Most articles on corporate cybersecurity run through the same lists of best practices: passwords, updates, backups. These fundamentals are still essential, but they do not address the real risks organizations face today. Data theft without encryption, reliance on critical service providers, and NIS2 requirements are reshaping data protection priorities for businesses.
Internet-exposed attack surface: the audit no one prioritizes
Devices accessible from the Internet remain a particularly exposed entry point. VPN servers, email gateways, NAS or firewall administration interfaces: these components are often deployed and then forgotten during update cycles.
Protection starts with a comprehensive inventory of exposed devices. Every publicly accessible service must be documented, along with its owner, software version, and the date of its most recent patch. Without this inventory, IT security teams are working blind.
Reviewing administrative access is the second part of the process. An administration port open to the Internet without IP filtering or multifactor authentication is a direct vulnerability. We find that this attack surface is rarely addressed as rigorously as workstations or email systems, even though it is the source of some of the fastest compromises.
Businesses that entrust their network infrastructure to an external provider, including Cyberion, gain greater visibility into these blind spots, provided the audit scope explicitly includes peripheral devices and not just application servers.
Cloud provider risk and business continuity: protecting data when a provider goes down
A business can suffer a major incident without any of its own systems being compromised. All it takes is for a cloud provider or critical service provider to be affected, interrupting access to data, business applications, or backups.
Supply chain security is an operational risk in its own right. Addressing this risk means going beyond the standard contractual availability clause. Three areas form the basis of a practical response:
- Map critical dependencies: identify which business processes rely on which providers, and assess the impact of a prolonged outage (file access, billing, customer communications).
- Review incident reporting terms: the contract must specify how quickly the provider will notify you of a breach and what technical information it will share to support the customer’s response.
- Maintain failover capability: keep a usable copy of the data that is independent of the provider, stored in a separate environment and tested at least once every six months.
The most underestimated scenario is a compromised provider that retains legitimate access to the client’s infrastructure. Quickly revoking provider access requires documenting those access rights in advance, along with the associated technical accounts.
Extortion through threats to disclose data, without encryption
Data theft is becoming more prevalent than traditional ransomware. Attackers exfiltrate sensitive information and then threaten to publish it, without ever encrypting systems. Detecting this type of incident depends on monitoring unusual outbound traffic, not on encryption alerts.
Preparing a response to extortion based on data disclosure means identifying in advance which data would cause real harm if leaked: customer data, intellectual property, and contractual documents. This classification determines the level of network monitoring required.
NIS2 and corporate cybersecurity governance: what SMEs need to check
The NIS2 Directive may apply to organizations that do not consider themselves large businesses. Its scope depends on the sector and thresholds that include many mid-sized organizations.
Businesses that may be affected should check whether NIS2 applies to them without waiting for the final national transposition. In France, the Resilience Bill provides for this transposition, but deadlines and national rules are still under discussion. This uncertainty is no reason to delay preparing the foundations for compliance.
In practice, preparation involves two parallel workstreams:
- Governance: appoint a cyber risk management lead, formalize an information systems security policy, and document incident notification procedures.
- Technical measures: network segmentation, patch management, privileged access controls, and centralized logging. These measures overlap with existing best practices but must be documented and auditable.
- Third-party management: NIS2 strengthens requirements for managing the digital supply chain, directly linking to the provider risk described above.
Everyday data protection practices: beyond the basics
Software updates, multifactor authentication, and backups remain the foundation. But their effectiveness depends on how rigorously they are implemented, not simply on whether they appear on a checklist.
An update program that excludes network device firmware leaves a blind spot. A backup that has never been tested through a restore provides no protection. Every IT security measure must be verifiable and verified.
Employee phishing awareness delivers measurable results when it involves regular simulation exercises, rather than an annual presentation. Test campaigns should vary the scenarios (a spoofed supplier, a fake request from management, a malicious link in a collaboration tool) to cover real-world attack vectors.
Separating personal and professional use on mobile devices remains a point of friction. Protection policies that require a work container on personal devices reduce the risk of data leaks without hindering team productivity.
Corporate cybersecurity is not simply a matter of piling on defensive layers. It depends on the ability to identify critical dependencies, detect stealthy data exfiltration, and maintain governance suited to regulatory requirements being rolled out. Organizations that address these three areas in parallel reduce their exposure far more effectively than those focused solely on individual security habits.
