Our CTO, Vesa Suontama, spoke at Turku Tech Week on 4 March 2026 on the topic “Identity is the New Attack Surface – How Do We Protect Identities?”. The presentation sparked a great deal of debate, so we sat down with Vesa to ask him to expand on the four key takeaways from his talk.
The first key point of your presentation was that identity is the key to almost everything. What made you put this right at the top?
Because it is literally true. Think of any digital service: a bank, email, a patient record system, or a company’s internal wiki. Everything begins with the system deciding who you are. If someone gains control of your identity, they gain everything you have. They don’t need to break anything. The door opens perfectly normally.
I started the presentation with a story about how I was scammed in a shop. The scam was pure social engineering: a story, empathy, and trust. No violence, no force. I fell for it because I didn’t stop to verify. The same thing happens digitally every day on a much larger scale. A phishing email works on exactly the same principle: it doesn’t break in; it gets you to open the door yourself.
Your second key message was that we no longer live in a castle, but in a bazaar. What did you mean by that colourful metaphor?
Traditional cybersecurity was built on the ‘castle model’. The firewall was the drawbridge, the internal network was the courtyard, and everyone inside was trusted. It worked well as long as everything essential stayed within the walls.
But cloud services changed everything. First, email moved to the cloud, then files, then CRM, and then everything else. Every new SaaS service moved a piece of the business outside the walls. No one held a meeting or made a conscious strategic decision about it – it just happened, service by service, year after year. Without us noticing, the castle became a bazaar.
In a bazaar, you cannot assume everyone inside is a good person. In a castle, the gatekeeper knew everyone by sight. In a bazaar, thousands of people are moving around, and you must constantly evaluate who is a merchant, who is a customer, who is a spy from a rival state, and who is a pickpocket. The only way to maintain order is to manage identities: who gets in where, with what permissions, and for how long.
Your third point was that security requires layers. Isn’t that fairly obvious?
As a principle, yes. In practice, many organisations still rely on a single layer: the password. Perhaps they’ve added multi-factor authentication (MFA), but often that’s the only improvement made in years. It’s like putting a second lock on the castle gate but leaving all the windows open.
Layered security means protecting identity on several levels simultaneously. Strong authentication is the first layer. On top of that comes the principle of least privilege: the user only has access to what they actually need. The third layer is continuous evaluation: the system monitors whether the user is behaving normally. If someone logs in from Turku and half an hour later from Singapore, something is wrong. None of these layers are sufficient on their own, but together they make an attack significantly harder.
The Vastaamo case is a painful domestic example of this. Their access management failed in a fundamental way. A sensitive database of patient records was accessed because protection was inadequate: no layers, no monitoring, no alerts. The consequences were devastating. Tens of thousands of patients were blackmailed using their own therapy notes. The company went bankrupt. Trust in the entire sector suffered in a way that still hasn’t been fully repaired. It was an attack on people’s lives, and it could have been prevented.
The fourth key takeaway was that cybersecurity is a good investment. How do you sell that to a sceptical decision-maker?
Usually, Case Vastaamo is enough. Everyone in Finland knows what happened. The company lost everything: its customers – the scale of whose pain and distress is hard to even imagine—its reputation, and finally its existence. It’s an extreme example, but smaller cases happen constantly. They just don’t make the headlines.
For those who prefer hard data, I point to the IBM study, which shows the average cost of a major data breach is nearly $5 million.
More important than the figures is the fact that the vast majority of these breaches start with identity – stolen credentials, excessive access rights, or unmanaged service accounts. These are things you can influence in advance. Identity management is not an expense; it is cheaper than the alternative.
But it’s not just about ‘insurance’ against problems. Well-implemented identity management streamlines work in expert organisations and improves job satisfaction. Furthermore, it frees up IT’s time for development work when routine tasks can be automated.
What is the most important message you would like to leave with the reader?
When protection is weak, a criminal doesn’t ‘break in’ – they simply use your details in secret. If you don’t manage identities, you don’t manage security.
And therein lies the good news. Unlike zero-day vulnerabilities or nation-state-level attacks, identity-related risks are ones that an organisation can influence itself. The right governance model, the right tools, and the right processes. You don’t have to be perfect.
You just have to be a little better than you were yesterday.