The method
Published by ANSSI in 2018 with the Club EBIOS, the method is organised in five workshops. It combines a compliance approach — a security baseline based on applicable frameworks — with a scenario approach focused on targeted threats.
It pays attention to the ecosystem: suppliers, partners and service providers are often the most likely attack path. Strategic scenarios describe these paths at high level; operational scenarios detail technical attack modes.
The method is compatible with ISO/IEC 27005 and underpins French information system security accreditation. ANSSI grants a label to software implementing it.
When to use it
- Security accreditation of an information system or digital project.
- Risk analysis required by a framework (NIS2, public sector, critical operators).
- Mapping targeted threats against an organisation and its ecosystem.
Watch out for
- Involve business owners from workshop 1: business values cannot be defined by IT alone.
- Limit the number of risk origin / target objective pairs to keep scenarios workable.
- The method is iterative: plan update cycles rather than a one-off analysis.
The five workshops
- Workshop 1 — Scope and security baseline: scope, business values, supporting assets, feared events, applicable frameworks.
- Workshop 2 — Risk origins: who could attack, with which objectives, and which pairs are most relevant.
- Workshop 3 — Strategic scenarios: high-level attack paths, including through the ecosystem.
- Workshop 4 — Operational scenarios: technical attack modes and likelihood.
- Workshop 5 — Risk treatment: strategy, security measures, residual risks and monitoring.
EBIOS RM software
List from the Aurorisk catalogue, links checked on 2026-09-26. Confirmed free access is listed first; unknown information is labelled.
| Tool | Source · licence · access | Scope | Description |
|---|---|---|---|
| CISO Toolbox — analyse de risques ↗ | Open sourceFree | France | EBIOS RM tool (five workshops) in the browser; data stored locally; free, MIT licence. |
| EBIOS-RM-Graph ↗ | Free | France | Standalone HTML page to build EBIOS RM scenario graphs; JSON export; licence not stated. |
| Polyodos ↗ | Commercial publisherFree for teaching | International | EBIOS RM in five workshops, with IEC 62443. |
| risk.mlab.sh ↗ | Commercial publisherFree with registration | France | Online platform (Cyber Dream) covering the five workshops; free plan with registration, paid advanced features; EU hosting. |
| Agile Risk Manager ↗ | Commercial publisher | France | ANSSI EBIOS RM label (v2.6.2, client-server). Publisher: ALL4TEC. |
| ARIMES ↗ | Commercial publisher | France | ANSSI EBIOS RM label (v1.2, standalone). Publisher: ADACIS. |
| BlueKanGo IRM — méthode EBIOS RM ↗ | Commercial publisher | France | EBIOS RM module of a SaaS risk management platform; demo on request. |
| C2R — Cyber Risk Review ↗ | Commercial publisher | France | ANSSI EBIOS RM label (v1.0, client-server). Publisher: Sia Partners. |
| Digi-IT — EBIOS Risk Manager pour Odoo ↗ | Commercial publisherOpen source | International | Odoo module covering the five workshops; LGPL-3 licence; publisher DIGI-ERP (Tunisia). |
| EGERIE Risk Manager ↗ | Commercial publisher | France | ANSSI EBIOS RM label (v4.0, standalone and client-server). Publisher: EGERIE Software. |
| Fence ↗ | Commercial publisher | France | ANSSI EBIOS RM label (v3.16, standalone and client-server). Publisher: Airbus Protect. |
| Oligo Risk Manager ↗ | Commercial publisher | France | ANSSI EBIOS RM label (v2.1.0 standalone, v1.0.0 client-server). Publisher: RECIPROC-IT. |
| Phinasoft Risk Manager ↗ | Commercial publisher | France | ANSSI EBIOS RM label (v2.0, client-server and SaaS). Publisher: Phinasoft. |
Standards and references
- ANSSI — EBIOS Risk Manager (2018)
- ISO/IEC 27005 — Gestion des risques de sécurité de l’information