Low adoption of two-factor authentication

According to a barometer from OpinionWay for Cybermalveillance.gouv.fr, only 26% of the 588 surveyed French companies with fewer than 250 employees had a two-factor authentication solution. This highlights a significant gap in cybersecurity measures among small businesses.

Account hacking remains a top threat

The report indicates that account hacking is the primary threat to companies and associations, with 21% of assistance journeys in 2025, marking a 52% growth. This increase underscores the evolving nature of cyber threats.

Zero Trust model emphasized by ANSSI

The ANSSI published a summary sheet on the Zero Trust model in June 2025, emphasizing systematic authentication as one of the principles of depth defense. The agency outlines five principles of the Zero Trust model, including access to the lowest level of privilege necessary and controlling each request with equal attention, regardless of origin.

Complementary security models advised

The ANSSI rejects the idea of replacing current protection measures, stating that "often, the Zero Trust models and perimeter defense models are opposed, although they are complementary." It advises maintaining current protections while adopting the Zero Trust principle.

Phishing kit compromises accounts

A SME with twenty employees is concerned as soon as an employee accesses their professional mailbox from home, as demonstrated by the BigBear 2.0 phishing kit. In June, the security teams of CloudSEK accessed the administration panel of this phishing service and found that 258 organizations had at least one Microsoft 365 account compromised despite two-factor authentication.

Phishing techniques bypass security

Hackers using this kit replicate the Microsoft 365 login page, allowing victims to validate their two-factor authentication, after which the attacker retrieves session cookies from Microsoft. With these cookies, the attacker accesses the account without additional identity proof.

Regular re-evaluation of access conditions

The ANSSI emphasizes that "access conditions to resources must be subject to regular re-evaluation." It recommends enabling two-factor authentication on the mailbox and file storage, extending it to other services.

Best practices for authentication

Cybermalveillance.gouv.fr advises enabling two-factor authentication whenever possible, preferring passkeys or physical security keys for executive and administrative accounts over SMS codes or notifications. Passkeys replace passwords with a key stored in the device, unlocked by fingerprint or device code.

Additional security recommendations

For services that do not accept passkeys, installing a two-factor authentication app is recommended. Disabling the least secure backup methods, revoking active sessions if an account is compromised, invalidating connection tokens, and changing passwords are also advised.

Password managers gain traction

Adopting a password manager for the entire team is suggested, with 46% of surveyed companies using a password manager, an increase of eight points from 2024. This trend reflects growing awareness of password security.

Monitoring unusual connections

The ANSSI recommends enabling unusual connection alerts offered by mailboxes and designating a person to receive them. Only 16% of the companies in the barometer had an attack detection solution.

Principle of least privilege

The principle of the least privilege, according to the ANSSI, requires granting access based on the lowest level of privilege necessary. Each employee should have the rights corresponding to their position, with administrative rights reserved for a separate account.

Managing access to devices

The ANSSI recommends compiling the list of computers and phones accessing data, including personal ones, and applying security updates as soon as they are offered. If the office suite offers rule-based access management, access to the mailbox should be denied from unregistered devices.

Network segmentation advised

Separating visitor Wi-Fi from the workstations network and placing printers and connected cameras on a separate network is also advised. Micro-segmentation is one of the depth defense principles associated with Zero Trust.

Free cyber diagnostics available

A SME of twenty people can request a free cyber diagnostic from a trained cyber assistant via the ANSSI, which provides six priority measures. For paid offers, the choice should be based on the size of the structure.

Cost of Microsoft 365 Business Premium

Microsoft 365 Online, for example, charges 27.73 euros excluding tax per user and month for the Microsoft 365 Business Premium offer, which includes identity and access management through policies and device management with Intune.

Gradual implementation of Zero Trust

The ANSSI requests a progressive implementation of Zero Trust, noting that shifting access decisions to a centralized infrastructure implies a dependency on a new cross-functional service, which could block access to company data if the service is down.

Controlled adoption of security attributes

It advises controlled and progressive adoption, including "iteratively the different security attributes," starting with the simplest to maintain up to date. The attributes include information on the user, the resource, and the context of the access request.

Accessibility of Zero Trust

According to the Paris-based IT provider Arescom, a Microsoft partner, "Zero Trust has become today accessible and relevant for all structures." The ANSSI notes that the term Zero Trust is a model and does not define the security functions of a so-called Zero Trust technology.