nobody tells you in the Copilot demo: it finds everything the user can open. Everything. That salary sheet someone shared with "Everyone except external users" in 2019? Copilot found it. 🙃 Copilot does not create a data problem, it just shows you the one you already had, very quickly and very politely. I show how to spot oversharing, clean up permissions and put sensitivity labels to work before you roll out Microsoft 365 Copilot, so your pilot does not turn into a data leak with a chat window.
⚡ Working harder and smarter with AI
AI will change everything, the slides say. Great. What do I do on Monday morning? ☕ This session is all demo and no strategy deck. I show what Copilot and other AI tools do really well in a normal working day, where they still fall flat on their face, and how to tell the difference before you forward that summary to your boss. For people who want to start tomorrow, not after the next steering committee. 🚀
Organising an event, user group or podcast?
I am happy to come by. Tell me the audience and I will tailor the session.