EBIOS RM and AI: what actually changes
ANSSI's EBIOS RM method is the French reference for cybersecurity risk assessment. Running it takes time: gathering documentation, facilitating five workshops, writing the deliverables. Artificial intelligence does not change the method. It cuts the time spent collecting and writing, so the workshops are used for deciding. That is Vailor's approach: the AI proposes, your experts decide.
Workshops 1 and 2: AI-assisted scoping and risk sources
The first EBIOS RM workshops set the scope and identify risk sources. Vailor's AI reads the project documents you upload (architecture files, maps, specifications) and prefills business values and supporting assets from cited excerpts. Without documents, Vailor organises collection from business teams through simple questions. The proposed risk sources take your context into account, and your experts keep or discard each one.
Workshops 3 and 4: AI-proposed strategic and operational scenarios
Scenario workshops are the longest part of an EBIOS RM analysis. Vailor's AI proposes strategic scenarios from the risk source and target objective pairs you kept, then attack paths for the operational scenarios, based on what your documents say about the architecture and the ecosystem. These proposals are a starting point: your architects correct and complete them in the workshop.
Workshop 5: AI-assisted risk treatment
The final workshop defines the treatment strategy. Vailor links the risk register to the measures in the action plan. Each measure carries an effort in person-days and a cost, prefilled by the AI and validated by your teams, plus a priority from P1 to P4. Deliverables export to PDF, Word and PowerPoint, with a decision-maker summary for management. Every decision is traced in an audit log where no application feature can delete an entry.
Mistakes that derail an AI-assisted EBIOS RM study
The first mistake is an oversized scope. Trying to cover the entire information system in a single study produces generic scenarios that nobody can act on, whereas workshop 1 works best when it frames one precise object: a business activity or a critical service. The second mistake is blurring the line between business values and supporting assets, because once that distinction is unclear every later workshop loses its logic. The third is treating the gap analysis against the security baseline as paperwork, when it is what makes the operational scenarios credible. AI removes none of these mistakes. It amplifies them: weak framing produces a large volume of plausible but unusable scenarios very quickly. The habit that matters is to treat generated proposals as material to be challenged in the workshop, never as a result to be approved in bulk.
What to have ready before the first workshop
An EBIOS RM study does not start from a blank page. Before the first workshop, gather the map of the system in scope, the inventory of supporting assets and their owners, the list of ecosystem stakeholders (suppliers, managed service providers, data exchange partners), the security measures already in place, and the findings of past audits or incidents. This is precisely the material an AI can read and structure beforehand: the richer the document base, the more contextualised the proposals put in front of participants. The second blocker is not documentary but human. Workshops 1, 3 and 5 call for business owners and executives around the table, not only the security team, because without a business judgement on the severity of feared events, the study stays a technical exercise. AI-assisted preparation mainly changes the nature of the meeting: participants arrive in front of drafted material and spend their time deciding rather than producing.
Measuring whether the acceleration produces decisions
Going faster is only worth something once it turns into decisions. The useful indicators are therefore not about page counts: the share of risk scenarios with a named owner and a due date, the delay between the end of workshop 5 and the entry of measures into the roadmap, the proportion of critical business values covered by an up-to-date study, and the ability to replay the analysis after an architecture change or an incident. EBIOS RM is built as an iterative approach, so a study that is never revisited loses its value within months. Scale then shifts the priorities: a mid-sized company whose CISO is shared across other duties first needs one defensible study, while a multi-entity group needs comparability between subsidiaries and consolidated risk reporting. For an organisation covered by NIS2 or DORA, the study feeds a file a supervisor can ask for, and the traceability of each decision matters as much as the outcome.
Conclusion: move to AI-assisted EBIOS RM
AI-assisted EBIOS RM does not simplify the method: it cuts collection and writing time and keeps the workshops rigorous. Your experts stay in charge of every judgement call. Book 30 minutes: we listen to your context, tell you concretely how Vailor addresses it, and if it makes sense, we scope a pilot.