What is cybersecurity?

You lock the office at night, you insure the premises and you would never leave the company chequebook on the reception desk. Yet most of what your business is worth no longer sits in a drawer: it flows through email, management software, cloud storage and phones. Cybersecurity is the craft of protecting that value.

This first chapter lays the foundations for the whole series. No needless jargon: a handful of solid ideas, concrete examples and official figures.

A simple definition

CybersecurityCybersecurityThe technical, organisational and human measures that protect computer systems, data and people against attacks, mistakes and failures. is the set of technical, organisational and human measures that protect information and systems against unauthorised access, use, disclosure, disruption, modification or destruction. That is, give or take a word, the definition used by NIST, the US standards institute, and it has the merit of being complete.

Three ideas to keep in mind from the start:

• You protect information and services first, not machines. A laptop can be replaced in a day; a leaked customer file never can.
• Technology alone is not enough. Many attacks get in through a person in a hurry, a poorly designed process or a badly protected supplier.
• Zero risk does not exist. The goal is to make attacks hard, spot them quickly and recover from them.

What you protect: assets

Before protecting anything, you need to know what matters. EBIOS Risk Manager, the risk analysis method published by ANSSI, the French national cybersecurity agency, distinguishes two families of assets:

• business assets: what keeps the organisation alive, such as the ability to produce, invoice and deliver, know-how, and customer and employee data;
• supporting assets: what those business assets rely on, such as workstations, servers, email accounts, online applications, premises and people.

A simple exercise for your next board meeting: list the five pieces of information or services whose loss would put you in trouble within a week. You have just drawn your first map of priorities.

The CIA triad: confidentiality, integrity, availability

Security professionals sum up their objectives in three letters, CIA. This is the CIA triadCIA triadThe three core goals of information security: confidentiality (only authorised people can access the data), integrity (the data is not wrongly altered) and availability (it is there when you need it)., the most useful lens in the trade.

Many French frameworks add a fourth property, traceability (or proof): being able to establish who did what, and when. It is what lets you understand an attack after the event.

A single attack often hits several properties at once. Today’s ransomware groups first steal data (confidentiality), then encrypt it (availability), and threaten to publish it if the ransom is not paid.

Threat, vulnerability, risk: three words not to mix up

These three words are often used interchangeably. They mean very different things.

• A threatThreatAny potential cause of an incident, whether an attacker, a piece of malware, a human error or a natural disaster, that could harm your systems or your data. is anything that could cause harm: a criminal gang, a malicious employee, a simple handling error, even a flood.
• A vulnerabilityVulnerabilityA weakness in software, hardware, a configuration or a procedure that an attacker can exploit to gain unauthorised access or cause an unauthorised effect. is a weakness that lets the threat act: unpatched software, a reused password, staff who have never been trained, a backup that has never been tested.
• RiskRiskThe possibility that a threat exploits a vulnerability and causes harm, estimated by combining the likelihood of the event with the severity of its impact. is the possibility of actual harm. It combines the likelihood that a threat exploits a vulnerability with how severe the consequences would be for your assets.

An analogy helps. The burglars in the neighbourhood are the threat. The ground-floor window left ajar is the vulnerability. The risk depends on what lies behind the window: an empty cupboard or the company safe.

Teachers sometimes sum this up with a shorthand formula: risk = threat × vulnerability × impact. It is not a mathematical equation, but it makes the key point: if any factor tends towards zero, the risk goes down. Formal methods such as NIST SP 800-30 or EBIOS Risk Manager follow the same logic by combining likelihood and impact.

Where can you act?

You do not choose your attackers. You do, however, control two levers:

1. Reduce vulnerabilities: apply patches, switch on multi-factor authenticationMulti-factor authentication (MFA)A login that requires at least two proofs of identity of different kinds (something you know, something you have, something you are), so that a stolen password is no longer enough., remove unnecessary access, train your teams.
2. Reduce impact: back up properly, segment the network, prepare a crisis plan, take out insurance.

The sum of all the points through which an attacker might try to get in is called the attack surfaceAttack surfaceAll the points through which an attacker can try to get into your information systems or extract data from them: internet-facing services, applications, accounts, devices, suppliers and people.: websites, email, remote access, cloud accounts, but also suppliers and staff. Every service exposed for no good reason is one more door to watch. Knowing what an attacker sees of you from the internet is an excellent starting point; it is also the idea behind the surface audit that KrakenShield offers.

