Cybersecurity for small businesses in Nice and PACA

Because they are the least well defended, not because they are the wealthiest. In its Cyber threat overview 2025, the French national agency ANSSI reports that 48% of the ransomware victims recorded in France are micro, small and mid-sized businesses, against 37% a year earlier — the largest category of victims, ahead of local authorities and healthcare organisations. The agency handled 128 ransomware compromises over the year. A twenty-employee business in Nice or Sophia Antipolis is exactly the profile attackers look for: data that has real value — quotes, payroll, client files — a constrained IT budget, no security officer in house, and often an access route into the systems of a larger customer. Attackers are not targeting you by name: they scan, find a poorly protected remote access or a reused password, and walk in.

A cybersecurity audit is a full assessment of your IT, carried out on site and then delivered in writing. At MZ Informatique it runs in three stages. Half a day on site: inventory of workstations, servers, mobiles and network equipment, verification of the backups and of a real restore, review of user accounts and remote access, check on updates and antivirus. Two to three days of analysis: mapping of sensitive data, password testing, search for public exposure and for leaks already known. A one-hour debrief: a written report ranking each risk by severity and by cost of correction, with an action plan prioritised over three, six and twelve months. Allow a week between the visit and the report. The first audit is free and carries no obligation.

The budget depends on the number of workstations and on the level of protection you are aiming for, but it is costed up front and does not move along the way. For a business in the Alpes-Maritimes with ten to thirty workstations, the costing always breaks down the same way: full security audit — the first audit remaining free; initial remediation, a one-off engagement that closes the gaps identified and puts the backups back in order; protection and monitoring on a monthly retainer, per workstation per month, including managed antivirus, off-site backup, updates and support; staff awareness training, per session. The final quote depends on three factors only: the number of workstations and servers, whether or not there is a file server to secure, and the level of monitoring you want — alerting alone, or guaranteed intervention.

Phishing remains the most used way in, because it does not target the machine but the person in a hurry. Effective awareness training comes down to three things. A real test campaign: we send fake phishing emails calibrated on your business — a bogus supplier invoice, a fake message from the director, a fake banking notification — and we measure who clicks, without ever naming anyone. A one-hour workshop, on site in Nice or by video call, built on the results of the campaign: spotting a forged sender address, checking a link before clicking, responding to an urgent payment request. A written procedure put up on the wall: who to report a suspicious email to, and what to do in the ten minutes after an unfortunate click. A second campaign three months later measures the real progress.

Act in this order, without improvising. One: isolate — unplug the network cable and switch off Wi-Fi on the affected machines, but do not shut them down: their memory holds traces that the analysis depends on. Two: protect the backups by physically disconnecting the drives and cutting off access to remote storage, before the encryption reaches them. Three: call a professional before attempting a restore: a restore started too early reinfects the network. Four: do not pay the ransom — payment guarantees neither the key nor that your data will stay unpublished. Five: report it — a complaint to the police or the gendarmerie, and notification to the CNIL within 72 hours if personal data is involved.