SME cybersecurity: threats, security measures and handling an attack

by Antoine El Khawand | 1/11/2026 | Software

Key takeaways:

According to ANSSI, SMEs, very small businesses and mid-sized companies remain the category most affected by ransomware. Account hacking dominates the assistance requests from businesses and associations.
The baseline of good practices relies on multi-factor authentication and updates. It also includes an offline backup and limited access rights.
Bpifrance subsidizes 50% of an 8-day Cybersecurity Diagnostic for SMEs with more than 10 employees. The remaining cost is €4,400 excl. VAT per site.
To be compensated by its cyber insurance, the victim must file a complaint within 72 hours. A personal data breach posing a risk must also be notified to the CNIL within 72 hours.
The transposition of NIS 2 is still under way in France in October 2026. Medium-sized companies in the 17 sectors concerned are among the important entities.

Phishing, account hacking, fake bank details, ransomware: SMEs face multiple threats with few resources. Yet IT security for an SME relies on well-known security measures. Multi-factor authentication, updates, offline backups and access control form this baseline. In the event of an attack, three steps matter a great deal: 17Cyber, a complaint within 72 hours, and possible notification to the CNIL. How can managers of small businesses and SMEs strengthen their company’s cybersecurity?

Why SMEs have become prime targets for cybercriminals

ANSSI’s 2025 cyber threat overview lists 128 ransomware compromises. SMEs, very small businesses and mid-sized companies remain the most affected category, with almost half of the victims (48%). According to the France Num 2026 Barometer, 39% of small businesses and SMEs suffered a cybersecurity incident within a year. And 53% of managers fear hacking or data loss.

SMEs’ resources remain limited in the face of these risks. In 8 out of 10 small businesses and SMEs, the manager handles IT personally, according to Cybermalveillance.gouv.fr. The share drops to 47% between 10 and 49 employees. An IT director is in charge in 41% of organizations with 50 or more employees. Yet every company holds valuable data: customer files, quotes, invoices, payroll.

The impact of an attack goes beyond the technical. ANSSI’s guide cites data theft, ransom, reputational damage or sabotage. For a company, reputational damage can lead to a loss of customer trust. The business tools that host this data therefore become entry points to protect. At Cirrus Shield, the page on data security for a CRM hosted in France details these protections. It mentions encryption in transit and at rest, and the login history.

The main cyber threats to businesses

Cybermalveillance.gouv.fr’s 2025 activity report ranks the assistance requests from businesses and associations.

Infographic of the cyber threats most reported by businesses and associations in 2025: account hacking, phishing, transfer fraud, ransomware — The four threats most reported by businesses and associations to Cybermalveillance.gouv.fr in 2025

Phishing and account hacking

Account hacking comes first with 21% of assistance cases, up 52%. Phishing follows with 16%. A booby-trapped email captures a user’s credentials, then opens access to the information system.

Transfer fraud and fake bank details

Transfer fraud is in the top three with 13.5% of assistance cases, up 93%. It covers CEO fraud, creditor impersonation and bank detail changes.

Ransomware and supply-chain attacks

Ransomware encrypts files and then demands a ransom. It accounts for 8.1% of requests from businesses and associations, a slightly rising volume. Cybermalveillance.gouv.fr sees it as the “most formidable and most damaging” threat for an organization. Service providers also act as relays for attacks. In 2025, ANSSI saw an attacker move from a provider’s system to the systems of several of its customers.

Security measures recommended by ANSSI

The French National Cybersecurity Agency (ANSSI) publishes a cybersecurity guide for small businesses and SMEs. Written with the Directorate General for Enterprise, it is titled “La cybersécurité pour les TPE/PME en 13 questions” (Cybersecurity for small businesses in 13 questions). The table summarizes its good practices and solutions.

Protection measure	Risks reduced	Guide benchmark
Multi-factor authentication (MFA)	Account hacking, phishing	Enabled on every compatible service: email, banking, cloud
Strong, unique passwords	Brute force, credential reuse	9 characters minimum, 15 for critical services
User accounts without admin rights	Installation of malicious code	Access revoked when each employee leaves
Automatic updates	Exploitation of vulnerabilities	Patches applied as soon as they are released
Antivirus	Known malicious code	Automatic update of the signature database
Firewall and encrypted VPN	Spread across the network, remote access	Connections between workstations blocked by default, IPsec or TLS VPN
“3-2-1” backups	Ransomware, hardware loss	3 copies on 2 media, including 1 offline

Identities, updates and firewalls

The overall level of protection remains stable. According to France Num, 84% of small businesses and SMEs report at least one protection measure, as in 2025. MFA adoption is progressing, however: 47% of them, up 9 points since 2024. A local firewall slows an attacker’s movements across the network. For remote work, an encrypted virtual private network (VPN) remains recommended. In 2024, more than half of ANSSI’s cyber defense operations stemmed from flaws in edge equipment. Firewalls and VPN gateways are part of it.

