In early October, several thousand cybersecurity specialists gathered in Monaco for the Assises, the profession’s major annual event. Many expected speeches about artificial intelligence and tomorrow’s threats. Vincent Strubel, director general of ANSSI, France’s national cybersecurity agency, took a very different line. He asked the room a simple question: “Do we sometimes lean too much on buzzwords and not enough on the fundamentals?”

The question was aimed at experts from large organizations. It applies even more to a business with fewer than 10 people. Here is why.

What was said in Monaco: one leak after another, and “basic” flaws

2026 will be remembered as the year of data leaks. Public bodies, large companies, service platforms: cyberattack announcements followed one another. The most telling example was recalled during the speech, as reported by Journal du Net: in August 2026, France’s public finance directorate (DGFiP) suffered a leak affecting 678,000 individuals and businesses, following illegitimate access to its information system.

Basic vulnerabilities, not science fiction

The most striking part is not the figure but the diagnosis. According to ANSSI, the incident report describes flaws that professionals come across every day, everywhere. This was not an extraordinary attack carried out with science-fiction tools, but basic vulnerabilities that had not been fixed.

More attackers, and younger ones

ANSSI’s director general also highlighted a shift: attacks no longer come only from organized criminal groups. Isolated individuals, sometimes very young, are also behind them.

Key takeaway: if a government body with specialized teams can be caught out on the basics, a small business with no IT staff is even easier to catch. The good news: those basics are within your reach.

Why your small business is concerned, even if “you have nothing worth stealing”

It is the sentence we hear most often from small business owners. It rests on a false idea: attackers do not target you for what you are worth, but because you are easy to reach.

What the France Num 2026 Barometer shows

The figures from the France Num 2026 Barometer, published in late September by France’s Directorate General for Enterprise and based on more than 9,000 small and medium-sized businesses, are clear:

39% of small and medium-sized businesses faced at least one cybersecurity incident in the last twelve months;
53% of business owners fear losing their data or being hacked.

Data leaks make scams more convincing

Repeated data leaks increase the risk for you. Your email address, name, phone number, sometimes your company registration number or bank details are already circulating. They are used to craft very convincing phishing messages: a fake supplier invoice, a fake tax letter, a fake call from your bank. The more accurate the data behind a message, the more convincing it is.

For a small business, the consequences of an incident are immediate: email blocked, customer files inaccessible, a diverted transfer, a hacked website. And there is no IT team to take back control the next day.

The 5 fundamentals that close the doors to a cyberattack

No miracle tool here. Five steps, most of them free, that you can put in place in half a day. To go further, our cybersecurity guide for small businesses covers the full foundation.

1. Turn on two-factor authentication for sensitive accounts

It is the most effective measure against password theft. Even if an attacker gets your password, they are missing the code sent to your phone. Yet only 39% of small and medium-sized businesses use it today, according to the France Num 2026 Barometer. We explain how to set it up in our article on passwords and two-factor authentication.

2. One unique password per service, stored in a password manager

Reusing a password is like using the same key for every lock. If one service leaks, all the others fall. ANSSI recommends long passwords of at least 12 characters in its recommendations on passwords. Nobody can remember dozens of passwords like that: a password manager does it for you and is a far better option than a spreadsheet or a sticky note.

3. Let updates install automatically

Many attacks exploit flaws that vendors have already fixed, on computers or software that were never updated. Turn on automatic updates on computers, phones, browsers and the office suite, including Microsoft 365. If you run a WordPress site, its plugins need to keep the same pace.

4. An external backup… that you have tested

Two thirds of small and medium-sized businesses have an external backup (67% according to France Num). That is good, on one condition: knowing that it works. A backup that has never been restored is a promise, not protection. Keep a copy disconnected or isolated from your network, so that ransomware cannot encrypt it along with your files, and run a restore test at least once a quarter. The 3-2-1 rule gives you a simple method.

5. A one-page incident procedure

On the day an incident happens, precious time is lost wondering what to do. Write one page, posted or shared with the whole team:

who to alert internally and at your IT provider;
disconnect the suspicious computer from the network, without switching it off;
change passwords from another device;
alert your bank if you have any doubt about a transfer;
if personal data has leaked, notify the CNIL, the French data protection authority, within 72 hours.

A procedure only helps if everyone knows it: our tips to raise your team’s cybersecurity awareness help you keep it alive. For the personal data side, see where to start with GDPR.

Cybersecurity Month 2026: take action

For Cybersecurity Month, held every October, the whole iokoo team invites you to put these 5 recommendations into practice. And if some of them seem complex, or if you would like support: create your iokoo account.

That is exactly our role: to provide you with complete IT support and secure the IT foundation of small businesses, without jargon and without unnecessary tools. Discover our cybersecurity advisory. Want to know where you stand? Let’s review it together.

Sources

Journal du Net, “Assises de la cybersécurité 2026 : haro sur les fuites de données”, October 8, 2026 (in French).
Directorate General for Enterprise / France Num, France Num 2026 Barometer, press release of September 28, 2026 (in French).
Cybermalveillance.gouv.fr and CNIL, Cybermois 2026 resources, October 1, 2026 (in French).
ANSSI, recommendations on multi-factor authentication and passwords (cyber.gouv.fr, in French).

Cybersecurity Month: what France's top cyber official told the experts, and why it matters for your small business