Truly prepared for a cyber-AI crisis?

Stress, manipulation, misinformation, deepfake, reputational pressure…

Will you survive?

To find out, this diagnostic is for you👇🏻

Strengths, weaknesses, blind spots…

⏱️18 – 20′ to know where you’re standing in terms of preparation.

Please enable JavaScript in your browser to complete this form.

- Step 1 of 5

🙏🏻Please provide honest answers so that this assessment will be truly helpful to you.

Note: all your answers will remain confidential.

Let's start by your crisis governance

What organisation did you implement? With what rules and what people?

Q1 - Has a crisis management team been set up with a clearly identified leader, clearly defined roles and responsibilities, and designated deputies? *

Yes, the team is in place
Currently being formed
No

Q2 - Have arbitration rules been established for stressful situations? *

Yes, everything has been settled, documented and tested.
Partially - Some points have been clarified, others no.
None of that.

Decision-making guidelines = what needs to be decided under pressure without time to think (absolute priorities, acceptable compromises, decisions that cannot wait for the executive committee, trigger points, absolute deal-breakers)

Q3 - Have you identified any cyber scenarios involving deepfakes or narrative manipulation targeting your senior management or your organisation’s reputation? *

Definitely. - We’ve considered every possible option, including cyber incidents, deepfakes and actual scenarios of leadership being compromised (e.g., evidence of misuse or drugs, prostitution, abuse etc.)
We have identified only purely cyber scenarios
We haven't considered any scenarios

Q4 - Have you listed all the AI tools used within your organisation, along with clear guidelines for their use? *

Yes, we have a shortlist of these tools, ranked in order of priority, and our staff have been properly briefed on the rules for using each one
We have a list of the main ones; we know that some employees are using AI tools without telling us
None of that

Q5 – Have you anticipated a scenario, where your own AI systems are compromised, manipulated or rendered unavailable? If so, do you have a fallback operating mode? *

Yes, AI failure scenarios have been documented and a fallback mode has been tested by regular red teaming games
More or less - The risk has been identified but, there is no formalised operational plan
No - Reliance on AI systems has not been factored into the crisis scenarios

Q6 - Do you have an approved and tested contingency plan that addresses the identified cyber and AI risks? *

Yes, everything is in place – the response and escalation plan, descriptions of threats and planned countermeasures, etc. – agreed with IT and Legal
More or less - We have simply identified the cyber threats we are exposed to.
None of that

Q7 – Has an official spokesperson been clearly designated and trained, including their deputy? *

Yes. Identified, trained, briefed (e,g, media training, solid line of argument to counter tricky questions from well-informed journalists or questions that might play into the hands of competitors)
We have appointed a spokesperson. However, they are not trained and no appointed deputy
No

Q8 – In the event of a major crisis, have you written down what must continue to function within your organisation , and how can this be achieved? *

Yes, we have a formalised business continuity plan, regularly tested according to a strict planning to ensure that all risks of loss of control, whether technical or physical in nature, are properly managed
Our plan focuses mainly on technical risks, not on other aspects
We have no business continuity plan

Q9 – Have you mapped out the incoming and outgoing data flows that feed into your AI tools, and assessed their quality and the reliability of the sources?* *

Yes, our data streams are mapped, our sources are assessed, and data quality is regularly checked, including in the pre-production and development environments
Some data streams are mapped but not all of them, as well as and the quality of the sources is not systematically assessed
No

Q10 – Does your definition of critical roles go beyond decision-making authority and access to sensitive data? *

Yes, our mapping includes all the identified profiles (decision-makers, organisational staff, vulnerable individuals, and visitors)
Our definition remains limited to decision-making authority and access to sensitive information
We have not identified any critical roles

Q11 – Does your vigilance process cover critical roles other than technical ones? *

Yes, our monitoring process covers all of these profiles
Our monitoring process is limited to IT and the crisis management team
We do not have a monitoring process

Q12 - An attacker always strikes where you least expect it. If your core systems fail in a crisis, have you thought out the box to find alternative ways to coordinate and keep operating? *

Yes, after an extensive brainstorming session, several original measures are in place, tested and familiar to the teams
We followed the standard measures
No, we never thought about putting 'alternative means' in place

By ‘alternative means’, we mean offline access to critical data, workstations isolated from the main network, backup generators, a fallback site, and a designated physical assembly point...

Q13 – Have you defined what constitutes ‘weak signals’ within your organisation, and who is responsible for identifying and reporting them? *

Yes, the different types of weak signals are clearly defined and documented, and every employee knows who to report them to
We have listed and defined algorithmic weak signals. What other types are there?
No, this concept has not been discussed at all within our organisation

Q14 - Are your official documents (audio, video, documents, signatures, job vacancies, etc.) identified, classified, protected, authenticated and traceable to prevent any tampering or forgery? *

Yes, we have catalogued and classified all the official content we produce according to specific criteria, and technical, procedural and legal measures are in place to protect it
Only highly critical content is protected, based on common-sense criteria. The rest is not even qualified.
No, no official content is protected.

