A conversation with Lam Le
As cybersecurity requirements continue to evolve, many small and medium-sized enterprises
(SMEs) are asking the same question: When should we start thinking about security?
According to Lam Le, the answer is simple: from the very beginning.
“Security is much cheaper to build than to retrofit”
“Retrofitting security into an existing project is painful and costly,” Lam explains. “If you know security will matter for your product, it’s far better to build it in from day one.”
Beyond the financial cost, he highlights the reputational risks companies face when security incidents occur.
“No company wants to see their logo appear on the dark web after a breach,” he says. “You can never eliminate risk completely, but you can reduce it significantly by thinking about security early.”
Lam also points out that regulations and industry standards increasingly require companies to take cybersecurity seriously. “Even if we don’t always like the regulations, we still need to follow them. Starting early makes that process much easier.”
Making Security Part of Company Culture
For SMEs, Lam believes cybersecurity should never be treated as a side project or a one-person responsibility.
“Security needs to become part of the culture,” he says. “The first step is awareness. People need to understand that security is not something separate from the product, it goes hand in hand with it.”
One of the biggest challenges, according to Lam, is communication.
“We shouldn’t talk about security like it’s rocket science,” he explains. “It’s important to use human language that everyone can understand.”
He recommends regular workshops, training sessions, and knowledge-sharing activities to make cybersecurity approachable across teams. Automation also plays an important role.
“If a task is repetitive and time consuming, we should automate it wherever possible,” he says.
Raising Awareness Through Real Examples
When asked about practical ways to increase awareness internally, Lam suggests using real-world cybersecurity incidents as examples.
“At Bosch, we collect security incidents happening around the world and share them internally,” he explains. “It helps people understand that cyberattacks are real, close to us, and happening every day.”
The key, he says, is simplifying the information. “Many security reports are very technical. We can rewrite them in simple language, almost like a newspaper story, so everyone understands what happened and why.”
If SMEs Only Focus on Three Things
So what should SMEs prioritize if they want to improve their cybersecurity efforts quickly?
Lam breaks it down into three clear steps:
1. Understand whether security is necessary
“First, ask: do we actually need security for this product or project? If the answer is no, then you don’t need to spend resources unnecessarily.”
2. Analyze and prioritize risks
“If the answer is yes, then identify where the risks are. Analyze the product, understand the potential attack paths, and prioritize the most critical risks first.”
3. Apply the right security measures
“Once you know the biggest risks, you can implement the right security controls to reduce them as much as possible.”
For Lam, cybersecurity is ultimately about being proactive rather than reactive. “The earlier you start, the easier it becomes,” he says.
Sweden Secure Tech Hub
Sweden Secure Tech Hub is a national innovation hub dedicated to strengthening the cybersecurity capabilities of small and medium-sized enterprises (SMEs). The initiative is co-funded by the European Union and delivered in collaboration with Kista Science City, Blue Science Park, Linköping Science Park, Luleå Science Park, Ideon Science Park, and Lindholmen Science Park.
We support SMEs across Sweden through:
-
Needs analysis
-
Expert advice
-
Testing services
-
Network building