Defence in depth

Picture a medieval castle. It does not have just one wall: it has a moat, a drawbridge, ramparts, watchtowers, a keep and enough supplies to withstand a siege. If the attacker crosses one line, the next one slows them down, and the lookouts spot them.

Defence in depthDefence in depthA strategy that stacks several independent layers of protection, so that when one fails, the others make up for it. applies the same idea to the digital world. In its methodology sheet of July 2026, ANSSI starts from a simple principle: any component or security control can fail. You therefore need to combine technical, organisational and physical measures that raise the cost of an attack, make it easier to detect and limit its impact. These measures must be multiple, robust and above all independent, so that a single attack technique cannot get round all of them.

The agency organises this approach around four pillars:

One piece of ANSSI advice often surprises people: strengthen governance and resilience first, before improving protection and detection. In other words, knowing your own systems and being able to run in degraded mode comes before buying yet another tool. Once those foundations are solid, a mature organisation can move towards a Zero TrustZero TrustA security model that grants no default trust to any user or device, even inside the network, and checks every access request against identity, device health and context. approach, where no access is granted simply because of where a device sits on the network.

The US NIST Cybersecurity Framework 2.0, published in 2024, says the same thing with six functions: govern, identify, protect, detect, respond, recover. Two frameworks, one logic.

Why every organisation is concerned

The official French figures for 2025 leave little room for doubt.

Behind that total are 27,934 businesses and associations and 5,078 local authorities and public bodies. Requests from businesses and associations jumped by 73% in a year. Their four main reasons:

1. account takeover (21% of requests);
2. phishingPhishingA scam that impersonates a trusted sender (a bank, a supplier, a colleague) by email, text message, phone call or QR code to trick the victim into clicking, handing over credentials or paying. (16%);
3. payment fraud, including fake transfer orders and swapped bank details (13.5%, up 93%);
4. ransomwareRansomwareMalware that encrypts an organisation’s data and demands a ransom to restore it, often also threatening to publish the stolen data. (8.1%), which the platform still describes as the most formidable threat for an organisation.

On ANSSI’s side, 1,366 incidents were reported to the agency in 2025, including 128 ransomware compromises. Its annual threat report is clear: small, medium and mid-sized businesses remain the category of organisation most affected by ransomware.

Data breaches follow the same trend: the CNIL, the French data protection authority, received 6,167 personal data breach notifications in 2025, a record, and one in two resulted from hacking.

Finally, the 2026 edition of Verizon’s Data Breach Investigations Report shows that 31% of breaches now begin with the exploitation of a software flaw. The tools that hunt for those flaws sweep the internet constantly, without looking at the size of the company behind each address.

Costly myths

“We are too small to be targeted”

This is the most widespread myth, and the most dangerous. Most attacks are opportunistic: automated tools try millions of passwords and addresses, and criminals exploit whatever gives way. You are not chosen, you are found. A small organisation is even a convenient target: fewer defences, quick decisions, and sometimes a way in to larger customers.

“We have nothing a hacker would want”

At the very least you have a bank account, an email address your customers trust and a business that stops if your files become unreadable. That is enough for payment fraud, phishing sent in your name or a ransom demand.

“We have antivirus and a firewall, that is enough”

The 2025 SME barometer shows that 84% of the businesses surveyed have antivirus software and 69% a firewall. Yet 80% say they are not prepared for an attack or do not know whether they are. Antivirus will not stop a stolen password being used from abroad, nor a fake bank account number slipped into an email thread.

“That is our IT provider’s job”

The provider implements, but it is management that decides what level of risk is acceptable and that is accountable for it. The GDPR already requires data controllers to apply security measures appropriate to the risk, and the EU NIS2 directive, still being transposed into French law, will strengthen the accountability of senior management in the organisations it covers.

Where to start

The good news is that a few simple measures fend off a large share of everyday attacks. The ANSSI IT hygiene guide and the recommendations of Cybermalveillance.gouv.fr agree on a common baseline:

Cybersecurity is not a project you finish: it is a discipline, like bookkeeping or workplace safety. In the next chapter we look at who the attackers are and what they are really after, because you always defend better when you know your opponent.