Now, let’s focus on crisis communication, which is often overlooked

In times of crisis, what should you say to your employees, customers, suppliers, etc.? How? Through which channels?

Q15 - The most devastating reputational threats are often the ones that were never anticipated. Have you thought through the possible attack angles your organization could be exposed to in a crisis, from those specific to your particular context to the most unimaginable? *

Yes, we cast a wide net to map reputational scenarios from the most obvious to the most unlikely — deepfakes, narrative manipulation, image reversal, attack via a trusted third party...
We have listed the most obvious risks, without going further
No, we have not thought about possible reputational risks

Q16 – Have you prepared defensive narratives and evidence to verify the authenticity of critical content in order to counter any attempts to manipulate your image or your public statements? *

Yes, we have anticipated this risk by providing anti-deepfake and anti-cyber stories, as well as ready-to-use evidence
We have evidence available, but no defence case has been prepared
We have some drafted narratives, but nothing has been finalised yet
No, that risk has not yet been considered

Q17 – Have you identified, segmented and prioritised the various internal and external audiences to be informed in the event of a crisis? *

Yes, each audience is identified along with its specific communication needs and priorities
We have a list of internal and external contacts, without any specific segmentation
No

Q18 - Have you identified secure alternative communication channels for use in the event of a crisis? *

Yes, dedicated channels are in place, have been tested, are secure and are known to our internal and external contacts
We have set up a few secure channels, which we tested when they were first established. The rest of our communication is informal.
No

Q19 – Have you prepared standard messages, which have been approved and tailored to each audience and to different crisis scenarios, so that they simply need to be adapted when the time comes? *

Yes, pre-approved messages covering the various cyber+IA scenarios identified are ready to use. They will simply be adapted to the situation
There are incident response frameworks for cyber incidents, but none exist for AI scenarios
We'll adapt when the time comes, depending on the type of attack

Q20 - In the event of a crisis, have you put in place a dedicated communication plan for your employees — guidelines, official channels, update frequency, psychological support — knowing that recovery is rarely linear and that your plan must be able to adapt to unexpected relapses? *

Yes, a clear plan is set out and tested in a protocol, with clear guidelines and a dedicated psychological support, as well as adaptation processes for relapses
We have a plan for the acute phase, but without anticipating relapses or testing the plan's durability
No, our communication is mainly outward-facing

Q21 – Do you have a media strategy in the event of a crisis? *

Yes, we have defined a cyberAI editorial strategy, established key contacts with targeted journalists, and built up a high-quality media database that is regularly updated
We have a few key media contacts and a media database that is more or less up to date, but we do not have a formalised cyberAI media strategy
The media aspect is not taken into account at all in our crisis management

Q22 - Do you have a dedicated social media strategy in place for crisis situations? *

Yes, we have established strict guidelines for responses based on the topic and for each social media platform, using pre-approved messages.
A professional with crisis management training manages our company accounts and will guide us if necessary.
We will manage our social media accounts sensibly when the time comes

Q23 - Are your official signatures (email, logo, visual templates) easy to copy and reuse without any control? *

Difficult. Usage is clearly controlled and monitored
Some elements are protected, others are not
Everything is freely downloadable, with no protection whatsoever

Q24 – 7.32 am, Monday morning. A journalist is trying to speak to a company representative. He has received a press release signed by the CEO announcing the immediate suspension of operations due to tax fraud, whilst the CEO is on a transatlantic flight and cannot be reached. What is going on? *

A protocol is immediately activated: CEO liaison, designated spokesperson, rebuttals and internal communications ready to be published with minor adjustments, media contacts available within 15 minutes
The CEO’s right-hand man takes over, providing a firm response and supporting documentation where necessary. However, there remains a risk of conflicting responses should staff members be contacted
The CEO would be contacted at all costs, even if it means waiting. No stand-in has been appointed for this type of situation
There is a high risk of panic. The CEO’s assistant and the CFO are answering the journalist’s questions off the cuff. A rumour is said to be spreading among the staff

Let’s see how your organisation perceives a crisis and responds to it

The level of vigilance, an understanding of how a crisis unfolds, how to respond to a crisis, etc.

