Bart Asnot

Bart Asnot's core message is that cybersecurity today cannot be separated from geopolitics, and that most people badly underestimate how early hybrid warfare actually begins. His clearest illustration is Ukraine: the invasion was preceded by "a full year" of mis- and disinformation campaigns in the eastern regions designed to shift the population's mindset before any physical action occurred ¹². For Asnot this is the paradigm, not the exception, attacks on a country's stability start in the information space long before anyone fires a shot, and defenders who wait for kinetic signals are already too late.

A second recurring theme is how generative AI has flattened the skill curve for attackers. He describes the rise of AI-empowered "script kiddies", people who once needed real coding ability now generating attacks on demand, which has scaled both the volume and impact of low-skill cybercrime ¹². He frames this as an inescapable trade-off of innovation itself: "Hoe meer een innovatie kan gemaakt worden voor het goede, hoe meer dat ook kan worden misbruikt voor het slechte" ¹². Crucially, he does not see AI as an autonomous threat actor in its own right, at least not yet: "Wij leiden. Technologie volgt... Ik zie dat niet echt gebeuren. Ik hoop ook dat dat niet echt gebeurt" ¹. Technology, in his view, remains a force multiplier for human intent, good or bad, rather than an independent agent.

On defense, Asnot is candid about limits. He repeats, in near-identical language across appearances, that "100% bescherming bestaat nooit in de digitale wereld. In die fysieke wereld eigenlijk ook niet" ¹². This isn't resignation but a call for realistic risk management: security postures go stale within days as employees adopt new devices or tools, so defenders must continuously reassess acceptable versus unacceptable risk rather than chasing an unattainable perfect state ¹². He backs this with scale: Microsoft ingests roughly 78 trillion security signals daily, which are anonymized and correlated by human analysts to produce confidential "nation state notifications" warning companies before state-linked actors strike ¹². He also flags a structural weakness, that companies migrating to the cloud keep applying legacy on-premise security thinking to a shared-responsibility model, creating a lag that attackers, who "don't care" about rules or audits, exploit as a head start ¹².

Asnot's account of who gets targeted tracks geopolitical and economic pressure points. He notes that during COVID, cybercriminals and espionage-linked states deliberately hit hospitals precisely because their security maturity was low and they had no choice but to stay operational ¹². In Belgium's case, he points to the roughly 48,000 registered members of the diplomatic community as the reason government and diplomacy are now the critical target sector, citing pro-Russian groups like NoName launching DDoS attacks the day after Belgian pro-Ukraine statements ¹². This leads him to a pointed observation about attribution asymmetry: opportunistic ransomware crews often self-identify to build "street cred," while genuinely targeted, state-linked attacks hide behind routers and jurisdictions across many countries, making legal or NATO-level responses nearly impossible ¹².

He is also willing to defend why so much of this fight stays invisible. Publicly attributing every incident, he argues, would breed paranoia that itself serves the adversary's real goal, destabilization, so much defensive work deliberately stays under the radar ¹². This coexists with a strong belief that Belgium is actually doing well: he cites European reports placing Belgium consistently "in de top drie, soms top één" of best-secured countries in Europe ¹², a claim he offers as reassurance rather than complacency.

On the human side, Asnot pushes hard against the technical mystique of the field. His advice to practitioners is to "denk als een hacker... denk hoe de andere kant werkt" ¹², treating adversarial thinking as a core professional discipline. But for ordinary users he wants the opposite of technical depth: he compares good cyber hygiene to driving a car, where you don't need to understand the engine, just the basic rules, password managers, 2FA, not clicking unknown links, and argues the "hoodie hacker" framing of cybersecurity as arcane and technical actively blocks mainstream awareness ¹². He sums up the asymmetry defenders face bluntly: "de cyberactoren... die zien gewoon iets nieuw, iets cool en die gaan dat proberen binnen te geraken," giving attackers a persistent small head start that defense can only ever narrow, never close ¹².