As attacks are becoming increasingly targeted and decrease in cost over time, many organizations are making changes to their defense approaches but without really knowing what the implications are towards the use of their infrastructure and data, their security culture and if it makes any difference from an attacker’s perspective. Spoiler: It usually doesn’t.The presentation is about how companies make mistakes in their defense philosophy, how organized crime and F-Secure red-teamers always get in, where Denmark rates and what can be done to actively measure your own security overall.This presentation will go through what defense scenarios companies are using, how criminals are able to get in anyway and what needs to change to make your security investments more effective, not just more complex and costly.