Q25 – Have you defined – and shared with your teams – exactly what constitutes incidents, anomalies and early warning signs within your organisation? *

Yes, everything is defined and documented. The teams have been trained and we regularly update our lists and documents.
Technical incidents are defined, but not AI anomalies or weak signals
No, none of these concepts are clearly defined within our organisation

Q26 – Are mechanisms in place for detecting and reporting incidents, anomalies, deepfakes and weak signals, operating 24/7? *

Yes, we have a number of complementary measures in place – technical detection tools, an alert system with a clear protocol, and training and simulation exercises to improve staff vigilance
We have technical detection and alerting tools, primarily focused on technical incidents, and we have put in place an incident reporting procedure.
We have raised awareness among our teams about cyber risks and have put in place simple reporting procedures via line managers
Nothing in particular is in place

Q27 - Do you have a system in place to monitor what is being published about your organisation and emerging threats? *

Yes, we have an active and dynamic monitoring system in place, covering forums, social media, the mainstream media and the dark web, with alerts configured based on keywords, noise thresholds, sentiment analysis and so on.
We monitor mentions on social media and in the press, and have set up a system to provide information on new cyber threats
We only have Google Alerts set up

Q28 – Have you carried out at least one crisis exercise in the last 12 months? *

Yes, we organise at least two a year
No, but it’s been arranged and planned
Never

Q29 - Have response time targets been set according to the type of incident and the criticality of the assets affected? *

Yes, they are defined, documented, known to the teams and measured
We have a general framework with critical thresholds
No

Q30 – Have any ‘cyberIA ambassadors’ been appointed within your teams to quickly report unusual alerts, pass on instructions and sensitive information, or help manage stress? *

Yes, each department has its own designated contact person, who has received proper training in cyber threats and profession-related anomalies, as well as in managing cognitive biases and stress
Only the key departments have their own, properly trained cyberIA ambassador
A few of them were selected for their emotional intelligence, but they haven’t received any specific training beyond the cyber security training that everyone undertakes
No, everything goes through the area managers

Q31 – A cyber-AI crisis is often managed in a state of complete uncertainty, without having all the facts at hand (source and nature of the problem, scale, scope, etc.), and with a maximum of two hours to communicate. Is your management team trained to make decisions under these conditions? *

Yes, we have worked through this scenario and trained our senior management to make decisions in conditions of complete uncertainty, whilst taking into account regulatory requirements and the deadlines imposed by our industry
To some extent. We are used to dealing with stressful situations and are familiar with the legal requirements, but we generally wait until we have all the facts before communicating internally and externally
No, this sort of situation makes us very uncomfortable, and the regulatory requirements have not yet been incorporated into our crisis management plan

Q31 - Do you have an ‘anti-deepfake’ checklist for sensitive public statements? *

Absolutely. Every time we speak, we go back over the outline we’ve drawn up and adapt it as necessary.
There is no specific list, but we have drawn up a set of arguments and justifications
No List made

Q32 - Do you have a lawyer specialising in AI matters who can be called upon at short notice in the event that one of your AI tools is tampered with? *

Identified, qualified, hired
Looking for him(her)
Didn't even think about it

Q34 – Monday morning, 8am. A video is circulating showing your CEO announcing the redundancy of 200 people. It is a deepfake. What happens within your organisation in the first 30 minutes? *

We have a specific protocol that can be activated as soon as a deepfake is detected; it will be verified using a tried-and-tested system and countered with a pre-approved rebuttal, published within 30 minutes
Our communications team passes the information on to top management, who prepares the response to be issued and decide which account to use, using pre-defined rebuttal points but without any real verification process in place.
Someone from outside our organisation informs the management, who hastily draw up a firm denial, without any concrete evidence to support it.

Finally, the post-crisis phase

A crisis is never truly over when it stops. The effects linger: reputational damage, human trauma, partner distrust, ongoing legal proceedings, vulnerabilities not yet addressed.

Q35 - Have you defined the criteria that will allow you to officially declare the end of the crisis? *

Yes, clear criteria are defined and known to decision-makers
We have a general idea but without formalized criteria
No, this decision will be made in the moment

Q36 - Have you put in place a structured debriefing process to analyse what happened and draw lessons from it? *

Yes, a process is formalized with designated responsible parties
We’ll hold an informal meeting among managers, without any formal process or designated chairperson
We’ll conduct a debrief with staff, without any formal process
No, we have not anticipated this step

Q37 - Have you anticipated the emotional and psychological support of your teams after the crisis? *

Yes, a support plan is in place with identified resources
Partially, we will think about it but without a prepared plan
No, this dimension has not been considered

Q38 - Have you prepared a reputation rebuilding strategy for the post-crisis phase? *

Yes, specific actions and messages have been anticipated for this phase
We have general ideas but without a formalized plan
No, these corrections will be made on an ad hoc basis

people. contingency and

Q39 - Have you put in place a remediation plan to address the vulnerabilities revealed by the crisis? *

Yes, an identification and correction process has been anticipated
We will address the most urgent issues
No, these corrections will be made on an ad hoc basis

Q40 - Have you anticipated, if needed, how to rebuild trust with your external stakeholders — clients, partners, regulators — after the crisis? *

Yes, specific actions are planned for each audience
Partially, we have thought about the most critical relationships
No, we have not anticipated this dimension