SMEs and mid-sized companies targeted by ransomware

According to the ANSSI 2025 Cyber Threat Outlook, small and medium-sized enterprises (SMEs) and mid-sized companies (ETI) were the first category of victims of ransomware treated by the agency in 2025, with 37% of the cases. Hackers often exploit vulnerabilities in firewalls, virtual private networks (VPNs), or stolen employee credentials to gain access.

Penetration tests simulate cyberattacks

A penetration test, or pentest, is a simulated attack against a computer system conducted by an ethical hacker, a specialist in information security. The hacker looks for vulnerabilities before criminals and documents the findings in a report for the company.

Authorization is required for a pentest

Before a pentest begins, a company must obtain written authorization from the provider. Without this, the expert could be committing an unauthorized access to a computer system, which is punishable by three years in prison and a fine of 100,000 euros under article 323-1 of the Penal Code.

ANSSI sets standards for security audits

In version 2.2 of its PASSI reference framework, published in November 2024, the ANSSI sets requirements for service providers of information system security audits. The agency lists qualified firms on its platform MesServicesCyber, and companies can check a firm’s qualification before signing a quote.

Costs of pentests vary

The price of a pentest is not regulated, and firms charge based on the number of working days of their expert, including report writing. For example, Bpifrance's Diag Cybersécurité offers a diagnostic for SMEs at 4,400 euros HT, covering eight days of testing and analysis.

Pentests vary in scope and complexity

A firm calculates its quote based on the area to be tested. Testing a website may take a few days, while testing the internal network of several offices takes longer. It is important to specify the number of days for manual testing, as automated scans may be billed as pentests without expert involvement.

Free preliminary assessments available

Before paying for a pentest, companies can get a free preliminary assessment from the ANSSI Cyber Depart diagnostic. This service provides six priority measures to improve cyber security and can be conducted in person or via video conference.

Pentest reports are detailed

At the end of a pentest, the firm provides a report in two parts. The summary is for management, highlighting the company’s risk level and major vulnerabilities, while the technical part details each vulnerability, how it was exploited, and the recommended corrections.

Gray box testing simulates real threats

In gray box mode, the pentester uses an ordinary employee’s account to simulate how far a hacker with stolen credentials could go. This mode can reveal weaknesses like weak passwords or inactive accounts, which were the first threat reported by companies in 2025.

Fixing vulnerabilities requires planning

To address vulnerabilities, a company should request an oral presentation of the report with its IT provider. Each critical vulnerability should be translated into a business scenario, and a correction plan with costs and deadlines should be created. Focus on internet-exposed equipment first, as they are a main entry point.

Ransomware use is declining

In its 2025 panorama, the ANSSI noted a decrease in ransomware use, with a shift toward data exfiltration. The number of cases treated by the agency increased from 130 to 196 in one year, showing a growing threat from data theft.