The Élysée Palace in Paris, photographed on September 28, 2019. Its next occupant will be elected on April 18 and May 2, 2027. Seven months before the first round, cybersecurity is still struggling to gain a foothold in the candidates’ platforms. Credits: Leynadmar / Wikimedia Commons, CC BY-SA 4.0.
France is two years behind on a European cybersecurity directive and now finds itself before the Court of Justice of the European Union. Fifteen thousand jobs remain vacant in the sector. The country’s 75 universities have approved deficit budgets. Seven months before the election, sixteen candidates have officially declared. Barely three even use the word cybersecurity in their public platforms. Meanwhile, in Saclay, a bank and a student association have signed their own agreement. Who trains the experts France says it lacks, and who will pay for them? We reviewed the platforms with documents in hand.
Updated on September 28, 2026
On May 20, 2026, around thirty students take their seats in the Peugeot auditorium at CentraleSupélec, on the Saclay plateau. They were selected through an application process. First they listen to a divisional general, head of the Interior Ministry’s cyber command. He is followed by two executives from a consumer-credit subsidiary. One leads information systems security, the other human resources. The afternoon continues at the company headquarters in Massy, around a conference on cyber crisis management. The day is called “l’Escale”. A student association, the Cyber Saclay-Team, organizes it with Crédit Agricole Personal Finance & Mobility.
Four months later, on September 21, the two partners announced the signing of an agreement. It is built around three pillars. The first is awareness of digital risks. The second supports student and research projects. The third introduces cybersecurity and artificial intelligence careers, with internships to go with them. The press release gives no amount and no duration.
The scene is modest. Yet it sums up the issue. The state sets a cyber talent goal, universities have no room left, and candidates are talking about something else. They prefer artificial intelligence and digital sovereignty to cybersecurity. Almost no one is talking about the people who will have to do it. The question has not yet been put to the French presidential election 2027 candidates. It should be.
What The State Has Promised
On January 29, 2026, Anne Le Hénanff presented the National Cybersecurity Strategy 2026-2030. She is the junior minister in charge of artificial intelligence and digital affairs. The document was developed under the authority of the General Secretariat for Defense and National Security. Its first pillar comes down to one sentence: “make France Europe’s largest pool of cyber talent.” Three objectives follow from that. The first is to build a cybersecurity culture from the earliest age. The second is to invest in every training path, whether initial, continuing, or retraining. The third supports the emergence of a European baseline of shared skills.
The shortage this strategy seeks to address is documented. The Cybersecurity Professions Observatory is run by ANSSI. It measured a 49% increase in job postings between 2019 and 2024. Around 15,000 positions remained unfilled in 2025. OPIIEC, the joint observatory for digital professions, estimates 25,000 openings by 2028. Two European texts are increasing the pressure. Since January 17, 2025, the DORA regulation has required banks and insurers to demonstrate digital resilience. The NIS2 directive is supposed to extend cybersecurity obligations to nearly 15,000 entities in France. Only a few hundred are currently affected.
This is where the promise collides with the NIS2 transposition timetable. The directive was supposed to be transposed by October 17, 2024. The transposition bill has a long name: “resilience of critical infrastructure and strengthening of cybersecurity.” The Senate passed it on March 12, 2025. The special committee of the National Assembly unanimously approved it on September 10, 2025. It has been waiting ever since. On February 4, the chairs of the two special committees publicly accused the Interior Ministry of blocking the bill. They are lawmaker Philippe Latombe and Senator Olivier Cadic. The sticking point is Article 16 bis, which bans imposing backdoors on encrypted messaging services. [In practical terms, a backdoor would allow the state to technically read your WhatsApp, Telegram, or Signal messages, editor’s note.] “We used to be leaders, and we are losing all credibility,” the first said. On July 8, the European Commission referred France and three other lagging states to the Court of Justice of the European Union. It is seeking a lump sum and daily penalties. The Assembly’s Conference of Presidents set the agenda for this session on September 22. It will end at the end of February to make way for the campaign. According to LCP, lawmakers are expected to begin examining the bill in the chamber during the second week of October. They will first have examined the law against sexual and gender-based violence.
Can the candidates be blamed for a delay that is first and foremost the executive branch’s and Parliament’s? That would probably be unfair. But whether they would handle it differently is very much a fair question. That is precisely the one professionals have started putting to them.
