Cybersecurity refers to the set of technical, organizational, and human means deployed to protect a company’s computer systems, networks, and data against intrusions and attacks. In France, micro-enterprises, small and medium-sized enterprises (SMEs), and intermediate-sized enterprises (ETIs) now account for an increasing share of incidents reported to ANSSI, with a marked rise in attacks specifically targeting these often under-equipped structures in terms of digital protection.
Data exfiltration without ransomware: the threat that the firewall alone cannot block
Recent reports on cyber threats in France reveal a shift in strategy among attackers. The encryption of systems by ransomware is slightly declining, but incidents involving data exfiltration are significantly increasing year on year.
The principle is simple: instead of blocking access to files, attackers copy sensitive data (client files, contracts, banking data) and then threaten to publish it. The company can continue to operate, but it faces blackmail regarding its reputation and an obligation to notify under the GDPR.
This evolution changes the game for the IT solutions to be implemented. A traditional firewall and antivirus protect the network perimeter, but they do not detect a discreet transfer of files to an external server. Specialized providers like APWN assist companies in deploying measures adapted to these new forms of threats, including monitoring outgoing traffic and segmenting access to data.
Specifically, an SME that stores personal data of clients must monitor not only intrusion attempts but also abnormal volumes of data leaving its network. Without this visibility, exfiltration can go undetected for weeks.
IT security audit: where to start when resources are limited
The first step in an effective cybersecurity approach is the security audit. This is not a diagnosis reserved for large groups: even a structure with ten workstations can (and should) map its vulnerabilities.
An audit begins with an inventory of digital assets: workstations, servers, business applications, remote access, user accounts. Each element is evaluated according to its level of criticality for the activity and its degree of exposure to threats.
The three control points to prioritize
- Password and access management: ensure that each user has only the rights necessary for their role, and that multi-factor authentication is enabled on critical accounts (email, accounting, VPN access)
- Status of software updates: an outdated operating system or business software presents known and documented vulnerabilities that attackers prioritize exploiting
- Backup policy: control the frequency, encryption, and especially the physical disconnection of backups from the main network, so they are not compromised in the event of an intrusion
The audit produces a list of vulnerabilities ranked by risk level. The most urgent fixes (an administrator account without two-factor authentication, for example) can often be applied within a few hours, without hardware investment.
NIS2 and regulatory compliance: what the French transposition implies for SMEs
The European NIS2 directive significantly broadens the scope of companies subject to cybersecurity obligations. In France, the transposition of NIS2 is notably delayed, with a blockage lasting over a year according to several specialized analyses. This delay does not exempt the affected companies from preparing.
NIS2 concerns sectors much broader than the previous version: industrial subcontractors, digital service providers, logistics chain companies. An SME working as a subcontractor for a “significant entity” may find itself within the scope without having anticipated it.
Concrete obligations to prepare for now
The directive imposes a formalized risk management, with documentation of protective measures, incident response procedures, and business continuity plans. It also includes an obligation to notify significant incidents within short timeframes.
For an SME, this means moving from an informal approach (“we have antivirus and backups”) to a documented and verifiable strategy. The cost of compliance depends on the existing maturity, but companies that already have a recent audit start with a real advantage: they know their gaps and can target investments.
User awareness: the link that technology cannot replace
The majority of successful intrusions exploit human error: clicking on a phishing link, opening a malicious attachment, transmitting credentials over the phone to a fake technical support. No IT solution, no matter how effective, compensates for an untrained user.
Awareness training is not limited to an annual presentation on risks. Effective programs combine phishing simulation campaigns (sending fake phishing emails to measure click rates), contextual reminders, and clear procedures for reporting suspicious messages.
A often-overlooked point: training must also cover off-site usage. Telecommuting, public Wi-Fi connections, and using personal devices to access company tools create vulnerabilities that network security policies do not automatically cover.
The protection of a company relies on the interplay between three pillars: up-to-date technical tools, anticipated regulatory compliance, and users capable of recognizing an attack attempt. Neglecting any of these pillars amounts to leaving a door open, regardless of the budget invested in the other two.