Businesses and individuals are producing an ever-increasing volume of digital data every day. The European regulatory framework has become denser: in addition to the GDPR, NIS2 for critical sectors, DORA for finance, and the AI Act for artificial intelligence systems have now been added, with staggered implementation timelines. In this context, data security is no longer just about antivirus software or a strong password. It involves choices regarding architecture, governance, and continuous verification.
Targeted Backups by Attackers: A Blind Spot in Protection Strategies
Most cybersecurity guides recommend regularly backing up files. This advice remains valid, but it masks a more recent problem. Field reports show that backup infrastructures are now a primary target for attackers. The goal is no longer just to encrypt active files but also to neutralize backup copies, making any recovery impossible without paying a ransom.
This evolution changes the game for IT teams. Having a backup is no longer sufficient if it is accessible from the same network as production systems. The immutability of copies (the inability to modify them after writing) and their physical or logical isolation become criteria for choosing any storage solution. It is also recommended to regularly test the effective restoration of data, as a backup that cannot be restored is not a backup.
To delve deeper into these issues, security information on Open Syd details several approaches suitable for businesses and freelancers.
Digital Supply Chain and Risks Related to Service Providers
Recent regulations, led by NIS2, expand the scope of responsibility well beyond the internal information system. Risk assessment related to suppliers and subcontractors is now part of the obligations for the entities concerned. A poorly secured cloud provider, a SaaS tool storing personal data without adequate encryption, a third-party access not revoked after the end of a contract: these are all vulnerabilities that digital solutions must cover.
In practical terms, this involves several checks before entrusting data to a third party:
- Examine the security certifications of the provider (ISO 27001, SecNumCloud qualification, or equivalent) and verify their exact scope.
- Contractualize notification obligations in case of an incident, with specific deadlines and commitments to transparency.
- Provide for a reversibility mechanism: the ability to recover all data in a usable format if the provider changes its terms or ceases operations.
- Regularly audit third-party access, removing those that are no longer justified.
Field reports vary on the actual capacity of SMEs to conduct these audits systematically. Cost and complexity remain barriers, prompting some organizations to pool these assessments through sectoral groups.
Regulatory Compliance: GDPR, NIS2, DORA, and AI Act in Practice
The stacking of European texts creates a concrete difficulty for businesses: each regulation covers a different scope, with obligations that partially overlap. The GDPR governs the processing of personal data. NIS2 imposes cybersecurity measures on so-called “important” entities. DORA specifically targets the digital resilience of the financial sector. The AI Act adds constraints for high-risk artificial intelligence systems.
For a company using an AI tool processing personal data in a sector covered by NIS2, these three texts apply simultaneously. Compliance digital solutions attempt to automate part of this work: mapping processes, activity registers, detecting discrepancies. The available data does not yet allow for measuring the actual long-term effectiveness of these tools, but their adoption is progressing in mid-sized organizations.
What the AI Act Changes for Data Protection
The AI Act introduces a classification of AI systems by risk level. High-risk systems (automated recruitment, banking scoring, intelligent video surveillance) must comply with requirements for transparency, traceability, and governance of training data. An AI model trained on biased or poorly protected data exposes the company to sanctions under both the AI Act and the GDPR simultaneously.
The CNIL has published guidelines on the interplay between AI and personal data protection, particularly for so-called “agentic” systems (autonomous AI capable of chain actions). These clarifications are recent, and their operational translation remains to be built for many organizations.
Digital Solutions for Threat Detection and Response
Detection tools have evolved beyond analyzing known signatures. EDR (Endpoint Detection and Response) and XDR (Extended Detection and Response) solutions correlate events across multiple layers of the information system: workstations, messaging, network, cloud. Detection now relies on behavioral analysis, allowing for the identification of novel threats that do not match any listed signature.
However, these solutions generate a volume of alerts that teams must sift through. Without a clear qualification process, the risk is to overwhelm analysts with false positives or, conversely, to miss a real incident lost in the noise. Automating the sorting (via rules or AI) helps, but it does not eliminate the need for human expertise in critical decisions.
The choice of a security solution is not made based on a list of features. It depends on the size of the organization, the sensitivity of the data processed, the applicable regulatory framework, and the actual capacity of teams to use the tool on a daily basis. A poorly configured sophisticated tool offers less protection than a simple tool that is well maintained. This is where most incidents originate, far more than from a spectacular technological flaw.
