We need less technology, not more: Marius Sandbu on complexity as the real risk

(Foto: Digital Innlandet v/Nina Knutsen)

NIC 2026 SPEAKER SERIES "5 questions with"

Fourth in our Speaker Series: Marius Sandbu, Cloud Evangelist at Sopra Steria and Azure AI MVP. We're putting the same five questions to the practitioners leading sessions at NIC 2026 this October, people who spend their working lives in the trenches rather than on a stage.

What do you believe that most of your peers would disagree with?

We need less technology, not more. We keep adding security products, monitoring tools, management platforms, and now AI, on top of everything else. Every new problem seems to result in another product. At some point, complexity becomes the biggest problem.

What do teams still accept as normal, even though it creates unnecessary risk?

Far too much permanent access. Admin accounts, service accounts, applications and APIs often get permissions because they needed them once, then keep them forever. Now we're adding AI agents with identities and permissions of their own.

When did something last go wrong that genuinely surprised you, and what changed afterwards?

What surprises me most these days isn't when technology fails, it's when it works exactly as designed and still creates a problem. Especially with AI agents. Give an agent an objective, some data, and access to tools, and it might find a perfectly logical way of achieving that objective nobody anticipated. That's changed how I think about automation. We used to test whether something could perform an action. Now we also need to test what happens when it gets creative about how it performs it.

What is one thing someone can change on Monday morning without waiting for a project, budget, or permission?

Delete something. An old admin account, an application nobody uses, a forgotten API key, software last opened in 2019. Security conversations tend to start with what we should buy next, but removing attack surface needs no budget or project, just someone willing to ask whether a thing still needs to exist. Find one, confirm nobody depends on it, and get rid of it.

What will people experience at NIC that they cannot get from a blog post or webinar?

You can read documentation, watch webinars, and ask AI to explain almost anything these days, but that doesn't replace meeting someone who's actually tried it in production and hearing: "Yeah, we did that. Don't do that." NIC brings together people who build, operate, and occasionally break real environments. The presentations give you ideas, but the discussions, questions, and shared war stories give you context.

Marius is on the Public Cloud track with Who Broke Production? Ask the Agent, a hands-on look at how Microsoft's new managed AI agent assists with troubleshooting and diagnosing failures in Azure, reasoning through signals across the environment, and how to configure and extend it with Skills, MCP integrations and sub-agents. Thursday at 3:40pm, Room 3.

‍

NIC 2026 SPEAKER SERIES "5 questions with"

We have put the same five questions to the practitioners leading sessions this October, people who spend their working days in the trenches rather than on a stage. Third up: Paula Januszkiewicz, Founder and CEO of CQURE, back on the security track with two deep technical sessions on identity and forensics.

What do you believe that most of your peers would disagree with?

I'm not sure this would be controversial among my peers, but I think we still overestimate what tools and formal security checks can guarantee. I've seen organizations with mature security stacks and recent penetration tests still suffer incidents, simply because important weaknesses were missed. That's why the quality of testing matters so much. A superficial test can be worse than people realize, because it creates comfort without necessarily creating security. For me, the strongest teams aren't the ones with the most tools or reports, but the ones that keep questioning what they may still be missing.

What do teams still accept as normal, even though it creates unnecessary risk?

Teams get used to complexity very quickly. A temporary exception stays for years, someone keeps access they no longer need, or an old protocol remains because one application still depends on it. Each decision may have been perfectly reasonable at the time. The problem comes later, when dozens of these small exceptions start connecting and nobody has the full picture anymore. That's where unnecessary risk builds up. For me, the key is regular review: not asking who made a bad decision, but simply, "Do we still need this today?"

When did something last go wrong that genuinely surprised you, and what changed afterwards?

What still surprises me isn't usually the attacker's technique. After years in incident response, the patterns are familiar. The surprise is how often simple questions become difficult during a real investigation: when did this start, which account was used, where did the attacker move next, what data was touched? Sometimes the answer isn't available because the right logs were never collected or retained. That's changed how I think about readiness. Incident response doesn't begin when the phone rings. It begins earlier, with logging, telemetry, retention, and knowing what evidence your systems can actually give you.

