Measuring cyber threats in 2025 first means accepting a paradox: the number of confirmed incidents reported to ANSSI remains close to its previous level, while cases of data exfiltration are increasing. The discreet theft of files is progressing faster than visible attacks like ransomware. For anyone storing personal or professional data, the question is no longer whether an attack will occur, but through which vector it will happen and how long it will remain invisible.
Silent Exfiltration vs. Ransomware: Two Threats, Two Logics
Ransomware encrypts and paralyzes. Its effect is immediate, loud, and often publicized. Data exfiltration, on the other hand, operates in the background: an attacker copies sensitive files without triggering an alert, then threatens to disclose or sell them.
The Cyber Threat Panorama 2025 published by ANSSI on March 11, 2026, shows that exfiltration incidents have increased compared to 2024. This trend changes the hierarchy of protection priorities: restoring a system after encryption is no longer sufficient if the data has already been copied and disseminated.
| Criterion | Ransomware | Data Exfiltration |
|---|---|---|
| Visibility of the attack | Immediate (system blocked) | Often delayed (weeks, months) |
| Attacker’s objective | Direct financial ransom | Resale or blackmail for disclosure |
| Main impact | Business interruption | Leak of personal or strategic data |
| Priority protection measure | Isolated backups, recovery plan | Detection of abnormal outgoing traffic, encryption at rest |
| Average detection time | Several hours | Several weeks depending on the context |
Reducing cybersecurity to merely preventing ransomware is like locking the front door while leaving a window open. Companies that invest in monitoring outgoing data flows, combined with systematic encryption of sensitive files, cover both scenarios. To delve deeper into these defense mechanisms, cybersecurity on Wiki Dark details approaches tailored to each type of threat.
Edge Equipment and Subcontractors: Underestimated Attack Vectors
Firewalls, VPN gateways, and other equipment exposed on the Internet are among the recurring targets identified by ANSSI in its 2025 report. An unpatched vulnerability on an edge device can provide direct access to the internal network without compromising an employee’s workstation.
The other blind spot concerns service providers. The Panorama describes compromises involving subcontractors who had legitimate access to their clients’ systems. A poorly protected supplier becomes an indirect entry point to the contracting company.
Two risk reduction strategies emerge:
- Apply security updates to peripheral devices shortly after their release, prioritizing devices directly accessible from the Internet.
- Restrict and audit access accounts granted to service providers, applying the principle of least privilege (limited access to what is strictly necessary for the task).
- Segment the network so that the compromise of a subcontractor does not grant access to all internal systems.
These measures do not require a significant budget. They are more about organizational rigor than purchasing expensive technical solutions.
Limits of Cyber Statistics: What the Numbers Don’t Say
The data published by ANSSI is based on events brought to its attention. The agency itself specifies that its sectoral distributions do not constitute a comprehensive measure of the threat in France. A small business that falls victim to data theft but does not report the incident does not appear in any panorama.
This opacity complicates the assessment of the real consequences of an incident for small structures. The costs of recovery, loss of business, and potential regulatory penalties accumulate but remain largely under-documented due to insufficient reporting.
Why Underreporting Distorts Risk Perception
When the majority of SMEs do not report their incidents, national statistics mechanically underestimate the actual volume of attacks. Leaders comparing their situation to these public figures mistakenly conclude that the risk remains marginal for an organization of their size.
The combination of massive underreporting and recognized lack of preparedness creates a gap between risk perception and reality. The published sector data serves as a warning signal, not a reliable thermometer.
Data Protection in Business: Measures that Actually Reduce Risk
Encrypting data at rest and in transit remains the first technical barrier against exfiltration. A stolen encrypted file has no value for the attacker if they do not possess the decryption key. Asymmetric encryption (a public key for encryption, a private key for decryption) is suitable for exchanges between partners, while symmetric encryption (a single shared key) is better applied to internal storage.
Detecting abnormal behavior on the network constitutes the second pillar. A massive file transfer to an external server at three in the morning should trigger an automatic alert. Without this monitoring, an exfiltration can last for weeks without being detected.
Team training closes the loop. Compromised access through phishing remains a frequent entry vector. An employee who identifies a fraudulent email interrupts the attack chain before it reaches the systems.
Data protection does not rely on a single tool but on the coherence between encryption, network monitoring, access management, and awareness. Companies that neglect one of these links leave an exploitable attack vector, regardless of the budget invested in the others.
