When an SME discovers on a Monday morning that its backups have been encrypted over the weekend, the question is no longer whether cybersecurity is a priority issue. The ransomware has struck, the IT team is improvising, and management realizes that the recovery plan was written on a post-it note. This scenario is increasingly common, even in organizations that thought they had covered the basics.
The cyber news of 2026 is not just a list of vulnerabilities patched or hacker groups dismantled. It highlights concrete gaps between what regulations require, what tools promise, and what on-the-ground teams can actually absorb.
NIS2 in France: an obligation that does not yet exist on paper
NIS2 has been discussed in every webinar for the past two years. Consultants are selling compliance audits, and vendors are displaying “NIS2 ready” badges on their solutions. On the ground, the legal reality is quite different.
The European directive NIS2 (EU 2022/2555) was supposed to be transposed into national law before October 17, 2024. However, as of September 11, 2026, no French transposition law has been enacted. The Resilience bill is still under parliamentary review, with no firm timeline for the publication of implementing decrees.
The direct consequence for French companies: NIS2 obligations are not legally enforceable as long as the law and its decrees are not published. You can follow the news on Cyber Vista to gauge the gap between regulatory announcements and their operational translation.
This does not mean that waiting is an option. Companies already working with European partners subject to NIS2 in their countries (Germany, Belgium, Netherlands) are facing real contractual pressure. Their clients and contractors demand compliance guarantees, French law or not.
DORA and the financial sector: the regulation that truly applies since 2025
While NIS2 is stalling in France, another European text is already having an impact. The DORA regulation (EU 2022/2554) is directly applicable since January 17, 2025, without the need for transposition. It concerns banks, insurers, asset managers, payment service providers, and their critical ICT suppliers.
On the ground, DORA imposes specific requirements for digital operational resilience. IT teams in financial institutions must map their dependencies on third-party providers, regularly test their recovery capabilities, and document every significant incident.
For fintechs and cloud providers serving the financial sector, the change is tangible. A hosting service provider that cannot demonstrate its DORA compliance risks losing its banking contracts. Feedback varies on the actual compliance burden depending on the size of the organization, but the legal framework leaves no ambiguity.
Ransomware in 2026: data theft replaces pure encryption
The 2026 global incident response report from Palo Alto Networks’ Unit 42 documents a notable evolution. Data encryption appears in 78% of reported extortion cases in 2025, down from over 90% between 2021 and 2024.
This decline in encryption does not mean that the threat is weakening. Pure data theft is establishing itself as a full-fledged extortion method. Attackers exfiltrate sensitive files and threaten to publish them, without bothering to encrypt anything. The pressure lies on the victim’s reputation and regulatory compliance, not on the unavailability of their systems.
For defense teams, this shift changes the operational game:
- Detecting data exfiltration (lateral movements, large transfers outside) becomes more critical than just traditional anti-ransomware protection
- Incident recovery plans must include a crisis communication and regulatory notification component, not just backup restoration
- Network segmentation and privileged access control limit the exfiltration surface much more effectively than post-facto decryption solutions
What this changes in daily security posture
It is no longer enough to check that backups are working. Monitoring outgoing network traffic becomes an operational priority. A spike in transfer to an external server at 3 AM should trigger an alert, not a log that no one reviews until Monday.
Offensive AI and targeted phishing: the fastest-growing threat
AI-generated personalized phishing and voice deepfakes are among the fastest-growing attack vectors.
On the ground, it is observed that AI-generated phishing attacks are grammatically flawless and contextualized. A fraudulent email may use the name of an internal project, the writing style of a colleague, or even imitate a manager’s voice during a phone call. A few seconds of voice recording are enough to train a credible model.
In the face of this rise, traditional phishing awareness training shows its limits. Asking employees to spot spelling mistakes no longer works when AI makes none.
- Phishing simulations must include AI-generated scenarios, with realistic contextual pretexts
- Identity verification through a second channel (phone callback, confirmation on internal messaging) remains the most reliable defense against voice deepfakes
- Behavioral detection tools on messaging (analyzing sending patterns, unusual attachments) effectively complement traditional anti-spam filters
SME cybersecurity: a widening gap with large companies
Large companies invest in SOCs, hire analysts, and deploy EDR solutions on every workstation. SMEs, on the other hand, often operate with a general IT provider who manages both the network printer and the password policy.
The majority of French SMEs have neither a dedicated CISO nor a formal incident response plan. When a ransomware attack occurs, the first reaction is to call the usual provider, who does not always have the necessary forensic skills.
Support mechanisms exist (Cybermalveillance.gouv.fr, regional diagnostics), but their adoption remains slow. The main barrier is not the software budget, but human time. In a structure of 30 people, no one has three days to devote to a cyber maturity audit.
The regulatory gap surrounding NIS2 does not help. Without a clear legal obligation, cybersecurity remains perceived as a cost center, not as a condition for operational survival. Recent incidents, data breaches affecting nearly half of the French population according to Cybermalveillance.gouv.fr, should be enough to change this perception.
