Cybersecurity: the 2025 threat landscape and key takeaways from the Cato CTRL report

OP-ED · 1 APRIL 2025

By Jérôme Beaufils, CEO of SASETY · Lire en français

Source: Cato CTRL 2025 Threat Report

The Cato CTRL 2025 report analyses cybersecurity trends and threats, based on data collected through the Cato Networks SASE platform. It highlights how cyberattacks are evolving, critical vulnerabilities and recommendations to improve companies' resilience.

The 2025 context

2025 marks a turning point in cybersecurity.

Organisations, whether public institutions, hospitals, banks, multinationals or SMEs, face cyber threats of unprecedented scale and sophistication.

The rise of emerging technologies such as artificial intelligence, the widespread use of cloud services and the multiplication of connected devices have considerably widened the attack surface of information systems.

In this context, it is no longer simply about protecting against computer viruses or one-off intrusions, but about facing organised cybercriminals, often backed by states, who target organisations methodically and strategically.

Cyberattacks now go far beyond simple ransomware or traditional phishing campaigns.

Today, attackers exploit vulnerabilities in real time, manipulate data using artificial intelligence and bypass traditional protections with formidable efficiency.

Faced with these challenges, cybersecurity must evolve towards a more agile, proactive and resilient model.

AI serving cyberattacks

Artificial intelligence, which has transformed many sectors, is proving to be a double-edged sword.

While it allows organisations to improve their security by detecting threats faster, it is also used by cybercriminals to make their attacks more effective and harder to spot.

Phishing campaigns, which once relied on generic and often poorly written emails, are now personalised using AI.

A sophisticated attack can use an algorithm able to analyse an organisation's internal communications and generate credible messages imitating the tone and style of an executive or a colleague.

This makes these scam attempts particularly dangerous, as even experienced employees can be fooled.

A recent example highlighted the impact of this technology in an attack on a large humanitarian organisation. The cybercriminals used AI to analyse exchanges between the CFO and his teams. Based on this information, they generated a fake email requesting an urgent transfer of funds to a fraudulent account, perfectly imitating the way the CFO usually communicated. The transfer was made without suspicion, resulting in a significant financial loss.

Deepfakes are another major threat. Thanks to advanced voice and video synthesis models, cybercriminals can create manipulated recordings in which an executive appears to give orders to employees. Several cases have already been reported where CEOs “asked” their teams to approve payments or change sensitive access to internal systems, when in fact these were AI-generated imitations.

Faced with these threats, organisations must put systematic validation protocols in place for any sensitive request, with multi-level checks. For example, a large transfer should never be approved on the basis of an email or phone call alone, but should require dual authorisation involving several people.

Exploiting zero-day flaws: a race against time

Zero-day flaws are among the greatest current threats to IT systems.

These vulnerabilities, not yet fixed by software vendors, are actively sought by cybercriminals and exploited before developers can even patch them.

Organisations without proactive detection are therefore exposed to intrusions before they are even aware of the threat.

In 2024, a European ministry fell victim to an attack based on a zero-day flaw in document management software used by several administrations. By exploiting this breach, the attackers were able to exfiltrate thousands of confidential documents before a fix was even available. This type of attack shows that cybercriminals no longer need to force protected access: they simply wait for a flaw to appear and strike with formidable precision.

To reduce risks, organisations must invest in behavioural detection, which analyses abnormal behaviour on systems rather than relying solely on known signatures. At the same time, adopting a Zero Trust architecture, where no access is granted by default, is an effective barrier against this type of threat.

Ransomware is evolving: towards increasingly aggressive cyber extortion

Ransomware is no longer limited to encrypting an organisation's files in exchange for a ransom.

Attackers now combine double extortion and targeted destruction, which means they first steal sensitive data before encrypting it.

They then threaten to publish it if the ransom is not paid, adding further pressure on victims.

An emblematic case involved a large hospital chain in 2024. The cybercriminals not only blocked access to patients' medical records, but also threatened to publish confidential information about conditions and ongoing treatments. Faced with this dilemma, the organisation was forced to negotiate, as disclosure of this data would have had disastrous ethical and legal consequences.

The only viable way to fight this type of attack is to adopt a preventive, resilient approach. This includes segmented backup systems, ensuring that critical data remains accessible even in the event of an attack.

Multi-factor authentication and real-time monitoring of suspicious activity must also be deployed to identify and stop intrusion attempts before they succeed.

Attacks targeting digital identities: the weak link of systems

Exploiting digital identities has become a priority for cybercriminals. Rather than trying to force a door, they prefer to steal a key and use it discreetly.

Credential stuffing, which consists of automatically testing combinations of stolen credentials, has become a common technique for breaking into organisations' information systems.

A striking example is that of a large European university, where compromised student accounts allowed attackers to access confidential research databases. This led to the theft of intellectual property covering years of academic work.

Organisations must strengthen their identity and access management by adopting technologies able to analyse suspicious logins in real time.

Towards integrated, managed cybersecurity

In a constantly evolving digital environment, organisations have the opportunity to strengthen their cybersecurity by adopting innovative, interconnected technologies.

To protect infrastructure and identities and anticipate threats, combining Cato Networks, Silverfort and Pentera makes it possible to build a complete, high-performing security strategy.

Thanks to its SASE(Secure Access Service Edge) architecture, Cato Networks provides unified network protection by building security mechanisms directly into data flows. This approach optimises connectivity while guaranteeing consistent security across all access, whether from the cloud, physical sites or remote users.

To complete this protection, Silverfort brings advanced identity management by securing authentication and monitoring access in real time. Its integration makes it possible to immediately identify unusual access attempts and apply appropriate controls, ensuring that only authorised users access essential resources.

With Pentera, cybersecurity becomes proactive. This technology automates penetration testing and continuously simulates real attacks to assess the robustness of existing defences. By providing clear visibility of potential vulnerabilities, Pentera allows organisations to optimise their security posture and act before a threat can be exploited.

To get the most out of these technologies, expert support is essential.

SASETY makes their integration easier by ensuring fast, smooth implementation, adapted to the specific needs of each organisation.

The goal is to make IT teams autonomous through targeted training and the transfer of know-how.

As a managed cybersecurity services provider, SASETY also ensures continuous monitoring and optimisation of the technologies to guarantee effective, lasting protection.

This approach allows organisations to adopt high-performing, scalable cybersecurity while relying on specialist expertise to adapt to new challenges.

💡 To see how effective Cato Networks, Pentera and Silverfort really are, nothing beats a demo!

☎️ A question, a project? Our experts are here to help!

Contact our experts →