In the event of a cyber-AI crisis,
the risk is not the attack itself

It is the loss of organisational control in the early hours

Will you survive?

Indecisive decisions, disorganised teams, vague or contradictory messages… that’s what make a situation turn for the worse, far beyond technical issues.

In a crisis, everything hinges on the ability to make quick decisions and act in a coordinated manner at all levels.

Here is a self-assessment to help you identify the breaking points that cause you to lose control.

Please enable JavaScript in your browser to complete this form.

- Step 1 of 6

25 questions – 5 focus areas – 15' for a snapshot of your situation

🙏🏻Please provide honest answers to make this assessment truly helpful to you.

Note: all your answers will remain confidential.

Optional, unless you would like to receive the results of your assessment by email

Let's start by your crisis governance

What organisation did you implement? With what rules and what people?

Q1 – A serious incident occurs. How do you decide to switch to crisis mode? *

The matter is submitted to the crisis management team, which makes a decision based on clear criteria for declaring a crisis, and a spokesperson is appointed
The person responsible for declaring a crisis has been identified, but the criteria for the Go-decision remain unclear
No one really makes the decision; the situation simply unfolds as it goes along

Q2 – A critical decision must be made within the next half hour, with only incomplete basic information available. What is happening? *

The rules for arbitration(*) and crisis management are designed to facilitate rapid decision-making, even in the event of disagreement
The top priorities have been set, but decision-making depends on who is present and the context
We always wait until we have at least the basic information before making a decision, for fear of getting it wrong, and it’s always the big boss who makes the final call

Decision-making guidelines = what needs to be decided under pressure without time to think (absolute priorities, acceptable compromises, decisions that cannot wait for the executive committee, trigger points, absolute deal-breakers, disagreement management...)

Q3 – Does your definition of critical roles go beyond decision-making authority and access to sensitive data? *

Yes - we have broadened this definition to include roles exposed to reputational and/or organisational risk (*)
No - our definition remains limited to decision-making authority and access to sensitive data
We have not identified any critical roles

(*) Critical roles linked to reputational and/or organisational risks = Head of Communications, Head of Human Resources, customer service staff, receptionists, executive assistants, interns and apprentices, frustrated employees, etc.

Q4 – Have you listed all the tools (AI and others) used within your organisation, along with clear guidelines for their use? *

All tools are listed, categorised, prioritised, and our staff are fully briefed on the rules for using each one
We have a list of the main tools, though we cannot guarantee that we are aware of all those used by our employees, or how they use them
No shortlist has been drawn up to date

Q5 – Have you considered scenarios in which information published externally or generated by your AI tools is manipulated or misleading, without you being able to detect it quickly? *

Yes, -these scenarios have been developed, are documented, and the appropriate responses have been formalised
Our scenarios are primarily based on typical cyber incidents
We haven’t worked out any scenarios

Now, let’s focus on crisis communication, which is often overlooked in crisis management

In times of crisis, what should you say to your employees, customers, suppliers, etc.? How? Through which channels?

Q6 – Have you put a crisis communication strategy in place? *

A well-defined strategy, tested and refined, with clear guidelines communicated to our staff and key details shared with our suppliers and customers
A basic framework has been established and communicated to our staff, without a clearly defined media or social media strategy
No strategy has been defined

Crisis communication strategy = communication framework (what can and cannot be said, key messaging to use or avoid, hashtags and keywords, relations with journalists, social media approach, etc.)

guidelines logos, prove

Q7 – Have you defence narratives and evidence of authenticity for critical content, based on plausible scenarios, that are ready to counter potential deepfakes and disinformation? *

Yes - response narratives and evidence of authenticity have been developed based on carefully crafted scenarios relevant to our context, and are ready to be deployed
We have prepared some initial defence materials (narratives, evidence) based on the most common scenarios reported in the press, but nothing specific to our organisation
No - we haven't made any arrangements in that regard

Q8 – Do you have pre-approved messages that can be adapted immediately in the event of a crisis? *

Messages have been prepared for the identified cyber and AI scenarios and are applicable to the various phases of a crisis
There are templates for standard cyber incidents (excluding AI manipulations) and for the three main phases of a crisis (early, middle and late)
No message has been prepared. We adapt our response depending on the type of crisis

Q9 – Can you communicate securely if your usual channels are unavailable or compromised? *

Various secure alternative channels have been established and tested for each type of contact, and the relevant parties have been informed
We have set up a few secure channels, which we tested when they were first established. The rest of our communication is informal.
No alternative arrangements have been made. We have the mobile phone numbers of our key contacts

Q10 – 7.32 am, Monday morning. A journalist is trying to speak to the CEO, as he has received a press release signed by the CEO announcing the immediate suspension of operations due to tax fraud. However, the CEO is away on business and cannot be reached. What is going on? *

Being alerted to the fake news, a protocol is immediately put into action: source identified, swift response issued, structured denial prepared, internal communications launched and a press release finalised – all within the hour.
The standard procedure is handled by the CEO’s assistant or the Head of Communications, who will respond with something along the lines of “we’ll get back to you with concrete details” and ensure that the information is addressed internally
The call causes confusion and the information spreads throughout the organisation. The journalist is given conflicting messages.

Let’s see how your organisation perceives a crisis and responds to it

The level of vigilance, an understanding of how a crisis unfolds, how to respond to a crisis, etc.

