Cyber Threats : A High, Systemic and Sustained Risk
ANSSI Threat Landscape 2025 : What Does It Mean For SMEs ?
Each year, ANSSI (French National Cybersecurity Agency) publishes its cyber threat landscape report whre it analyzes the main trends observed from incidents handled or reported to the agency.
The conclusion of the 2025 edition is clear : “the level of cyber threat remains high, affects everyone, and involves attackers who are increasingly difficult to track.”
ANSSI describes a “systemic” threat.
This means cyber threat now affects the entire economic and social fabric, not just a few targeted organizations.
In addition, this cyber threat is no longer temporary. It is a lasting trend.
The report also highlights that attacks are often opportunistic.
Cybercriminals target many organizations without specific sector focus, although education and healthcare are among the most affected sectors in 2025.
As the report is dense and technical, we provide a clear, jargon-free overview in this article. We highlight six key trends with a direct impact on SMEs.
Then, we outline practical ways to anticipate and respond.
Cyber Threat Developments Directly Impacting SMEs
1. SMEs remain the primary victims of ransomware
Ransomware (attacks involving a ransom demand) remains a major threat according to the report.
Since 2021, SMEs have consistently been the most affected category. In 2025, they represent 48% of ransomware victims — nearly 1 out of 2.
At the same time, the report highlights the strong increase in data theft extortion.
In this scenario, attackers do not always block systems.
They simply threaten to publish stolen data.
As ANSSI reminds, this creates significant reputational risk.
It can affect customer trust and even the company’s survival.
“These data exfiltrations – whatever their nature – and their public exposure create a substantial reputational risk for victims.
They may lose customer trust or see their economic survival affected.”
— ANSSI Cyber Threat Landscape 2025
2. AI can accelerate attack capabilities
ANSSI highlights that generative AI can act as a force multiplier for attackers.
For example, it can spread disinformation at scale, create fake company or employee profiles on social media or generate more convincing phishing content.
AI can also be used for victim profiling or malware design.
However, ANSSI states that these tools are mainly used as assistants today, not as fully autonomous attack systems.
3. Attacks become more stealthy and harder to detect
Highly visible attacks have not disappeared. But an increasing share of compromises is now more stealthy.
Attackers increasingly use legitimate services — cloud, remote access tools, web services — to blend into normal traffic and avoid detection.
They can stay inside an information system for months before exfiltrating data or launching a visible attack.
For companies, this means some intrusions may remain undetected for long periods, making threat detection more complex.
4. Social engineering techniques are more sophisticated
With AI and increasingly advanced techniques, social engineering becomes harder to detect.
For example, the “ClickFix” technique is rising sharply in 2025.
It tricks employees into executing malicious commands themselves, disguised as technical messages (e.g. fake captcha).
“Without requiring high technical skills, attackers continue to exploit human biases, notably by relying on the willingness of targeted individuals.”
— ANSSI Cyber Threat Landscape 2025
5. Suppliers are an increasingly exploited entry point
Using a supplier to reach a target company has been a known method for over ten years.
The 2025 report shows a rise in attacks through suppliers (ex. Cloud) and IT service providers within the supply chain.
By compromising a supplier, attackers can access their clients’ systems or data.
For SMEs, this means their security also depends on the security level of their providers and suppliers.
6. Cybersecurity will be a market requirement
ANSSI highlights that several European regulations — notably NIS2 and the Cyber Resilience Act (CRA) — aim to raise the overall cybersecurity level.
In the financial sector, DORA (Digital Operational Resilience Act) is applicable.
These regulations will also impact many SMEs.
Even when not directly in scope, SMEs will face higher security requirements from clients, contractors, or partners.
How To Anticipate Instead Of React ?
The 2025 report shows one simple reality.
For SMEs, the question is no longer whether they may be targeted.
The question is whether they are ready to withstand and recover from an incident.
In other words, SMEs cannot focus only on preventing attacks.
They must also be ready to respond and continue operating if an attack occurs.
We structure this approach around four key stages of cyber resilience : identify, secure, prepare, remediate.
1. Identify weaknesses before attackers do
The report shows that security cannot rely only on technical tools.
Attackers also exploit organizational weaknesses, human errors or poorly managed dependencies.
For SMEs, this calls for a global security assessment covering technical, organizational, and third-party aspects.
2. Secure : people and technology
Since attackers exploit both technical vulnerabilities and human behavior, cybersecurity must address both :
- Technical : secure access to systems and maintain appropriate protection levels
- Organizational : raise employee awareness, as attackers often rely on deceiving users
3. Prepare : governance and documentation
The 2025 trends confirm that a cyberattack is not just a technical issue.
It can stop operations : production halted, employees inactive, customer trust lost.
This makes cybersecurity a leadership issue.
It becomes part of corporate governance, further reinforced by new regulations.
ANSSI also stresses that preparedness is critical.
This depends not only on technology, but on clear internal organization.
Even for SMEs, this means having :
- Cybersecurity governance : set priorities, supervise projects, define roles and responsibilities
- Documented continuity plans : procedures to avoid improvisation when systems are unavailable
4. Remediate : manage the consequences of an attack
ANSSI reminds that remediation — cleaning a system after an attack — is complex.
It requires identifying and removing all attacker access points to prevent re-entry through a backdoor.
This phase often requires specialized expertise and depends heavily on prior preparation.
In summary
In a context of persistently high cyber threat, cybersecurity for SMEs is no longer just a technical matter.
It becomes a condition for business continuity in an environment where attacks continue to rise.
For business leaders, the question is now strategic.
How will the company continue operating if an attack occurs ?
This reality also comes with rapidly strengthening European regulation that also affects SMEs.
In our next articles, we will analyze what these regulations concretely change for SMEs.
Author
Lai Ly
SME Cybersecurity Governance Specialist
Financial Services sector Specialist
Contributeur
Stéphane Hivert
SME Cybersecurity Specialist
E‑commerce, Industrial sector Specialist
Disclaimer
This report is provided for informational purposes only and reflects the author’s opinion at the time of analysis.
It does not constitute legal or regulatory advice and does not guarantee the absence of risks or vulnerabilities.
Threats and risk levels may evolve over time.
Any decisions taken on the basis of this report remain the sole responsibility of the reader.