Are you truly prepared for a cyber-AI crisis?

Stress, manipulation, misinformation, deepfake, reputational pressure…

Would you survive?

To find out, this diagnostic is for you👇🏻

A cyber-AI crisis is emerging, no longer triggered solely by technical incidents but increasingly through manipulative tactics (phishing, vishing, spoofing, deepfakes, corrupted AI models, etc.) that are difficult and/or time-consuming to detect, causing serious damage to trust.

In the face of these threats, leaders are on the front line, and often have no safety net.

Here is a tool to assess your ability to deal with a cyber crisis – strengths, weaknesses, blind spots, etc. – as well as to explore ideas on what measures to implement in line with your needs.

What does our assessment involve?

3 dimensions:

Crisis Governance — your organisation, your rules, your roles, your structure
Crisis Communication — your audience, your narratives, your messages, your channels, your spokepersons, your strategies
Team Responsiveness — your ability to respond appropriately and collectively when the time is right

On your marks, get set…

Please enable JavaScript in your browser to complete this form.

- Step 1 of 4

Assess your ability to respond to a cyberIA crisis

⏱️18 - 20' to know where you're standing in terms of preparation.

Important : Please answer honestly so that this assessment will be truly helpful to you, and rest assured that all your answers will remain confidential.

Ready?

Let's start by your crisis governance

What organisation did you implement? With what rules and what people?

Q1 - Has a crisis management team been set up with a clearly identified leader, clearly defined roles and responsibilities, and designated deputies? *

Yes, the team is in place
Currently being formed
No

Q2 - Have arbitration rules been established for stressful situations? *

Yes, everything has been settled, documented and tested.
Partially. Some points have been clarified, others no.
No. None of that.

Decision-making guidelines = what needs to be decided under pressure without time to think (absolute priorities, acceptable compromises, decisions that cannot wait for the executive committee, trigger points, absolute deal-breakers)

Q3 - Have you identified any cyber scenarios involving deepfakes or narrative manipulation targeting your senior management or your organisation’s reputation? *

Definitely. We’ve considered every possible option, including cyber incidents, deepfake and actual scenarios of leadership being compromised- evidence of misuse or drugs, prostitution, abuse etc
We have identified only purely cyber scenarios
We haven't considered any scenarios

Q4 - Have you compiled a list of all the AI tools used within your organisation, along with clear guidelines for their use? *

Yes, we have a shortlist of these tools, ranked in order of priority, and our staff have been properly briefed on the rules for using each one
We have a list of the main ones; we know that some employees are using AI tools without telling us
None of that.

Q5 – Have you made provisions for a scenario in which your own AI systems are compromised, manipulated or rendered unavailable? If so, do you have a fallback operating mode? *

Yes, AI failure scenarios have been documented and a fallback mode has been tested by regular red teaming games
More or less. The risk has been identified, but there is no formalised operational plan
No. Reliance on AI systems has not been factored into the crisis scenarios

Q6 - Do you have an approved and tested contingency plan that addresses the identified cyber and AI risks? *

Yes, everything is in place – the response and escalation plan, descriptions of threats and planned countermeasures, etc. – defined jointly with IT and Legal
More or less. We have simply identified the cyber threats we are exposed to.
None of that

Q7 – Has an official spokesperson been clearly designated and trained, including their deputy? *

Yes. Identified, trained, briefed - media training, solid line of argument to counter tricky questions from well-informed journalists or questions that might play into the hands of competitors
We have appointed a spokesperson, but not trained and without any deputy
No

Q8 – Have you set out in writing what must continue to function within your organisation in the event of a major crisis, and how this can be achieved? *

Yes, we have a formalised business continuity plan, regularly tested according to a strict planning to ensure that all risks of loss of control, whether technical or physical in nature, are properly managed
Our plan focuses mainly on technical risks, not on other aspects
We have no business continuity plan

Q9 – Have you mapped out the incoming and outgoing data flows that feed into your AI tools, and assessed their quality and the reliability of the sources?* *

Yes, our data streams are mapped, our sources are assessed, and data quality is regularly checked, including in the pre-production and development environments
Some data streams are mapped, but not all, and the quality of the sources is not systematically assessed
No

Q10 – Does your definition of critical roles go beyond decision-making authority and access to sensitive data? *

Yes, our mapping includes all the profiles identified (decision-makers, organisational staff, vulnerable individuals, and visitors)
Our definition remains limited to decision-making authority and access to sensitive information
We have not identified any critical roles

Q11 – Does your vigilance process cover critical roles other than technical ones? *

Yes, our monitoring process covers all of these profiles
Our monitoring process is limited to IT and the crisis management team
We do not have a monitoring process

An attacker always strikes where you least expect it. In the event of a major crisis rendering your usual systems inaccessible, have you thought outside the box to find alternative ways to coordinate and keep operating? *

Yes, after an extensive brainstorming session, several original measures are in place, tested and familiar to the teams
We followed the standard measures
No, we never thought about putting alternative means in place

By ‘alternative means’, we mean offline access to critical data, workstations isolated from the main network, backup generators, a fallback site, and a designated physical assembly point...

