EBIOS RM Software Accelerated by Artificial Intelligence

Not yet: Vailor is going through the labelling process. Its EBIOS Risk Manager label application has been filed with ANSSI. It is based on version 3.1 of the label specifications (1 October 2024) and on version 1.5 of the EBIOS Risk Manager guide. The application covers the version installed at the customer's site (on-premise). ANSSI publishes the official list of labelled solutions on cyber.gouv.fr, and that list is the reference.

This is not a risk team exercise. Workshop 1 needs business owners to identify business values and calibrate the severity scales, and IT to map the supporting assets behind them. Workshop 3 pulls in procurement and contract owners, because the ecosystem has to be assessed: suppliers, service providers, partners. Workshops 4 and 5 sit mainly with operational security and with the executives who decide on treatment and formally accept residual risk. Without an executive sponsor, workshop 5 stays theoretical.

The EBIOS Risk Manager guide published by ANSSI is freely available and comes with a fictional case study that runs through all five workshops end to end. It is the best way to see how the objects and deliverables chain together. A case study does not replace your own scoping, though: business values, severity scales and relevant risk sources depend on what your organisation actually does and who it depends on. Reuse the structure, not the content.

ISO/IEC 27005 is guidance: it sets out what an information security risk management process should cover, without prescribing how to run it. EBIOS RM is a method: it fixes a sequence of workshops, the objects it works with (business values, risk sources, strategic scenarios, attack paths) and the deliverables you produce. ANSSI designed the method to stay aligned with ISO/IEC 27005 and ISO 31000, so it can be used to meet the risk assessment requirement of ISO/IEC 27001 without methodological conflict.

EBIOS RM is a method, not a set of certifiable requirements: no organisation holds an EBIOS RM certificate. Individuals are trained on the method; organisations are not audited against it. It is not mandatory in itself, but ANSSI recommends it, in particular for French security accreditation work, and many public sector buyers expect it in practice. It also works as evidence: an ISO 27001 auditor will look at how your scenarios, controls and residual risks hang together.

A narrow and genuinely critical one: a core business application, a sensitive process, an exposed service. Aiming at the whole information system on the first pass inflates the number of business values and supporting assets in workshop 1 and makes the later workshops unmanageable. It is far better to finish all five workshops on a limited scope, produce a treatment plan people can act on, and then widen. A finished assessment beats one abandoned at workshop 3.

It can, and many teams start there, but a spreadsheet hits its ceiling quickly. EBIOS RM works on linked objects: a business value carries supporting assets, a risk source and target objective pair feeds a strategic scenario, which breaks down into attack paths and then into controls. In a workbook those links are maintained by hand and break at the first update. A dedicated tool keeps the traceability, supports several people working at once and regenerates deliverables without re-keying.

EBIOS RM is meant to run as a cycle, not as a one-off report. The security baseline set in workshop 1 and the continuous improvement plan produced in workshop 5 are both designed to be reviewed, and an assessment should be reopened as soon as something makes it wrong: a new critical supplier, an architecture change, a significant incident, a shift in the threat landscape. The blocker is rarely the method, it is the cost of redoing the deliverables. The more that is automated, the more an annual review stays realistic.