The attack surface of a company is no longer limited to its workstations. Strengthening cybersecurity in 2024 requires addressing angles that most guides overlook: network equipment exposed on the Internet, silent data exfiltration, and supplier risk. Here, we detail the technical axes that concretely change the defense posture.
Exposed network equipment: the entry point that companies underestimate
Firewalls, VPN concentrators, email gateways: these devices are directly accessible from the Internet and constitute prime targets. The Cyber Threat Panorama 2025 published by ANSSI on March 11, 2026, confirms that vulnerabilities on these perimeter devices remain a major intrusion vector.
The problem is not the absence of a firewall, but its obsolescence. A firmware that hasn’t been patched for six months on a VPN box offers an entry point as wide as a server without a password. The most cost-effective operational measure is to maintain a comprehensive inventory of exposed services and to apply patches shortly after publication.
Regularly checking open ports from the outside, disabling administration interfaces accessible on the Internet, and segmenting incoming traffic by trust zone: these actions reduce the attack surface without additional software investment. To explore solutions tailored to your context, you can visit the Cyber Vista site, which details various network protection approaches.
Data exfiltration: monitor outgoing traffic, not just incoming
The majority of cybersecurity strategies focus on blocking intrusions. ANSSI notes in its latest report a rise in data exfiltration incidents, while ransomware compromises have slightly declined. Silent data theft is becoming more frequent than ransomware encryption.
In practical terms, an attacker who has gained a foothold in the network can copy customer databases, contractual documents, or intellectual property without ever triggering an alert if no monitoring of outgoing traffic is in place. DLP (Data Loss Prevention) solutions or detection rules for abnormal transfer volumes to unusual destinations become a necessary complement to backups.
Indicators to monitor on the network
- Unusual outgoing data volumes outside of working hours, especially to geolocated IP addresses outside the company’s usual perimeter
- Mass or sequential access to sensitive file directories by a single user account over a short period
- Outgoing connections from internal servers that normally do not need Internet access (database servers, domain controllers)
These weak signals, correlated in a SIEM or network detection tool, allow for the identification of ongoing exfiltration before the damage becomes irreversible.
Supplier risk and software supply chain
A company’s cybersecurity stops where that of its service providers begins. The ANSSI report describes compromises through service providers, placing third-party risk management as an operational priority, not just a contractual one.
A SaaS vendor whose infrastructure is compromised, an integrator with permanent VPN access to your network, a subcontractor storing your data on a poorly segmented shared environment: each link adds an attack vector. The NIS 2 directive, which is currently under examination for transposition into French law, further strengthens the obligations for managing supplier-related risks for the entities concerned.
Concrete measures for managing third-party risk
Require each critical service provider to have a documented incident response plan. Limit remote access to the strict minimum with a Zero Trust approach applied to supplier accounts: mandatory multi-factor authentication, time-limited sessions, complete logging.
Integrating a security audit clause into contracts allows for periodic verification that the provider maintains a level of protection consistent with the sensitivity of the data processed. Without this visibility, the company delegates its security without any means of control.
Authentication and user management: beyond the password
Multi-factor authentication (MFA) is no longer an option; it is a prerequisite. Phishing attacks heavily target user credentials, and a password alone, even complex, does not withstand a well-crafted phishing campaign.
Phishing-resistant MFA relies on hardware keys or FIDO2 protocols, not just a simple SMS. Codes sent via SMS remain vulnerable to SIM swapping techniques. For privileged accounts (system administrators, access to sensitive data), switching to physical tokens or local biometric authentication significantly reduces the risk of compromise.
- Deploy MFA on all remote access (VPN, cloud applications, email) as a priority, then extend it to critical internal access
- Immediately revoke accounts of employees who have left the company, including associated service accounts
- Segment access rights according to the principle of least privilege: each user accesses only the resources necessary for their role
Identity and access management (IAM) forms the foundation upon which any information system protection strategy rests. Without control over who accesses what, other security layers lose much of their effectiveness.
Strengthening a company’s cybersecurity in 2024 does not involve piling on tools but rather methodically covering blind spots: perimeter equipment, outgoing traffic, supplier chain, and strong authentication. It is these technical foundations, maintained over time, that make the difference against increasingly opportunistic attackers.
