Matthijs van Amelsfort
Director, National Cyber Security Centre (NCSC-NL)
Sessions (2)
Sessions featuring Matthijs van Amelsfort at ONE Conference
Blended Threats, Blurred Lines
The core message of the panel was that cybercrime and state activity increasingly overlap, making response a shared responsibility across business, law enforcement, national cyber agencies, and intelligence services. The moderator framed the issue by asking what happens when an incident is both a crime and a state attack: who is actually in charge? The panel’s value came from placing those blurred responsibilities side by side, with perspectives from NCSC, Randstad, the police, and MIVD. Stan summarized the collaboration imperative directly: cybercrime is a team sport, and no single organization has an individual solution for combating it. The early discussion focused on moments when the blurred line became tangible. Matthijs described a ransomware investigation where the absence of ransom notes suggested a state actor rather than a purely criminal operation, changing what responders needed to consider, including what information they had already exposed by entering the incident. Jessica recalled a crisis exercise in which board members debated whether to pay, before legal asked who would actually receive the money: a nation state or a criminal organization. Stan pointed to the 2024 police data breach, where the police were both victim and investigating agency, and where the case ended with attribution to Laundry Bear, a state-sponsored group. Marcia described a broader trend rather than a single incident, noting that China formally uses parts of society, individuals, and organizations to pursue national goals by gathering intelligence abroad. The panel then moved into the operational reality of faster exploitation. The moderator referenced frontier models and NCSC reporting that vulnerabilities become public and are exploited at greater speed and scale. Matthijs said that, for NCSC response, the identity of the actor initially does not matter because the kill chain looks similar: initial access, consolidation, and exfiltration. Attribution belongs to intelligence agencies and police, while NCSC focuses on what happened, collecting indicators of compromise and TTPs, preventing new victims, and identifying organizations already affected. Marcia explained that naming an actor such as Laundry Bear is intended both to hold that actor responsible and to raise awareness so others can detect or prepare for similar activity. The business and communications discussion emphasized preparation under uncertainty. Jessica stressed that even extensive tabletop and crisis testing cannot cover every scenario, so organizations need the right decision-makers in the crisis room: legal, finance, communications, and business leaders able to assess impact and decide. She warned that withholding information can create panic outside the organization, making communication planning part of crisis balancing. Stan added that cybercrime remains difficult for society to understand because it is not easily tangible, so police, government, and private industry should share stories and explain what is happening. The excerpt closed with the panel asking who benefits from blurred lines; Marcia argued that states benefit because hiding behind criminal actors complicates attribution and response.
Closing day 2
The closing session framed the value of the two-day ONE Conference as connection, shared learning, and renewed focus on practical cyber resilience. The host opened by asking what had stood out, and the speakers described the event as both enjoyable and meaningful: one highlighted how much there was to tell, share, and connect around, while another, attending the ONE for the first time, said it was a “true joy” and an honor to learn more about the community, hear the talks, and see the proactivity across the field. The conversation then turned to the Ukrainian colleagues who had just spoken and to the speaker’s own visit to Ukraine in August. The most striking comparison was between air raid sirens in the Netherlands and in Kyiv. In the Netherlands, the Monday siren is treated as a routine test; in Kyiv, it means drones and ballistic missiles may be coming. The speaker connected this to the cyber world’s idea of a tabletop exercise, asking how seriously exercises are being taken when, for Ukrainian colleagues, the scenarios are real life. This led directly to the resilience message for the Netherlands: keep the basics in order and remember that the situations discussed are already happening elsewhere. The session also reviewed a significant year of organizational change for the NCSC. The speaker recalled that the planned January 1 merger with D2C and CSIRT DSP had happened, the reorganization had taken place on July 1, and the hoped-for Cybersecurity Act was now in place. On that basis, the speaker said the NCSC is ready. Looking ahead, the discussion identified AI as something that will keep everyone busy in the coming year, with emphasis not only on challenges but also on how AI can be used to the community’s benefit. The final message was deliberately practical: follow the five basic principles of the NCSC and get basic cyber hygiene in order. The speaker hoped that, after the stories shared during the day and the closing session, attendees could return next year and say real progress had been made. The close also recognized the event team, announced the next ONE Conference dates as 5 and 6 October 2027, encouraged attendees to complete the feedback form, and ended by inviting everyone to networking drinks.