What criteria distinguish a truly secure online professional access from a simple login form protected by a password? Between the entry into force of the European Accessibility Act on June 28, 2025, and the publication of the Cyber Threat Panorama 2025 by ANSSI on March 11, 2026, the requirements placed on professional spaces have changed in nature.
This article compares current access management practices and identifies gaps that still expose small organizations.
Multifactor Authentication: Real Coverage Depending on Access Type
The recommendation to deploy multifactor authentication (MFA) on all sensitive accounts has been circulating for several years. Documented feedback from 2026 shows a gap between intention and implementation.
| Access Type | MFA Frequently Enabled | MFA Often Absent |
|---|---|---|
| Professional Email | Yes | – |
| Cloud Administration Console | Variable | Yes, on secondary accounts |
| VPN or Remote Access | Rarely | Yes |
| Online Payment Tools | Yes (banking regulation) | – |
| Backup Consoles | Rarely | Yes |
The typical scenario: a company activates MFA on email because the provider requires it, then leaves remote access and backup consoles protected by a simple password. It is precisely through these secondary entry points that compromises occur.
Managing a professional access at J’entreprends Au Féminin illustrates this logic well: each connection point deserves a separate verification, not just the main portal.
MFA only protects the accesses on which it is actually deployed. Covering email without covering the VPN or backup console is like locking the front door while leaving the window open.
Ransomware and SMEs: Data from the ANSSI 2026 Panorama
The Cyber Threat Panorama 2025 published by ANSSI on March 11, 2026, provides a structuring data point: SMEs, small businesses, and mid-sized companies represent 48% of the known ransomware victims reported to the Agency. This figure places small and medium-sized organizations at the forefront of targets, ahead of large companies and local authorities.
This high proportion is partly explained by incomplete professional access practices. A strong password on the main account is not enough if backups are not isolated from the current network.
Isolated Backups and Restoration Testing
ANSSI recommends integrating two complementary measures into the professional access process:
- Backups stored outside the main network, inaccessible from current user accounts, so that a ransomware cannot encrypt them at the same time as production data
- Regular restoration tests, because a backup that has never been tested may prove unusable at a critical moment
- A segmentation of access rights to backup consoles, distinct from general administrative rights
An untested backup is equivalent to a non-existent backup. Several organizations affected by ransomware had backups but had never verified that they could be restored within an acceptable timeframe.
Passkeys and Identity Management: What Changes in 2026
Passkeys (biometric or hardware access keys, compliant with the FIDO2 standard) are beginning to be seen as a credible alternative to traditional passwords for professional access. Their adoption remains gradual, but several professional service platforms now offer them.
The difference from a classic password is structural. A password can be intercepted by phishing, reused across multiple accounts, or guessed through brute force. A passkey never leaves the user’s device and cannot be entered on a fake site.
Current Limitations for Small Organizations
The adoption of passkeys assumes that each employee has a compatible device and that the identity management infrastructure supports the standard. For a small business of three people using varied devices, deployment is more complex than for a company equipped uniformly.
However, for individual accesses (a craftsman connecting to their professional space from a single device), the passkey simplifies the process while enhancing security. The gain is maximal when the number of devices is limited.
Digital Accessibility of Professional Spaces: Mandatory Since June 2025
Since June 28, 2025, the European Accessibility Act requires e-commerce services aimed at consumers to make their journey usable, understandable, and robust. Professional spaces linked to online commercial activities are concerned.
In practical terms, a professional login form must be usable with a screen reader, provide sufficient contrasts, and not rely solely on a visual captcha. Microservice companies benefit from an exemption under certain conditions, but this exemption does not cover e-commerce platforms.
- The login journey must be navigable via keyboard without focus traps
- Error messages must be explicit and associated with the relevant field
- Text alternatives must be provided for any non-textual element of the authentication process
- A captcha that is exclusively visual becomes a regulatory obstacle for users of assistive technologies
This obligation changes the way a professional access space is designed. Security and accessibility do not oppose each other, but their combination requires precise technical choices (biometric authentication compatible with screen readers, for example).
The data from the ANSSI Panorama and the new accessibility obligations converge towards the same conclusion: online professional access should be conceived as an identity management system, not just as a simple password field. Organizations that treat MFA, backups, passkeys, and accessibility as separate projects accumulate vulnerabilities that mutually reinforce each other.
