PARIS — 14th May 2025 — SecurityScorecard today published its 2025 France Cybersecurity Report, which found that 98 of the country’s 100 largest companies experienced at least one third-party breach in the past 12 months. The report assesses the external cyber risk posture of France’s top firms by market capitalization and highlights persistent exposure across critical supply chain dependencies.
The report, now in its second year, draws on SecurityScorecard’s proprietary data and examines key risk factors such as network security, endpoint hygiene, patching cadence, application vulnerabilities, and DNS health. While some firms have improved internal defenses, the data shows that most breaches are now entering through vendors, not enterprise infrastructure. Key Findings:
SecurityScorecard is trusted by over 3,000 organizations globally, including two-thirds of the Fortune 100. The company is recognized as a trusted resource by the U.S. Cybersecurity & Infrastructure Security Agency (CISA) and supported by leading global investors. Learn more at securityscorecard.com or follow us on LinkedIn.
The report, now in its second year, draws on SecurityScorecard’s proprietary data and examines key risk factors such as network security, endpoint hygiene, patching cadence, application vulnerabilities, and DNS health. While some firms have improved internal defenses, the data shows that most breaches are now entering through vendors, not enterprise infrastructure. Key Findings:
- 98% of France’s top 100 companies were affected by at least one third-party breach in the past year.
- 100% had at least one breached fourth-party supplier.
- Direct breaches dropped slightly—from 7% last year to 4% this year—with insider threats and malware as the primary causes.
- The top 25 companies experienced over twice the number of third-party breaches as the bottom 25.
- 94% of companies with an “A” security rating had no known breaches.
- 29% of companies were rated “C” or lower, down from 40% in last year’s report.
- Construction & Infrastructure: All evaluated companies were rated “C” or below and experienced third-party breaches, indicating a high level of risk.
- Industrial: This sector showed notable improvement, with only 13% of companies rated “C” or lower, down from 42% last year.
- Financial: This sector reported the lowest level of third-party breach exposure, with 93.75% of companies affected—still high, but below the national average.
- Improve visibility into third- and fourth-party relationships.
- Prioritize application and network security as foundational defenses.
- Replace periodic vendor assessments with continuous monitoring.
- Require secure-by-design practices in vendor contracts and procurement.
- Apply strong access controls, multi-factor authentication, and timely patching.
SecurityScorecard is trusted by over 3,000 organizations globally, including two-thirds of the Fortune 100. The company is recognized as a trusted resource by the U.S. Cybersecurity & Infrastructure Security Agency (CISA) and supported by leading global investors. Learn more at securityscorecard.com or follow us on LinkedIn.