Q11 – Are your teams able to identify and assess incidents, anomalies and early warning signs (including those related to AI)? *

All these elements – both technical and non-technical – are defined, documented and incorporated into the teams’ working practices, and the teams have been made aware of them
Cyber incidents are explained and documented, and our teams receive appropriate training. As for the rest – AI anomalies and weak signals – nothing has been done to date
No training or awareness-raising on these various issues has been provided to the teams. Even we, at management level, are not very familiar with them

Q12 – Are mechanisms in place for detecting and reporting incidents, anomalies, deepfakes and weak signals, operating 24/7? *

We have combined several measures – technical detection tools, an alert system with a clear protocol, and training and vigilance tests for our teams
We have detection and alerting tools, designed to identify technical incidents, which operate in line with incident escalation and feedback loop protocols
We have no detection mechanisms in place; just informal human vigilance

Q13 - Do you actively monitor your exposure and digital footprint? *

Yes - a structured monitoring system covers the media, social media, forums and weak signals, with customisable alerts
A media and social media monitoring system is in place, but that’s about it
We only have Google alerts set up at management level

Q14 – Are your teams and managers trained to respond in crisis situations, when faced with uncertainty and under time pressure? *

Yes - regular exercises in real-world conditions incorporate realistic scenarios (uncertainty, pressure, time constraints, emerging threats)
We organise one crisis simulation a year, which is fairly theoretical
No training or simulations have been carried out so far

Q15 – Have any ‘cyberIA ambassadors’ been appointed within your teams to quickly report unusual alerts, pass on instructions and sensitive information, or help manage stress? *

Each department has a designated contact person who is fully trained in cyber threats and anomalies specific to their line of work, as well as in managing cognitive biases and stress
Only the key departments have their own, properly trained staff
No, everything goes through management and the area managers

Let’s now check your ability to protect the integrity of your information and content

Q16 - Are your official content (audio, voice recordings, video, documents, signatures, logos, job vacancies, etc.) catalogued, classified, protected, authenticated and traceable to prevent any falsification or impersonation? *

Yes - we have listed and classified all our content according to specific criteria. Furthermore, technical, procedural and legal measures are in place to protect it
Only highly sensitive content is protected in accordance with common-sense criteria
We haven't started work on this task yet

Q17 - Have response time targets been set according to the type of incident and the criticality of the assets affected? *

Yes - they are defined, documented, tested, understood by the teams and measured
We have a general framework with critical thresholds
Nothing has been clearly defined

Q18 - Do you have an ‘anti-deepfake’ checklist for sensitive public statements? *

Absolutely. Every time we speak, we go back over the outline we’ve drawn up and adapt it as necessary.
There is no specific list, but we have drawn up a set of arguments and justifications
No List made

Q19 – Is there a formalised approval and verification process in place prior to any sensitive publication (press release, public statement, strategic content)? *

Yes - a clear process is in place (validation, verification, traceability) and is applied systematically
Validations do exist, but there is no formal framework or full traceability
No, approvals are assessed on a case-by-case basis

Q20 – A credible press release is circulating in your name, announcing the closure of a site with 200 layoffs. It is false. Can you quickly prove that it did not come from you? *

Information is detected quickly and verified immediately. The source of the content is identified and traced. A clear rebuttal is published promptly, backed up by concrete evidence to prove that it is fraudulent
As soon as the information is received, a denial is drafted using a pre-approved template, published swiftly, but without any solid evidence to prove that it is false
The statement is causing confusion throughout the organisation. Teams are unsure what to think and what to say to their external contacts. The official response is slow and improvised.

Finally, the post-crisis phase

A crisis is never truly over when it stops. The effects linger: reputational damage, human trauma, partner distrust, ongoing legal proceedings, vulnerabilities not yet addressed.

Q21 – How do you actually decide when a crisis is over? *

Clear criteria are applied, enabling decisions to be made without ambiguity
The decision depends on how you feel and the circumstances
The crisis is ‘fading away’ of its own accord without any formal decision

Q22 – After a crisis, what actually happens within your organisation? *

A structured review of the experience is carried out promptly. Decisions are made and monitored over time
A review is carried out with the teams, followed by limited action or no real follow-up, due to business pressures
An informal review is carried out, without leading to many concrete changes. We are under too much pressure to deliver short-term profitability

Q23 – After a crisis, how are your teams looked after? *

A structured support programme has been put in place (psychological support, fatigue management, support for managers) with ongoing monitoring
Measures are being put in place (exchanges, ad hoc support), but without a structured framework or long-term monitoring
Managers are left to manage their teams through local initiatives, without an overarching framework or specific support

Q24 – After a crisis, how do you rebuild trust with your stakeholders if it has been damaged? *

Long-term initiatives are being implemented, both internally and externally, featuring consistent messaging, concrete evidence and, where necessary, coordinated commercial actions to restore confidence
Measures are taken in the wake of the crisis (communication-related, and sometimes commercial), but without clear coordination or structured follow-up
Statements are made in the wake of the crisis, but without any follow-up or concrete action to restore confidence in the long term

Q25 – Have the shortcomings exposed by the crisis actually been addressed? *

All are listed, prioritised and addressed with proper follow-up to ensure that each vulnerability is rectified appropriately and effectively
The most critical vulnerabilities are addressed and fixed; the others are dealt with on a case-by-case basis, depending on need and the time available
Only one or two are treated, for reasons of cost-effectiveness

Diagnostic completed!

At the end of this assessment, you will be offered practical assistance
to quickly address your most critical vulnerabilities

In the event of a cyber-AI crisis,the risk is not the attack itself