Offline backups

A backup connected to the network remains exposed: ransomware can encrypt it. Hence the offline copy required by the “3-2-1” rule. Restores should also be tested regularly. After encryption, only intact backups make it possible to restart business activity quickly.

Antivirus, EDR and intrusion detection

Antivirus is a first line of defense against known malicious code. An EDR (endpoint detection and response) adds detection of suspicious behavior on the company’s workstations. These cybersecurity solutions have their limits: some attackers adapt their tools to evade detection. MFA also fails if the user’s device is already compromised. User training therefore complements cybersecurity tools.

Organizing an SME’s cybersecurity: internal lead, provider, diagnostic

Security solutions have little effect without oversight or training. The topic ties in with IT management for an SME without a dedicated department. To strengthen the cybersecurity of small businesses and SMEs, the approach relies on three levers.

An internal lead and an identified provider

Without an IT director, an internal lead monitors the security plan, access rights and providers. Official recommendations advise identifying an incident response provider in advance. According to France Num, 65% of affected small businesses and SMEs handle the incident internally, 31% with an external provider.

Cybermalveillance.gouv.fr’s ExpertCyber label is awarded after an audit by AFNOR Certification. It covers securing systems, maintaining security and post-incident assistance. The Mon ExpertCyber service puts companies in touch with these providers. Chambers of commerce (CCI) and chambers of trades (CMA) can also direct companies to suitable assistance.

From a free test to a subsidized cyber diagnostic

The first step is to measure the level of cyber maturity. On MesServicesCyber, ANSSI offers a three-minute test and a “cyberdépart” diagnostic. The latter lasts one hour and is free, with a volunteer cyber helper.

Bpifrance funds a more in-depth cyber diagnostic, promoted by France Num. The Cybersecurity Diagnostic targets independent SMEs with more than 10 employees. In 8 days, an expert assesses the maturity of practices and the vulnerability of the company’s assets. The cost is €8,800 excl. VAT per site, subsidized at 50%, i.e. €4,400 excl. VAT. The action plan ranks measures by their impact on the security level and prepares crisis management.

Budget is among the most frequently cited obstacles, according to Cybermalveillance.gouv.fr. Among poorly prepared companies, 61% mention it, just behind a lack of expertise (63%).

How to respond to a cyberattack

Cybermalveillance.gouv.fr and ANSSI’s guide describe a sequence of reflexes when facing ransomware:

cut the Internet connections of the attacked network, without switching off the affected machines;
unplug connected backups to preserve them;
alert your usual provider or the 17Cyber service, available 24/7;
do not pay the ransom, as payment guarantees neither data recovery nor non-publication;
file a complaint before any reinstallation, to preserve technical traces;
keep a log: date, time, author and description of each action.

Complaint and insurance: the 72-hour deadline

Article L12-10-1 of the French Insurance Code, introduced by the law of January 24, 2023, governs this point. Compensation for losses linked to a cyberattack requires a complaint within 72 hours. The deadline runs from when the breach becomes known. The rule applies to legal entities and to professionals in the course of their activity.

Data protection: notifying the CNIL

Notifying the CNIL is a separate step from filing a complaint. A personal data breach presenting a risk must be notified within 72 hours. The detailed procedure is in the article on the GDPR compliance process for an SME.

The regulatory framework: GDPR and the NIS 2 directive

Article 32 of the GDPR already requires security measures “appropriate” to the risk. It mentions encryption, system resilience and restoring access to data.

The NIS 2 directive strengthens the cybersecurity obligations of companies in 17 sectors. Medium-sized companies in these sectors are classed as important entities. Micro and small companies are excluded, except in specific cases. Entities in scope will have to register, manage their risks and report their incidents.

In France, transposition is still under way. The Senate passed the bill on March 12, 2025. As of October 28, 2026, the National Assembly’s legislative file mentions no adoption in plenary session.

FAQ: IT security for SMEs

Why are SMEs prime targets for cyberattacks?

They hold valuable data with limited protection resources. ANSSI’s 2025 overview ranks SMEs, very small businesses and mid-sized companies as the top ransomware victims.

Which IT security measures should an SME implement first?

ANSSI’s guide notably cites multi-factor authentication, updates and offline backups. Add user accounts without admin rights, a firewall and staff training.

How much does a cyber diagnostic cost for an SME?

Bpifrance’s Cybersecurity Diagnostic costs €4,400 excl. VAT per site after the subsidy. The one-hour “cyberdépart” diagnostic is free.

Should you pay the ransom after a ransomware attack?

No, Cybermalveillance.gouv.fr recommends not paying.

Is an SME concerned by NIS 2?

A medium-sized company in one of the 17 sectors concerned is classed as an important entity. The French transposition law is still being debated in Parliament in October 2026.