Why we do more than the regional standard (and what it costs)

A prospective client put the question to us bluntly: “You are more expensive than the agency next door for hosting the same site, why?”. The honest answer takes an article. Not because the agency next door does poor work: the market standard for SME hosting and managed services is what it is, and it was set at a time when attackers were not agents. Here are the figures, the local precedents, and line by line what we do differently.

Where French SMEs really stand #

The 2025 barometer from Cybermalveillance.gouv.fr, the French government’s cybercrime assistance service, carried out by OpinionWay among 588 companies with fewer than 250 employees, leaves no room for doubt. 26% use two-factor authentication to connect remotely to the company network. 16% have an attack detection system. 31% have an incident response procedure, and nearly half admit they are not prepared. 78% report having “backups”, without anyone knowing where they are or whether they have ever been restored. And yet 44% feel highly exposed: the awareness is there, the tooling is not. On the ANSSI side, the 2025 threat overview ranks small businesses, SMEs and mid-sized companies as the leading category of ransomware victims, with nearly half of the compromises known to the agency.

Alsace is not spared, it is on record #

• 14 February 2020, Grand Est Region. Ransomware paralysed the workstations of 7,500 staff in Lorraine, Champagne-Ardenne and Strasbourg for more than a week.
• September 2022, European Collectivity of Alsace. A legitimate account hijacked in early September, a malicious loader, then Cobalt Strike to map the network. Detected on 29 September just as the attack tool was being deployed, according to the CISO: around a hundred machines out of 6,500, and a five-day IT shutdown decided in order to investigate. What saved the authority was detection, exactly what 84% of SMEs do not have.
• Night of 6 to 7 September 2023, Strasbourg. The Fondation Vincent de Paul, some thirty healthcare, childcare and elderly care facilities, saw its information system knocked out; Strasbourg’s emergency departments absorbed the overflow.
• March 2025. “Strasbourg is attacked every week”, sums up the city’s deputy mayor in charge of technology, phishing and denial of service included. The same article notes that over seven city council meetings, more than a hundred hours of debate, less than ten minutes were spent on cybersecurity.

These organisations have IT departments, budgets and providers. A twenty-person SME with a brochure website, a business tool and a mailbox on a shared hosting plan has none of that, and it is on the same map, at the same distance from the same attackers.

⟷ scroll sideways

Line by line: what we do on top #

• One isolated machine per site or application. No shared hosting where a compromised neighbour becomes your problem: each client lives in its own machine, on a segmented network behind a single entry point, on dedicated servers in France.
• Backups out of reach. The 3-2-1 rule with an immutable copy on a separate backup server, tested restores, and probes that check every night that the backup really took place. Ransomware that encrypts the server does not encrypt the copy.
• Administrator access through a bastion. Named accounts, SSO with a second factor, keys only, and every session recorded and replayable. No machine accepts a password any more. We describe this migration on 18 September, and the move from a cloud SSH client to a self-hosted console on the 16th.
• Patches decided, not endured. A live inventory of all versions, daily CVE monitoring, and weekly patching done while watching, the same day for an exposed critical flaw. Because the exploitation window is counted in hours.
• Centralised logs and detection. A SIEM that keeps twelve months of events away from the machines, monitors SSH keys across the whole fleet in real time and alerts above a threshold. It is what saved the European Collectivity of Alsace, and what 84% of SMEs do not have. Full article on 21 September.
• Firewall checked from outside. Not “enabled in the interface”: tested from a third-party machine, with fail2ban and CrowdSec in front of exposed services.
• Self-audit and frameworks. The 42 ANSSI hygiene measures run against our own infrastructure, without going easy on ourselves, and a reading of the 20 objectives of the NIS2 framework, published on 23 September.

Why, if nobody requires it? #

Three reasons, in order. The threat has changed speed: what we describe in our two articles on offensive AI does not wait for SMEs to catch up with the standard. Regulation is coming: NIS2 will turn those of our clients who are concerned into entities that must answer for their providers, and we want to be the answer, not the problem. And it is our job: a hosting provider that loses a client’s data gets no second chance, whatever the contract says.

What it costs, honestly #

It is not the cheapest hosting in the region, and it never will be: a dedicated machine costs more than a folder on a shared server, and managed services that pay attention cost more than a script that updates things at night. But most of the difference is not hardware, it is doctrine and tooling, and the tooling is shared across the whole fleet: the bastion, the SIEM, the monitoring and the backups serve all clients at once. In practice, the gap with a usual offering is measured in tens of euros a month for a website, not hundreds. Set against a local authority’s five days of downtime or a hospital group’s lost night, the question of price takes on a different nature.

If you want to compare, point by point, what your current provider puts against each row of the table above, we will gladly do it, with no commitment, with the evidence on our side: that is the content of our managed services and our sovereign hosting. Let us talk.

Sources #

• Cybermalveillance.gouv.fr / OpinionWay, Baromètre de la maturité cyber des TPE-PME 2025 (2025 barometer of cyber maturity in small businesses and SMEs, October 2025)
• ANSSI / CERT-FR, Panorama de la cybermenace 2025 (2025 cyber threat overview, 11 March 2026)
• Le Monde Informatique, La Région Grand-Est embourbée dans une cyberattaque (the Grand Est Region bogged down in a cyberattack, February 2020)
• LeMagIT, Cyberattaque contre la Collectivité européenne d'Alsace : le CISO raconte (cyberattack on the European Collectivity of Alsace: the CISO’s account, 2022)
• L'Informaticien, En Alsace, une attaque d'envergure paralyse un groupe hospitalier (in Alsace, a large-scale attack paralyses a hospital group, September 2023); Rue89 Strasbourg, aftermath of the GHSV cyberattack
• Rue89 Strasbourg, “Strasbourg est attaquée toutes les semaines” (“Strasbourg is attacked every week”, 2 March 2025)
• Verizon, 2026 Data Breach Investigations Report