Cybersecurity in France 2025: Between Resilience and the Rise of AI-Powered Ransomware

In 2025, France is facing an unprecedented wave of cyberattacks. Ransomware, AI-generated phishing campaigns, and polymorphic malware have become the new weapons of cybercriminals. Yet, the country is not defenseless. Artificial intelligence is now also part of the solution, powering tools capable of predicting and neutralizing threats before they strike. Let’s look back at a turning point for cybersecurity in France.

Explore the full report European Cybersecurity 2025: Toward a Unified Defense in the Age of Generative AI for a detailed overview of the strategies, risks, and technologies shaping Europe’s digital resilience.

---

Cyberattacks in France Surge in 2025

AI-powered ransomware and phishing campaigns

According to the 2025 TPE-PME Cybermalveillance.gouv.fr barometer, 16% of surveyed companies reported at least one cyber incident over the past 12 months. Small and medium-sized businesses (SMEs) remain particularly vulnerable: 40% of ransomware incidents handled or reported to ANSSI in 2024 affected these smaller entities. ANSSI confirms an intensification of ransomware attacks, which represent the majority of reported incidents since the start of the year.

The major shift lies in the massive use of artificial intelligence by attackers. Generative AI models are now capable of crafting highly targeted phishing campaigns that replicate your tone, job title, and even your email signature. In just one click, an AI script can generate convincing messages that mimic your writing style or that of your supervisor.

According to Palo Alto Unit 42, an AI-coordinated attack can now be launched in just 25 minutes, compared to two days previously.

One striking example is the Adecco France case, tried in Lyon in June 2025. As reported by Le Monde and TV5 Monde, a network led by a 22-year-old orchestrated a large-scale cyber scam impacting over 70,000 victims, with total damages estimated at €1.6 million. The group stole small amounts (usually under €50) from clients’ bank accounts, a strategy designed to slip past financial monitoring systems. The Lyon prosecutor’s investigation revealed a highly organized structure using automated tools for access and transaction management, though no direct evidence of AI usage was confirmed.

Cloud, SaaS, and internal vulnerabilities

Another worrying trend is the shift of attack vectors toward cloud environments and SaaS applications. The rise of remote work and collaborative tools has expanded the attack surface significantly. Research from Orange Cyberdefense highlights a spike in data leaks caused by poorly secured or misconfigured accounts.

Threats also come from within. Generative AI tools embedded in office suites have introduced new prompt injection vulnerabilities, where a hidden instruction in a document can trigger unwanted actions. CISOs now warn about “shadow AI” – unsupervised internal use of AI tools that weakens corporate defenses.

---

AI Strikes Back: Smarter Cyber Defense

Next-generation intelligent defense tools

Fortunately, AI is not just used for attacks. French and international vendors are rolling out AI-driven cybersecurity tools capable of detecting, correlating, and neutralizing threats in real time.

• Trend Cybertron, part of the Trend Vision One platform, maps attack vectors and predicts suspicious behavior before damage occurs.
• Thales CyberBoost AI, launched in spring 2025, combines behavioral analytics with automated response mechanisms.
• Orange Cyberdefense Shield 2.0 claims to reduce the average response time by 60% using a predictive model trained on a decade of incident data.

These solutions use EDR (Endpoint Detection and Response) and XDR (Extended Detection and Response) enhanced with AI-based learning. They no longer just raise alerts—they act autonomously, blocking malicious processes, isolating infected machines, and notifying security teams instantly.

Zero Trust and predictive cybersecurity

The Zero Trust security model has become the new standard: trust nothing by default, not even internal traffic. Combined with AI, it relies on real-time evaluation of every connection, file, and user. Behavioral analytics (UEBA) solutions continuously analyze employee activity and immediately flag anomalies, such as logins from unusual locations, irregular hours, or abnormal data exfiltration.

As summarized by Trend Micro Europe, “the shift from reactive to predictive cybersecurity is well underway.” AI now anticipates attacks before they even begin.

---

Regulation and Public Support in 2025

NIS2 Directive enforcement and CNIL sanctions

The European NIS2 Directive officially came into force on October 17, 2024, requiring EU member states, including France, to transpose it into national law by that date. In 2025, France is still finalizing transposition through the “Resilience” bill, led by the Ministry of Economy and ANSSI, aimed at strengthening the cybersecurity of essential service operators and digital service providers. (European Commission – Digital Strategy) (CMS Law – Anticipating the NIS2 Transposition)

The directive imposes stricter obligations on critical sectors such as energy, healthcare, finance, transport, telecommunications, and water infrastructure:

• Implementation of a risk management system and regular audits
• Business continuity and recovery plans
• Mandatory incident notification within 24 hours and detailed reporting within 72 hours (ENISA – NIS2 overview)

In short, NIS2 is already applicable at the EU level, but France is still finalizing its national implementation, expected by the end of 2025.

---

Funding and national cybersecurity programs

The French government is prioritizing digital resilience for both businesses and the public sector.

• Cyber PME, a national initiative run by Bpifrance under the France 2030 plan, helps small and medium-sized enterprises strengthen their cybersecurity posture. It offers a 50% subsidy for cybersecurity audits (4,400 € covered on an 8,800 € pre-tax cost) and funding for up to 70% of the action plan, capped between 30,000 € and 80,000 € depending on project needs. (Bpifrance – Cyber PME) (France Num – France 2030 Cyber PME)
• In healthcare, the CaRE Program (Cybersecurity Acceleration and Resilience of Healthcare Facilities), coordinated by the French Digital Health Agency (DNS), funds hospital infrastructure upgrades, audits, and disaster recovery plans. Although no total budget has been publicly disclosed, multiple calls for projects and grants were launched between 2023 and 2025. (esante.gouv.fr – National Cybersecurity Strategy)
• The Cybermalveillance.gouv.fr portal provides free awareness kits (posters, guides, online tests) for SMEs, local authorities, and individuals. Meanwhile, ANSSI continues to expand cybersecurity education with resources such as IT Hygiene and SecNumAcademie.

These initiatives reflect a clear goal: making cybersecurity accessible and proactive, supporting small organizations and healthcare institutions as well as large corporations.

---

Best Practices and Recommended Tools

Even without massive budgets, every organization can improve its cyber defense strategy.

• Enable multi-factor authentication (MFA) across all critical systems.
• Keep all software up to date, including cloud extensions.
• Test network robustness using tools like CrowdStrike Falcon Free Scan or OpenVAS.
• Train teams through phishing simulation exercises.
• Restrict the use of generative AI to controlled and monitored environments.

Ultimately, digital resilience depends on habits: prevention, monitoring, and quick response.

---

Conclusion

Cybersecurity in France in 2025 has entered a new era. Artificial intelligence is amplifying cyber threats but also empowering defenders to predict and counter them. Between rapid ransomware attacks and automated cyber defenses, the balance remains fragile.

The challenge for the coming years is clear: to move from a reactive mindset to a proactive prevention culture, where every organization, from startups to industrial giants, becomes an active player in its own cybersecurity.

---