How to choose cyber and OT risk management tools
Start with the system in scope and the task to perform. A compliance platform, CVSS calculator and threat modelling tool address different needs.
Choose by need
| Assess information system risk | EBIOS Risk Manager structures analysis through workshops and scenarios; start with the ANSSI method and guide; ANSSI publishes a list of labelled software. Then compare tools by workshop coverage, hosting, exports and access management. |
|---|---|
| Assess an industrial OT/ICS system | IEC 62443-3-2 structures assessment around the system under consideration, zones, conduits and target security levels. |
| Model threats to an application or system | Diagramming tools help describe components, flows and threats; they do not replace organisation-wide risk analysis. |
| Prioritise vulnerabilities | Combine asset context with CVSS severity, EPSS likelihood signals and known exploited vulnerabilities (KEV). |
Checks before choosing
- Define the scope: IT systems, applications, OT environments, suppliers or multiple entities.
- Confirm that the required methods and frameworks are supported and that results can be exported.
- Decide where data may be stored: workstation, internal server or online service; check accounts, backups and sharing.
- Try a representative scenario and make sure owners can maintain the analysis after it is created.
Comparison of selected tools
Indicative, non-exhaustive selection. Deployment and limitations summarise publisher or organisation sources; this is not a certification or security assessment. Information checked on 2026-09-26.
| Tool | Method and use | Access | Deployment | Limitations | Source / checked |
|---|---|---|---|---|---|
| Agile Risk Manager ↗ | EBIOS Risk Manager Agile Risk Manager: ANSSI-labelled EBIOS Risk Manager tool; runs the method’s five workshops. | Commercial publisher | Client-server (version 2.6.2). Publisher: ALL4TEC. | The label attests methodological compliance, not price or feature scope: ask the publisher. | Publisher source ↗Checked 2026-09-26 |
| ARIMES ↗ | EBIOS Risk Manager ARIMES: ANSSI-labelled EBIOS Risk Manager tool; runs the method’s five workshops. | Commercial publisher | Standalone (version 1.2). Publisher: ADACIS. | The label attests methodological compliance, not price or feature scope: ask the publisher. | Publisher source ↗Checked 2026-09-26 |
| C2R — Cyber Risk Review ↗ | EBIOS Risk Manager C2R — Cyber Risk Review: ANSSI-labelled EBIOS Risk Manager tool; runs the method’s five workshops. | Commercial publisher | Client-server (version 1.0). Publisher: Sia Partners. | The label attests methodological compliance, not price or feature scope: ask the publisher. | Publisher source ↗Checked 2026-09-26 |
| CISO Assistant ↗ | Assessment and compliance (IT and OT) Assess risks and track compliance and security controls. | Open sourceFree | Open-source Community Edition, self-hostable with Docker. | Plan for instance installation, administration and updates. | Publisher source ↗Checked 2026-09-26 |
| CISO Toolbox — analyse de risques ↗ | EBIOS Risk Manager Run an EBIOS RM analysis in five workshops and produce deliverables (PPTX, Word, Excel). | Open sourceFree | Browser application; data saved locally (IndexedDB). | Not ANSSI-labelled; data stays in the browser used and must be backed up by export. | Publisher source ↗Checked 2026-09-26 |
| EGERIE Risk Manager ↗ | EBIOS Risk Manager EGERIE Risk Manager: ANSSI-labelled EBIOS Risk Manager tool; runs the method’s five workshops. | Commercial publisher | Standalone and client-server (version 4.0). Publisher: EGERIE Software. | The label attests methodological compliance, not price: ask the publisher. | Publisher source ↗Checked 2026-09-26 |
| Fence ↗ | EBIOS Risk Manager Fence: ANSSI-labelled EBIOS Risk Manager tool; runs the method’s five workshops. | Commercial publisher | Standalone and client-server (version 3.16). Publisher: Airbus Protect. | The label attests methodological compliance, not price or feature scope: ask the publisher. | Publisher source ↗Checked 2026-09-26 |
| FIRST — calculateur CVSS ↗ | Vulnerabilities and prioritisation Calculate a CVSS v4.0 technical severity score for a vulnerability. | Association or foundationFree | Web calculator. | A CVSS score alone does not provide exploitation likelihood or business risk. | Publisher source ↗Checked 2026-09-26 |
| MONARC ↗ | Assessment and compliance (IT and OT) Assess risks in four phases, reusing similar analyses. | Public bodyOpen source | Online service (MONARC Cloud) or self-hosted installation of the open-source code. | MONARC-specific method; check it matches the expected method (EBIOS RM, ISO 27005…). | Publisher source ↗Checked 2026-09-26 |
| Oligo Risk Manager ↗ | EBIOS Risk Manager Oligo Risk Manager: ANSSI-labelled EBIOS Risk Manager tool; runs the method’s five workshops. | Commercial publisher | Standalone (version 2.1.0) or client-server (version 1.0.0). Publisher: RECIPROC-IT. | The label attests methodological compliance, not price or feature scope: ask the publisher. | Publisher source ↗Checked 2026-09-26 |
| OWASP Threat Dragon ↗ | Threat modelling Draw threat models and record mitigations. | Association or foundationOpen sourceFree | Desktop application or self-hosted web application. | Focuses on application and system threat modelling; it is not a full GRC register. | Publisher source ↗Checked 2026-09-26 |
| Phinasoft Risk Manager ↗ | EBIOS Risk Manager Phinasoft Risk Manager: ANSSI-labelled EBIOS Risk Manager tool; runs the method’s five workshops. | Commercial publisher | Client-server and SaaS (version 2.0). Publisher: Phinasoft. | The label attests methodological compliance, not price or feature scope: ask the publisher. | Publisher source ↗Checked 2026-09-26 |
| Polyodos ↗ | EBIOS Risk Manager · Assessment and compliance (IT and OT) EBIOS RM in five workshops and OT/ICS cybersecurity studies under IEC 62443-3-2, on the same platform. | Commercial publisherFree for teaching | Browser application; local storage, private server or Polyodos server. | Not ANSSI EBIOS RM labelled. Collaboration and sync require a server; a local project stays in its browser. | Publisher source ↗Checked 2026-09-26 |
Guides and references
- ANSSI — EBIOS Risk Manager method ↗
- ANSSI — EBIOS Risk Manager label (labelled software) ↗
- ISA — ISA/IEC 62443 series of standards ↗
- FIRST — CVSS v4.0 calculator ↗
- MITRE ATT&CK ↗
Browse all cyber and OT tools →
EBIOS RM · IEC 62443 / compliance · Vulnerabilities