What is one thing someone can change on Monday morning without waiting for a project, budget, or permission?

Choose one privileged account and follow it properly. Not in a policy document, but in the real environment. Where can it log on? What groups is it in? Which systems trust it? Is it used interactively? Could its credentials end up on a workstation or server where they should never appear? This exercise takes much less effort than a large security programme, but it often exposes surprising dependencies and old assumptions. You don't need a new budget to improve security. You can start by understanding one important access path better than you understood it on Friday.

What will people experience at NIC that they cannot get from a blog post or webinar?

At NIC, people will see things happen live, not just hear the polished conclusion afterwards. We can follow an attack path as it develops, inspect what the operating system is actually doing, look at where credentials appear, and use forensic artefacts to piece together what happened step by step. That matters because real environments rarely behave exactly like a diagram or a blog post. Something unexpected always comes up. NIC also has a very technical audience, so we can stop, dig into those surprises, challenge assumptions, and go much deeper than we normally could in a webinar or recorded session.

Paula is on the security track twice, both Wednesday in Room 1: Breaking Identity at Scale: From DPAPI & TBAL Secrets to Full Domain Compromise at 1:20pm, and Windows Knows What You Did: Deep Dive into Automatic Destinations at 4:00pm.

‍

NIC 2026 SPEAKER SERIES "5 questions with"

Ahead of NIC 2026, we're sitting down with some of the practitioners leading sessions this October, the same five questions, put to people who spend their working lives in the trenches rather than on a stage. Second up: Sami Laiho, Senior Technical Fellow and MVP at Adminize.com, and one of the most established voices in Windows security.

What do you believe that most of your peers would disagree with?

Whether Macs are actually more secure than Windows. Most people still assume they are, and that Windows is the dangerous platform you have to lock down hard. I disagree. A properly configured and managed Windows computer can be extremely secure. The real question was never which OS you use, it's how well you understand it, configure it, manage privileges, patch it, and actually use the security capabilities already built in.

What do teams still accept as normal, even though it creates unnecessary risk?

Letting Entra ID and Azure admin portals be accessed from any computer. We've spent decades learning that privileged administration belongs on dedicated, trusted devices, yet cloud administration keeps getting an exception. Your Global Admins shouldn't be managing your cloud environment from the same machine they use for email, Teams, and everyday browsing. Use a dedicated Privileged Access Workstation. That's not a new idea just because the servers moved to the cloud.

When did something last go wrong that genuinely surprised you, and what changed afterwards?

A ransomware attack on a single computer, about two years ago. Our defenses worked, the attack was contained, so technically it was a successful demonstration of the architecture. What surprised me was how the attacker got there: the computer was sitting in a part of the network we didn't properly know about, because of a gap in our device inventory. Afterwards, I fixed the inventory, and this time we included physical network connections too, including underground cabling we didn't even know existed.

What is one thing someone can change on Monday morning without waiting for a project, budget, or permission?

Stop using an administrator account as your everyday login. You don't need a new product, a six-month project, or a bigger budget, just create a separate account for admin tasks and use your normal account without admin rights day to day. It's one of the oldest security recommendations in Windows, and still one of the most important. If your everyday account is an administrator, every app you run and every mistake you make starts from a far more privileged position than it needs to.

What will people experience at NIC that they cannot get from a blog post or webinar?

Networking is probably the most important asset you can have in a modern IT environment. And no, I don't mean TCP/IP, I mean people. Nobody can know everything anymore, the technology is too broad and changes too fast. What you can do is get to know people who know the things you don't. At NIC, you meet those people, ask them questions, challenge their ideas, share experiences, and build relationships that help you long after the conference itself is over.

‍

Catch Sami live on the security track: 60 Life Hacks of Windows in 60 Minutes on Wednesday at 10:00am, and Cyber Security: State of the Union 2026 on Thursday at 3:40pm, both in Room 1.

‍