In practice, a cyberattack rarely begins with a SOC alert or a flashing dashboard. It usually starts with a user who can no longer open a file, an administrator who loses access to a server, or a business application that suddenly stops responding. It is from these weak, often late signals that incident response teams step in. For the first time, InterCERT France sheds light on this operational reality through a report based on more than 200 real incidents handled by French CERTs. The conclusion is unambiguous: the cyber threat is no longer marginal or exceptional. It has become massive, industrialized, largely opportunistic, and it strikes long before organizations fully realize they are under attack.
Opportunistic and profit-driven cybercrime, far from the APT myth
Far from the media narrative of highly sophisticated and targeted cyberattacks, the majority of observed incidents follow a far simpler logic. Nearly three out of four attacks are opportunistic. Attackers are not looking for a specific organization; they exploit whatever is exposed, vulnerable, or poorly secured at the time.
The dominant motivation is financial. Extortion, resale of access, and data theft structure most of the cybercriminal activity observed. Espionage does exist, but it remains a minority and is concentrated in sectors with high strategic value such as defense, energy, healthcare, the public sector, and aerospace. Where data becomes a strategic asset, attacks become more targeted, stealthier, and longer-lasting.
Ransomware: still central, but more complex than it appears
Ransomware remains at the core of the threat landscape and accounts for nearly a quarter of the incidents analyzed. However, the report challenges a common misconception. Encryption alone has become the exception. In most cases, it is part of a broader sequence involving data exfiltration, partial destruction of backups, and a reconnaissance phase that can last several weeks.
Another key finding is that only one ransomware attack out of two is publicly claimed. The absence of a public claim does not mean there was no data theft or extortion attempt, but often reflects a quieter and more flexible attacker strategy. When ransom amounts are known, they typically range between 100,000 and 250,000 dollars, but most cases remain deliberately opaque.
The Achilles’ heel of organizations: access paths and critical assets
The intrusion vectors observed are depressingly familiar. Unpatched public-facing applications, compromised valid accounts without strong authentication, poorly secured remote access services, and phishing campaigns account for most initial access paths, particularly in smaller organizations.
One constant stands out throughout the report: Active Directory remains the cornerstone of major attacks. When it is compromised, along with administrator accounts or application servers, incidents last longer, cost more, and require far greater reconstruction efforts. Unsurprisingly, nearly three quarters of compromised environments rely on Windows, reflecting a technological homogeneity that makes attackers’ work easier and maximizes their return on investment.
Late detection, heavy response: a structural gap between size and maturity
The report highlights a troubling paradox. The larger the organization, the slower the detection. On average, a very small business detects an incident in about ten days, a small or medium-sized company in just over twenty days, a mid-sized enterprise in nearly a month, and a large organization after more than thirty days. The complexity of information systems, fragmented responsibilities, and extended decision-making chains largely explain this gap.
In ransomware cases, the reality is even starker. In nearly 70 percent of incidents, it is users or system administrators who discover the attack, not security tools. SIEM and EDR solutions account for only a quarter of detections, revealing less a lack of tools than a lack of operational use.
Skills shortage: the real battlefield
In eight out of ten major incidents, organizations acknowledge they lacked the internal skills needed to manage the crisis effectively. The most common gaps involve digital forensics, crisis management, Active Directory expertise, and post-incident reconstruction.
This weakness is particularly pronounced in mid-sized companies, SMEs, and very small businesses, which lack both the budgets and the critical mass to internalize such rare expertise. External CERTs therefore play a central role, but they are too often called in when the crisis is already well underway, sometimes beyond the point of no return.
Backups: the illusion of a safety net
The report delivers a harsh reminder about a persistent myth. In one out of three incidents, backups are unusable at the time of the attack. They may have been encrypted or deleted by the attacker, or they prove to be outdated, incomplete, or never tested under real conditions.
An operational truth emerges clearly: an untested backup is not a resilience strategy, but a fragile assumption.
Communication and authorities: persistent blind spots
Fewer than half of organizations communicate internally during an incident, and only nine percent engage in external communication. Notification of authorities is improving but remains insufficient, especially among smaller organizations that struggle to identify the right contacts or embed these steps into their crisis procedures.
What this report really says
Beyond the numbers, this first incidentology report from InterCERT France delivers a clear message. The cyber threat is no longer exceptional; it is structural. Attackers are no longer chasing technical exploits, but organizational asymmetries: unpatched systems, lack of MFA, unusable logs, and crisis procedures that exist only on paper.
Resilience does not come from piling up more tools, but from earlier detection, effective log usage, trained and readily mobilizable teams, and the ability to act before an incident escalates into a full-blown crisis. This report marks a turning point, shifting from abstract threat narratives to a cold, operational view of the reality experienced by CERTs. One that executives, CISOs, and regulators would be wise to take seriously.
