From defense to resilience: staying ahead in the age of cyber threats

Q. Where are attackers most likely to get in today? 

Arnaud Marie: Identity management remains a major weak point. And often, the problem comes down to basic security hygiene: keeping user profiles up to date, controlling access rights and managing employee onboarding and offboarding properly. You can invest in multiple layers of protection, but if those processes are not consistently managed across the business, unused accounts and outdated permissions will continue to leave doors open.

Shadow IT is another blind spot, and it goes well beyond AI. Shadow AI gets much of the attention today, but the issue goes much further. Devices, software, browsers, remote sites, temporary environments set up for a particular business need – anything operating outside the company’s knowledge or oversight can create another point of exposure.

Stéphane Anouari: I would actually put social engineering one step earlier. Often, all it takes is tricking an employee – and the techniques aren’t necessarily sophisticated. The breach itself is only the first step. The real question is how far the attacker can go once inside.

Third-party access is another concern. Businesses rely on a network of service providers, some with extensive access to their applications and infrastructure. A weakness in one of those providers can quickly become their own. And with regulations such as NIS2, many suppliers will have to meet new security requirements if they want to keep working with companies directly covered by the legislation.

Q.  Is generative AI fundamentally changing both cyberattacks and cyber defense?

S. A.:  Generative AI is lowering the barrier to sophisticated attacks. Capabilities once reserved for highly skilled hackers are now within reach of far less experienced users. At Black Hat 2026, two OpenAI engineers demonstrated AI agents launching an autonomous attack against the Hugging Face website.

The risks extend inside the business. Without proper data and application governance, generative AI can access and process anything a user has permission to see. If those permissions are too broad, the consequences can be serious.

AI agents deserve particular attention. They’re easy to create, require little technical expertise and can deliver real business value. But an unchecked proliferation of agents brings its own risks. Businesses need visibility into what these agents do, alongside a clear understanding of the value they deliver. That’s the role of agent observability.

A. M.: AI is changing the scale of the game. Attackers can operate at greater scale, at greater speed and at a fraction of the cost. In the past, an attacker might abandon an attempt once the effort outweighed the potential return. AI removes much of that constraint. By automating successive stages of an attack, it makes deeper penetration both faster and cheaper.

Defenders face the same imperative to scale. AI-powered security tools can sift through huge volumes of information, connect seemingly unrelated signals and spot early signs of compromise. Without those capabilities, keeping pace will become increasingly difficult.

Q. As attackers grow more powerful, can organizations still keep pace?

S. A.: There is an undeniable asymmetry between the two sides. A company has finite resources, a complex estate to protect and regulatory obligations to meet. It has to defend every possible entry point. An attacker only needs one.

The response is layered security, less technical debt and Zero Trust architectures that never assume access is safe. But above all, companies need to be able to withstand an attack and recover from it.

A. M.: Cybersecurity is a constant game of adaptation. Every new defense prompts a new way around it. AI is speeding up that cycle for both sides.

No company can promise it will never be breached. What matters is what happens next: how quickly it can restore operations and how much damage it can contain. That damage goes beyond lost data or downtime. It can mean lost revenue, disrupted services and lasting reputational harm. Businesses need to decide in advance what level of disruption and loss they can tolerate. That’s the starting point for resilience.

Q.  How can organizations identify what is truly critical and build resilience around it?

A. M.: Look at the business, not the IT estate. Identify the operations that cannot afford to fail, then trace the data, applications, infrastructure and connections that support them.

Next, establish the limits. How long could each service be down? How much data could the business afford to lose? What would the fallout be for customers, reputation or employer brand?

Those answers should drive backup and recovery priorities. But there’s a catch: critical services depend on other systems, and those dependencies are easily missed.

We worked with a company whose recovery plan looked perfectly sound. Its priority services were clearly identified, but some of the infrastructure needed to bring them back online had been overlooked. One missing component was enough to put the entire recovery plan at risk.

S. A.: Think of airport security. The closer you get to the aircraft, the more stringent the checks. Corporate security should work the same way, with the strongest safeguards around the most critical assets.

That also means moving away from security spending for its own sake. A multimillion-euro investment means little if it doesn’t address the right risks.

ISO 27001 and similar frameworks can help by imposing a more disciplined approach: defining critical assets and aligning risk management, governance, protection and recovery.

Q. Healthcare organizations are particularly exposed to cyberattacks. What makes them vulnerable, and how can they strengthen cybersecurity without compromising patient care?

S. A.: Hospitals face a difficult combination of high staff turnover, shared workstations, fragmented IT and ageing technology.

During one audit, we found passwords displayed directly on shared computer screens to make life easier for staff. It illustrates the practical compromises made in a busy clinical environment.

Medical devices pose an even harder problem. Some rely on obsolete software, yet taking them offline for an upgrade could disrupt care. Others are simply too difficult or expensive to update. The result is a paradox: systems remain vulnerable because hospitals cannot afford to switch them off.

Identity and access management, business continuity and disaster recovery are therefore critical. They’re also among the priorities of France’s national CaRE programme.

A. M.: Hospitals are also exceptionally interconnected. A university hospital works with a wide range of external partners, all needing to access, exchange or enter information.

A hospital’s digital environment is rather like the building itself: lots of people need access, but not everyone should be able to go everywhere.

Controlling that access, managing third parties and gradually tackling technical debt are essential. For public hospitals, though, tight budgets make the necessary investment decisions particularly difficult.

Q. NIS2, DORA, CRA, ISO 27001… How can organizations turn new compliance requirements into a strategic advantage?

A. M.: Companies need a clear view of the requirements they face today, those coming down the line and the certifications that could open up new business.

Not every certification is mandatory. But some become commercial prerequisites. An IT provider working with large enterprises, for instance, may find itself excluded from tenders if it cannot demonstrate the right level of assurance.

Getting ahead of these requirements can strengthen resilience while shortening the path into new markets. It’s as much about commercial opportunity and time to market as it is about compliance.

S. A.: The sheer number of regulations can make the picture confusing. Understanding the rules matters, but security shouldn’t become an exercise in ticking boxes.

Most requirements reinforce familiar principles: strong identity controls, business continuity, resilience and defense in depth. Compliance is important, but it should never come at the expense of sound technology principles.

Q. Looking ahead, which asset organizations must protect to ensure cyber resilience?

A. M.: Data, because it holds much of a company’s knowledge and value, yet that value depends on the services it enables. Businesses need to understand where their data resides, which critical operations rely on it and how it moves through their systems.

The real asset is the entire chain: data, applications, infrastructure and the connections between them. Knowing how to identify, isolate and secure that chain will be central to resilience.

S. A.: People. My concern is that generative AI could gradually erode our cognitive and creative skills without us even realizing it. We’re already seeing signs of that in software development.

If we stop reading, writing, analyzing, learning and making mistakes for ourselves, we risk becoming dependent on synthetic information, applications and architectures.

We could end up relying on systems that no one fully understands – or knows how to fix. At that point, meaningful human oversight may no longer be possible. And once we lose that, we lose control. The challenge is to strike the right balance between informed, responsible AI use, security technology and regulation. That’s how we safeguard the capabilities that must remain human.