What The Candidates Say
On July 9, CESIN sent an open letter to the candidates. This Club of Information and Digital Security Experts brings together more than 1,300 security leaders. The letter asks five questions. What sovereignty doctrine does the country set for itself? How do you move “from a Europe of rules to a Europe of capability”? What industrial policy is being pursued for critical digital infrastructure? Who governs this area? How is the country being prepared for digital and geopolitical shocks? Two weeks later, its general delegate, Alain Bouillé, drew an initial conclusion. Among the roughly twenty declared or expected candidates, only Raphaël Glucksmann, Bruno Retailleau, and Gabriel Attal had addressed these issues. On July 20, Hexatrust and the INCYBER Forum launched Cyber 2027, a platform for tracking the platforms. It promises a radar of proposals and follow-up on announced budgets. It also promises a candidate town hall at the Lille Forum, from March 9 to 11, 2027.
Two months later, what do the platforms contain? A lot of artificial intelligence, a lot of sovereignty, and little cybersecurity in the operational sense of the term. Digital sovereignty refers to a state’s ability to control its data, infrastructure, and software. It must not depend on foreign actors or laws to do so. The term has become common across the political spectrum since June 13. That day, the U.S. administration cut off foreign nationals’ access to Anthropic’s most advanced models. As early as June 19, Le Monde described it as “a catch-all concept shared by the contenders for the Élysée.”
Gabriel Attal (Renaissance) is backing the heaviest plan, “France 2040”. It calls for €200 billion over ten years, split evenly between public and private funding. It also adds an EU-wide “AI CAP.” He wants to train 20 million workers to use artificial intelligence tools by 2030. Program comparison tools consulted so far assign him no measure specific to cybersecurity. Édouard Philippe (Horizons) is betting on infrastructure and European digital sovereignty. He wants to double computing capacity in five years and introduce a “Buy European Tech Act.” Above all, he wants to raise the number of engineers trained each year from 40,000 to 100,000. A right to retraining would accompany jobs threatened by automation. But what engineers are we talking about? The figure does not distinguish cybersecurity.
Bruno Retailleau (Les Républicains) is one of the few to write the word, along with Raphaël Glucksmann and, for health data, David Lisnard. His plan calls for €25 billion over five years. He wants to strengthen “the cybersecurity of hospitals, local governments, and vital infrastructure.” He wants to require sovereign hosting under SecNumCloud certification and create a full-fledged Ministry of Artificial Intelligence. He intends to double the number of engineers specializing in artificial intelligence, computer science, robotics, applied mathematics, and digital infrastructure. He also calls for a three-year moratorium on the GDPR and the AI Act for strategic sectors. That request runs up against the European legal timetable. Raphaël Glucksmann (Place publique) is a candidate in the Socialist primary on October 9-10 and 16-17. He proposes a “cyber sentinels” plan. Specialized anti-cybercrime brigades would be deployed across the country, backed by regional centers. ANSSI would be strengthened and “a new generation of professionals” trained. He also adds a Digital and Artificial Intelligence Industrial Agency. France 2030, Bpifrance, and a higher tax on digital giants would fund it. An international AI campus rounds out the package. As of now, it is the proposal closest to the first pillar of the national strategy.
Jean-Luc Mélenchon (La France insoumise) supports a national public cloud tied to public data centers. Public-sector data would be hosted on French-law servers. He wants a global conference under UN auspices to “disarm and regulate AI.” He also proposes strengthening police staffing against online child sexual abuse material. No training figures are given. Marine Le Pen (Rassemblement national) has been a candidate since July 7. She wants data belonging to French citizens to be hosted in France or the European Union by European operators. She wants foreign takeovers of strategic digital companies to be controlled. She favors “automation without replacing workers.” Her party has not published a costed plan on the subject. Marine Tondelier (Les Écologistes) proposes regulating recommendation algorithms. She is betting on public research and public procurement. David Lisnard (Nouvelle Énergie) wants a sovereign framework for hosting and cybersecurity of health data. For Xavier Bertrand, the citizen observatory Poligraph lists no digital measures. For Fabien Roussel, the iFRAP foundation’s comparison tool does not list any yet.
