On 10 September 2026, the publisher Board of Cyber released the first large-scale panorama of the external attack surface of entities subject to NIS2 in France. The dataset covers 21,700 organisations taken from the official list published by ANSSI. The average score stands at 690 out of 1,000. This figure sums up a reality that documentary audits do not see: 7.9% of entities show a technical exposure rated as basic (source: Board of Cyber, 10 September 2026, via Silicon.fr).
What this panorama measures, and what it does not
This is not a compliance audit. Board of Cyber assesses the external attack surface visible from the internet: open ports, exposed software versions, expired TLS certificates, misconfigured DNS records, credentials present in public leaks. No authentication is required for this type of reconnaissance. An attacker carries out the same work before launching any intrusion.
The difference from a documentary audit is fundamental. A framework such as the ReCyF assesses the implementation of policies, procedures and continuity plans. This panorama assesses what an adversary observes from the outside. The two are complementary. A NIS2 programme can produce impeccable documentation while exposing unpatched services for months. This divergence is precisely what the 690/1,000 score reveals at national scale.
What the distribution means
The distribution is asymmetric. 32.7% of entities reach the advanced level: a controlled attack surface, regular patching, valid certificates, few unnecessary open ports. 59.4% sit at the intermediate level: partial exposure, incomplete patching on part of the perimeter, a few management services exposed without need. 7.9% are at the basic level: obsolete services accessible from the internet, technical accounts present in public leaks, configurations allowing deep reconnaissance within minutes.
7.9% of 21,700 represents around 1,700 entities. These organisations are subject to NIS2. Some operate infrastructure in the energy, transport or health sectors. Their external exposure is not hypothetical. It is measurable, accessible, and potentially exploitable today.
A concrete example from the water sector
A mid-sized local authority, operator of a drinking water distribution network, falls within the NIS2 perimeter as an important entity. It has appointed a cyber referent, filed its declaration of entity status with ANSSI, and started its documentary compliance work with the ReCyF. Its external score stands at 640.
Two major deductions: a backup server exposed on a non-standard port, accessible from the internet for eighteen months, and two expired TLS certificates on industrial supervision web interfaces. None of these elements is visible in a documentary audit. Both are visible within minutes using the standard reconnaissance tools used before any targeted intrusion.
This example is not exceptional. It illustrates a common reality in the intermediate level: organisations progress on procedural compliance, but the technical perimeter evolves faster than supervision.
Three concrete actions
First action: obtain your own external measurement. This type of assessment, carried out without access to your internal systems, gives you the attacker's viewpoint. It usefully complements your compliance programme without replacing it.
Second action: do not confuse this score with your NIS2 compliance level. A high score is a positive signal about your external hygiene. It says nothing about your detection capability, your continuity plan, or your access entitlement management policy. NIS2 compliance covers a far broader scope than the external attack surface.
Third action: treat the exposures identified as documented evidence. If your diagnosis reveals an exposed service, record it, qualify it, and trace its remediation. This traceability matters in the event of an ANSSI inspection. The first sanctions handed down in Europe relate to documented and persistent failures, not to unforeseeable incidents.
The link with the Resilience Bill
The French transposition of NIS2 through the Resilience Bill has been awaiting parliamentary examination since September 2026. The timetable remains uncertain. This delay does not create a grey zone, however. Subject entities have had active obligations since the Directive became applicable. A basic-level exposure in September 2026, followed by a Resilience Bill adopted in 2027, will not be treated as an absence of prior obligation. The transposition date determines the terms of supervision, not the emergence of the obligations.
To prepare for this, an internal maturity audit in 90 days offers a structured framework for aligning your NIS2 documentation with your technical reality. The external attack surface is a starting point. The maturity audit is its natural continuation. Together, they give a faithful picture of your position: what the authority will see from the outside, and what your file can demonstrate internally.
What the average does not tell you
An average score of 690/1,000 across 21,700 entities is a mixed result. It means that the majority of organisations subject to NIS2 in France have begun genuine work on their external perimeter. It also means that roughly one third of these organisations have not yet reached a level of technical control consistent with the obligations of an important or essential entity.
The Board of Cyber panorama covers only the visible external surface. It does not measure the security of internal access, the quality of logs, or the robustness of notification procedures. These dimensions are subject to separate checks within NIS2 inspections. But the external surface is the first perimeter your adversaries assess. It deserves to be the first thing you measure as well.