Will The Police Ever Catch Your Attacker?

You report a breach. Does anyone ever get arrested?

Stan Duijf, Head of Operations at the NIS, the Dutch National Police unit for national and international investigations, sits down with Lieuwe Jan Koning, Co-founder & CTO at ON2IT, to explain what actually happens on the other side of a cyberattack. One case can span 5 to 20 countries. Arrests are rare, so his team measures something else: how expensive they make crime to run. Takedowns, seized servers, 35 million euros in seized crypto, sanctions, and Operation Endgame, a campaign that hits the same criminal infrastructure twice a year. Arrests still happen, often the moment a suspect travels.
You leave knowing why arrests are the wrong metric, what threat intel the police want from your security team, and how AI is speeding up both sides of the fight.

Timestamps:
00:00:00 Who is really on the other side of a breach
00:01:07 Why one cybercrime case spans 5 to 20 countries
00:04:23 Inside Operation Endgame: the recurring takedown campaign
00:16:03 The Dutch specialty: technical skill and the broad intervention strategy
00:17:07 Takedowns, seized servers, and 35 million euros in crypto
00:24:10 AI is making cybercrime faster, and investigations too
00:29:29 What companies can do: sharing threat intel and joint takedowns

Key Topics Covered:

Why a single cybercrime investigation spans 5 to 20 countries, and what that does to response time
Operation Endgame: a recurring, campaign-level takedown strategy against info stealers and botnets
The broad intervention strategy: prevention, disruption, and repression, with arrests as one tool among many
How crypto seizures work and why they matter more than the arrest count
What threat intel the police want, and what integrated operations with companies like Microsoft, Palo Alto Networks, and Google look like

Related ON2IT Content & Referenced Resources
Threat Talks: https://threat-talks.com/
ON2IT Zero Trust MDR Prevent: https://on2it.net/
AMS-IX: https://www.ams-ix.net/ams
Operation Endgame: https://www.operation-endgame.com/
Hack_Shield / Hack_Ride, Dutch police youth offender-prevention programs: https://www.politie.nl/nieuws/2026/maart/4/11-politie-en-hackshield-werken-aan-digitale-weerbaarheid-van-kinderen.html