From Most Wanted Hacker to Cybersecurity Visionary: Greg van der Gaast on Fixing the System from Within

Once one of the world’s most wanted hackers, Greg van der Gaast has become one of the most influential voices in cybersecurity leadership. Now a trusted consultant to governments and Fortune 500 companies, he brings a rare, first-hand understanding of offensive and defensive security.  

As a leading cybersecurity speaker, Greg is known for his honest, strategic approach to tackling systemic vulnerabilities across industries. In this exclusive interview, he discusses the real causes of data breaches, the mindset shift organisations need to adopt, and why the future of cybersecurity depends on doing the basics brilliantly. 

Q: You were once a wanted hacker—a journey that’s now brought you to the forefront of cybersecurity leadership. How did that early experience on the other side of the digital fence shape your defensive mindset today? 

Greg: “It’s interesting because I think in one way, it gave me an attention to detail as to what to look for, what causes breaches. But somewhat weirdly, I think what it influenced the most is the defensive mindset, because back then you built a computer, you loaded your operating system and then you went on like Internet relay chat in the chat room full of hackers. We didn’t have broadband, we didn’t have home routers. Your computer was directly connected to the Internet.  

“There were no firewalls yet. If you hadn’t secured it, locked it down, tightened it, patched everything, updated everything. Hard drive still made noise back then. And if you hadn’t done that about 30 seconds after joining that chat room, it started making a lot of noise and everything just started shutting down and you’d have to reinstall Windows from floppies. So weirdly.  

“That’s probably what stuck with me the most, is just making absolutely sure that things are locked down properly. And there was kind of a gap there where I actually entered more the working kind of company business enterprise environments. And how do you do that at scale? And that whole, like, actually running a business gets in the way thing.  

“And there was a gap there, and that’s when I kind of. But some of the principles held and I kind of came full circle and now it’s more about just leadership and holistic approaches and really getting to the root causes and business process, company culture. And I don’t mean security awareness, I mean real culture to help do that same thing, have that consistent level of assurance, but also things like efficiency and agility to actually help the business on a holistic level. “ 

Q: When thinking about cybersecurity within a business environment, what would you identify as the most vulnerable point of failure that often goes overlooked? 

Greg: “Everyone says people. I think people are the first link, but they’re also your first line of defence. It’s, in a word, sloppiness, lack of maturity, lack of processes, lack of integration, not having that full holistic view of your environment, but also your It and your security functions, not understanding the business processes themselves, not knowing what there is to protect. Those are the real issues. Because you hear a lot about Dave for marketing clicked an email and that’s how everything turned to Poopoo.  

“But then they don’t forget, okay, he clicked on email. So an attacker had Dave’s level of access on his laptop. So how did they get the admin? Because you hadn’t configured that laptop properly. And how did they get through your VPN? And how did they get through your firewall? Because you hadn’t updated the firmware, you hadn’t changed the default password.  

“And then how did they run through wildfire, like through your data centre? Because you had poor system administration techniques and you had a bunch of unpatched servers. But let’s blame it all on day for marketing instead of the security and It teams who didn’t do their jobs. So holistic approach.” 

Q: Despite rising awareness, cybersecurity breaches continue to escalate. In your view, do we treat cybersecurity with the seriousness it deserves—and what are the real-world consequences when we don’t? 

Greg: “I don’t think we take them seriously enough, but it’s funny, I think there’s meaningful things that we take far too seriously. Like, I’m really not concerned about losing my credit card. I’ll file a claim, I’ll get my money back, I’ll get a new car. It’ll cost me five quid tops. Not bothering other things. Pretty significant. We’re scouting.  

“We work in supply chain discovery and management. And if you are a big international business and your suppliers go offline, or your production, manufacturing production goes offline for three weeks, three months, in some cases, pretty significant. Hospitals going offline, traffic management systems going offline. There’s a lot of ways things can get quite ugly. The numbers of ways that that.  

“Is possible in is increasing very quickly. And the biggest problem with this is it’s not about pumping more money into security and buying more tools, which is what the security industry would love you to do. It’s. The whole approach is flawed. We are not fundamentally making things secure.  

“We are trying to Bolt on security at the end in a way that just will never be a correct fit and is simply too expensive to do completely. And that’s why as we keep digitising things and keep making all these smart online systems, that just becomes things that people can exploit.  

“And we simply do not have the resource to constantly 24/7 monitor this stuff and try to detect and respond, which fails 90% of the time anyway. So I need to start doing stuff right from the beginning.” 

Q: Finally, looking ahead—based on current trends and vulnerabilities—what do you anticipate will be the next major evolution or shift in cyber attacks? 

Greg: “We’re pretty far out there already. Ransomware is very disruptive. We’ve got more and more critical infrastructure stuff being hit. I think that’s going to continue to grow, continue to scale up. We’re still not taking the problem seriously. We usually just blame an intern and go on from there. I think someone told me T Mobile has been hacked six times in the last three years.  

“That’s probably a bad sign. I think it’s going to be a bit more of the same, but it’s going to get more and more damaging. The scale of things will get worse and worse. Hopefully it doesn’t come to like warfare. That’s a big scenario. “ 

“That’d be ideal. If we didn’t get to warfare, that’d be great.” 

This exclusive interview with Greg Van Der Gaast was conducted by Mark Matthews.