The majority of security incidents in companies do not stem from a sophisticated attack on the core network. They exploit poorly inventoried peripheral equipment, overly broad access privileges, or unmonitored data transfers. Ensuring data security in a company requires addressing these blind spots before deploying visible solutions.
Perimeter Equipment: The Neglected Edge of Corporate Cybersecurity
VPN gateways, firewalls, routers, and servers exposed on the Internet constitute the most exploited attack surface. The 2025 cyber threat landscape published by ANSSI in March 2026 confirms that these devices located at the edge of the information system remain a priority target.
We observe that most security policies focus on workstations and business applications, leaving edge equipment without dedicated inventory. A firewall with firmware that is several months old becomes a silent intrusion vector.
The measures to be applied to this perimeter are precise:
- Maintain a comprehensive inventory of each exposed device (VPN, reverse proxy, Wi-Fi controller), including the firmware version in production and the date of the last update.
- Apply security patches within 72 hours for critical vulnerabilities, prioritizing equipment accessible from the Internet.
- Enable multi-factor authentication on all remote administration interfaces, including SSH access and web consoles of routers.
- Implement centralized logging of incoming and outgoing connections, with alerts on abnormal transfer volumes.
We recommend finding security information at Cyber Vista that details the protection strategies applied to this type of perimeter infrastructure.
Data Exfiltration: Detecting Theft Before Encryption
Ransomware is no longer the dominant threat. ANSSI notes in its 2025 landscape a significant increase in data exfiltration incidents, while compromises through encryption are slightly declining. The attacker copies strategic files and threatens to publish them, without ever triggering a ransomware-type alert.
This evolution changes the game for data protection in companies. A detection system focused solely on malicious encryption misses the majority of thefts. Monitoring must focus on outgoing flows.
Alert Signals on Unusual Transfers
A user account exporting several gigabytes to an external cloud service outside of business hours constitutes a strong signal. Similarly, a surge in DNS queries to recently registered domains may indicate exfiltration via DNS tunneling.
Limiting access privileges remains the most effective lever. Applying the principle of least privilege means that a sales department employee has no reason to access HR databases or technical plans. Each business role corresponds to a strictly defined data perimeter.
Generative AI and Data Security Policy: Framing Internal Uses
ANSSI observes that generative AI lowers the technical level required to launch an attack. Accessible tools allow less experienced attackers to enhance the sophistication and effectiveness of their operations. The risk does not only come from the outside.
Internally, employees use AI assistants to draft reports, analyze spreadsheets, or rephrase documents. Without a clear policy, confidential data flows through uncontrolled public tools.
Concrete Rules for Using AI in the Company
We recommend integrating an AI component into the existing IT security policy, defining three levels:
- Categories of data prohibited in any external AI tool: personal data of employees, unpublished financial information, trade secrets, access credentials.
- Prior validation of each AI extension or plugin installed on workstations, with a register maintained by the IT team.
- Logging access to approved AI tools, to trace requests containing sensitive data and trigger an audit in case of anomalies.
Prohibiting AI tools without offering a validated alternative pushes teams towards shadow IT. It is better to deploy a controlled instance, hosted on infrastructure where you control the data location.
Incident Response Plan: Test Before the Crisis
Having a documented response plan is not enough. A plan that has not been tested for more than six months has gaps in on-call contacts, network isolation procedures, and regulatory notification timelines.
A simulation exercise reveals flaws that no document audit detects. We find that the first simulation consistently highlights coordination issues between the IT team, legal department, and communications.
Checkpoints During a Crisis Exercise
The scenario must include confirmed exfiltration with a threat of publication, not just encryption of workstations. The exercise verifies the ability to isolate a network segment in less than an hour, identify the perimeter of compromised data, and notify the competent authority within the timelines imposed by GDPR.
Training employees makes sense in this context. Rather than generic sessions on best practices, we recommend targeted exercises by business direction, with scenarios adapted to the real risks of each department (targeted phishing for financial functions, social engineering for executive assistants).
Data security in companies hinges on architectural choices, granular access policies, and regular testing. Organizations that treat edge equipment, exfiltration detection, and AI framing as operational priorities significantly reduce their exposure to current threats.
