France Reports Ransomware Drop as NIS2 Bites, Google Closes $32B Wiz Deal, LLM Guardrails Broken Wide Open

France's ANSSI confirms ransomware attacks on French organizations dropped significantly in 2025 — a signal that regulation-driven security investment is paying off. Meanwhile, Google completes its landmark $32 billion Wiz acquisition, reshaping cloud security compliance forever. Palo Alto's Unit 42 discovers that LLM safety guardrails can be trivially bypassed, raising urgent questions for EU AI Act compliance. And UK cyber-attacks are surging at four times the global rate.

📉 France's ANSSI Reports Ransomware Attacks Dropped in 2025

France's national cybersecurity agency ANSSI has released its annual threat report confirming that ransomware attacks on French organizations declined in 2025. Small and medium businesses remained the most targeted segment, but overall attack volumes dropped — a departure from the relentless upward trend of previous years.

The timing is significant. France was among the first EU member states to begin enforcing NIS2 requirements in late 2024, with mandatory incident reporting and risk management obligations taking effect for essential and important entities. ANSSI's report suggests that the combination of regulatory pressure, increased security spending, and improved resilience postures is starting to show measurable results.

What This Means for NIS2 Compliance

• Regulatory pressure works. France's data provides early evidence that mandatory cybersecurity requirements under NIS2 are driving tangible security improvements — a powerful argument for organizations still treating compliance as a checkbox exercise.
• SMBs remain the weak link. Despite overall improvements, small businesses continue to bear the brunt of ransomware attacks. NIS2's supply chain security requirements mean larger entities must now ensure their SMB partners meet minimum security standards.
• Incident reporting drives transparency. ANSSI's improved data quality is itself a product of mandatory reporting — organizations that previously handled breaches quietly are now contributing to the national threat picture.

☁️ Google Completes $32 Billion Wiz Acquisition — Cloud Security Landscape Shifts

Google has officially closed its $32 billion acquisition of Wiz, the largest cybersecurity deal in history. Wiz will operate within Google Cloud while maintaining its brand identity and multi-cloud support — a critical detail for European customers navigating DORA and NIS2 cloud provider requirements.

The deal fundamentally reshapes the cloud security compliance landscape. Wiz's Cloud Native Application Protection Platform (CNAPP) capabilities — spanning vulnerability management, misconfigurations, identity risks, and runtime threats — are now backed by Google's infrastructure and data sovereignty investments in Europe.

Regulatory Implications

🤖 Palo Alto Unit 42 Discovers Major Security Gaps in LLM Guardrails

Researchers at Palo Alto's Unit 42 have published findings demonstrating that safety guardrails in major LLM platforms can be systematically bypassed. The attacks are not theoretical — they work against production systems and can force AI tools to generate harmful, biased, or non-compliant outputs.

This research lands at a critical moment. The EU AI Act's risk-based framework requires that high-risk AI systems implement robust safety measures, including output filtering, bias detection, and human oversight mechanisms. If the very guardrails designed to ensure compliance can be trivially circumvented, the entire regulatory framework's effectiveness comes into question.

What Organizations Must Do Now

• Audit your AI guardrails. If you're deploying LLMs in any customer-facing or decision-making capacity, your guardrails may not be as robust as your vendor claims. Independent red-teaming is essential.
• Document your AI risk assessments. The EU AI Act requires demonstrable risk management for high-risk systems. Guardrail bypass vulnerabilities must be documented, mitigated, and reported.
• Implement defense in depth. Don't rely on a single guardrail layer. Combine input filtering, output monitoring, human review, and logging to create multiple safety barriers.
• Monitor for adversarial inputs. Automated detection of jailbreak attempts and prompt injection attacks should be part of your AI security monitoring stack.

🇬🇧 UK Cyber-Attacks Surge at Four Times the Global Rate

Check Point's latest data reveals that cyber-attack volumes against UK organizations are growing at four times the global average. The surge affects all sectors, with financial services, healthcare, and critical infrastructure facing the heaviest targeting.

The UK's post-Brexit regulatory divergence from the EU creates a particularly interesting comparison point. While EU member states benefit from the coordinated NIS2 framework, the UK is pursuing its own Cyber Security and Resilience Bill and updated Network and Information Systems (NIS) regulations independently.

Cross-Border Compliance Challenges

For organizations operating across both the EU and UK, this divergence creates dual compliance obligations:

• Incident reporting timelines differ. NIS2 requires 24-hour early warnings and 72-hour full reports. UK NIS regulations have their own timelines and reporting authorities.
• Supply chain requirements overlap but aren't identical. An organization compliant with NIS2 supply chain provisions may still need additional measures for UK compliance, and vice versa.
• Data protection interplay. UK GDPR and EU GDPR breach notification requirements run in parallel, potentially requiring dual reporting for a single incident.

🔒 OpenAI Acquires Promptfoo — AI Security Testing Goes Mainstream

OpenAI has announced its acquisition of Promptfoo, an AI security testing startup that helps developers identify vulnerabilities in LLM applications. The deal signals that even AI's biggest players recognize the critical gap between AI capabilities and AI security — exactly the gap the EU AI Act is designed to address.

Promptfoo's platform enables automated red-teaming, safety evaluations, and security testing for AI agents — capabilities that map directly to EU AI Act requirements for conformity assessments and ongoing monitoring of high-risk AI systems.

Why This Matters for EU Compliance

• Conformity assessments need tooling. The EU AI Act requires that high-risk AI systems undergo conformity assessments. Tools like Promptfoo provide the automated testing capabilities needed to make these assessments scalable.
• Agentic AI introduces new risks. As AI systems become more autonomous (agentic), the attack surface expands. Security testing must evolve from static evaluations to continuous monitoring — a requirement the EU AI Act anticipates.
• Market consolidation favors integrated platforms. OpenAI embedding security testing directly into its platform could set de facto standards for AI safety testing — standards that EU regulators will be watching closely.

🏛️ Senate Confirms New NSA & Cyber Command Leader — US Cyber Strategy Implications

The US Senate has confirmed Joshua Rudd to lead both the National Security Agency and US Cyber Command under the controversial "dual-hat" arrangement. The confirmation comes as transatlantic cybersecurity cooperation faces scrutiny under shifting US administration priorities.

For European organizations, US cyber leadership changes matter because of the deep interconnection between US and EU critical infrastructure defense, intelligence sharing under the EU-US Data Privacy Framework, and coordinated responses to nation-state threats. Any shift in US cyber doctrine ripples through NATO's cooperative cyber defense posture and bilateral agreements with EU member states.

📊 EU Regulation Status Tracker — March 2026