Should this be worrying? There are arguments both ways. The issue is clearly entering the campaign through artificial intelligence. The first debate among seven candidates, on August 27 before Medef, was shaped by it from start to finish. The candidates themselves are targets. In late July, Édouard Philippe was hit by false information about his health. Several media outlets attributed it to pro-Russian networks. In early August, Raphaël Glucksmann said he had been the target of a destabilization operation. The Paris prosecutor’s office opened an investigation. On August 5, Gabriel Attal’s team reported interference originating in Russia. According to Ifop, 86% of French people fear deepfakes could manipulate the election result. In the opposite direction, cybersecurity in the strict sense remains marginal. No candidate repeats the national strategy’s talent goal. The question of training funding appears nowhere. CESIN notes that France has changed digital ministers five times in ten years. It wants the minister’s rank to be high enough to carry weight in budget decisions. Guillaume Tissier of the INCYBER Forum adds a methodological caution. “Politicians often have the habit of mixing things together, of reallocating budgets that have already been assigned,” he notes. That makes “the effectiveness of public action” hard to track.
Meanwhile, On Campus
Universities, for their part, are not waiting for the campaign to do the math. All 75 French universities approved an initial 2026 budget in deficit. Only 20 were in that situation in 2022. On February 9, the Higher Education Ministry opened a conference on university funding. The Senate noted in the 2026 budget a €260 million increase in the program devoted to higher education. That program reaches €15.6 billion. University presidents say the increase is insufficient given duties transferred without compensation. France Universités puts that at nearly half a billion euros. “We are missing one billion to save the public university service,” says Laurent Gatineau, president of CY Cergy Paris University. He describes missions funded through one-off project calls. He warns of a pivotal 2028, when those funds run out.
In this context, companies have an institutional channel to fund schools and universities. It is the balance of the apprenticeship tax, or 0.09% of payroll. Each employer directs it to the schools and universities of their choice on the SOLTéA platform. The second allocation period opened there on September 3. Companies also have more direct channels. Those are multiplying.
On May 6, École Polytechnique and Accenture signed a strategic partnership lasting four years, supported by the X Foundation. It includes a teaching and research chair and continuing education programs in artificial intelligence and cybersecurity. A “employer brand” component and a strategic steering committee round out the setup. The school has published a corporate relations charter. In June 2025, the armed forces cyber defense command signed an agreement with ISTIC. This computer science school at the University of Rennes aims to strengthen cybersecurity skills. In Brittany, the Cyber Excellence Center was created in 2014 by the Ministry of the Armed Forces and the Region. For more than ten years, it has brought together schools and companies. The Cyber CNI Chair at Institut Mines-Télécom has entered its fourth phase, scheduled from 2025 to 2028. The Campus Cyber in La Défense released its first-year review in July of its transformation.
The agreement, signed on September 17, is unusual in that it links a company and a student association. Crédit Agricole Personal Finance & Mobility signed it with the Cyber Saclay-Team. Paris-Saclay University recognizes it as the institution’s “cybersecurity association.” Founded by Sam Borhani, a law student, it organizes conferences and meetings. On May 20, it had brought together three partners around the students. They were the Interior Ministry’s cyber command, the DataIA Institute, and Crédit Agricole Personal Finance & Mobility. Yet the university is not a party to the agreement. Should we see this as welcome flexibility, without institutional red tape, with direct access to students and internships attached? Or as a gray area where no one knows who is in charge, what the tradeoffs are, and what oversight the institution retains? Both readings hold up. When asked by Ecostylia in an interview published in July, Sam Borhani preemptively answered the objection. “For me, a partnership does not mean dependency. It means pooling skills around a shared goal.” Useful clarification for the reader: Ecostylia is among the supporters listed by the association on its website.
The Saclay case is not isolated, and it raises the same question as the others. Are these agreements a complement, meaning bridges the university can no longer provide because it lacks the means? Or are they a substitution, with a public service mission drifting into the private sector without a common framework? Supporters of both answers have arguments. No candidate has yet said which one they choose.
The Questions The Campaign Will Have To Decide
Who pays for the training of the professionals the national strategy wants to see multiplied? Is it the state, universities, companies, or some combination no one has yet described? Should the Digital Minister be given a rank that allows them to weigh in on budget decisions, as CESIN demands? Or should that role remain a junior minister attached to Bercy? Will the resilience law be passed before the vote, with or without Article 16 bis? Will the roughly 15,000 entities covered by NIS2 have to wait until the next five-year term to know what is expected of them? Should agreements signed on campuses remain local initiatives? Or should they be brought into a framework that the state, universities, and companies all accept?
The Lille INCYBER Forum promises a candidate town hall in March. Until then, the Cyber 2027 radar will record what the platforms say and what they leave unsaid. In Saclay, a student association and a financial institution have already offered their own answer without waiting. The question is whether it will become the state’s.