Q13 – Have you defined what constitutes ‘weak signals’ within your organisation, and who is responsible for identifying and reporting them? *

Yes, the different types of weak signals are clearly defined and documented, and every employee knows who to report them to
We have listed and defined algorithmic weak signals. What other types are there?
No, this concept has not been discussed at all within our organisation

Now, let’s focus on crisis communication, which is often overlooked

In times of crisis, what should you say to your employees, customers, suppliers, etc.? How? Through which channels?

Q14 - The most devastating reputational threats are often the ones that were never anticipated. Have you thought through the possible attack angles your organization could be exposed to in a crisis, from those specific to your particular context to the most unimaginable? *

Yes, we cast a wide net to map reputational scenarios from the most obvious to the most unlikely — deepfakes, narrative manipulation, image reversal, attack via a trusted third party...
We have listed the most obvious risks, without going further
No, we have not thought about possible reputational risks

Q15 – Have you prepared defensive narratives and evidence to verify the authenticity of critical content in order to counter any attempts to manipulate your image or your public statements? *

Yes, we have anticipated this risk by providing anti-deepfake and anti-cyber stories, as well as ready-to-use evidence
We’ve given it some thought, but nothing has been formalised yet
No, that risk has not yet been considered

Q16 – Have you identified, segmented and prioritised the various internal and external audiences to be informed in the event of a crisis? *

Yes, each audience is identified along with its specific communication needs and priorities
We have a list of internal and external contacts, without any specific segmentation
No

Q17 - Have you identified secure alternative communication channels for use in the event of a crisis? *

Yes, dedicated channels are in place, have been tested, are secure and are known to our internal and external contacts
We have set up a few secure channels, which we tested when they were first established. The rest of our communication is informal.
No

in quickly

Q18 – Have you prepared standard messages, which have been approved and tailored to each audience and to different crisis scenarios, so that they simply need to be adapted when the time comes? *

Yes, pre-approved messages covering the various cyber+IA scenarios identified are ready to use. They will simply be adapted to the situation
There are incident response frameworks for cyber incidents, but none exist for AI scenarios
We'll adapt when the time comes, depending on the type of attack

Q19 - In the event of a crisis, have you put in place a dedicated communication plan for your employees — guidelines, official channels, update frequency, psychological support — knowing that recovery is rarely linear and that your plan must be able to adapt to unexpected relapses? *

Yes, a clear plan is set out and tested in a protocol, with clear guidelines and a dedicated psychological support, as well as adaptation processes for relapses
We have a plan for the acute phase, but without anticipating relapses or testing the plan's durability
No, our communication is mainly outward-facing

Q20 – Do you have a media strategy in the event of a crisis? *

Yes, we have defined a cyberAI editorial strategy, established key contacts with targeted journalists, and built up a high-quality media database that is regularly updated
We have a few key media contacts and a media database that is more or less up to date, but we do not have a formalised cyberAI media strategy
The media aspect is not taken into account at all in our crisis management

Q21 - Do you have a dedicated social media strategy in place for crisis situations? *

Yes, we have established strict guidelines for responses based on the topic and for each social media platform, using pre-approved messages.
A professional with crisis management training manages our company accounts and will guide us if necessary.
We will manage our social media accounts sensibly when the time comes

Q22 – 7.32 am, Monday morning. A journalist is trying to speak to a company representative. He has received a press release signed by the CEO announcing the immediate suspension of operations due to tax fraud, whilst the CEO is on a transatlantic flight and cannot be reached. What is going on? *

A protocol is immediately activated: CEO liaison, designated spokesperson, rebuttals and internal communications ready to be published with minor adjustments, media contacts available within 15 minutes
The CEO’s right-hand man takes over, providing a firm response and supporting documentation where necessary. However, there remains a risk of conflicting responses should staff members be contacted
There is a high risk of panic. The CEO’s assistant and the CFO are answering the journalist’s questions off the cuff. A rumour is said to be spreading among the staff.

Let’s see how your organisation perceives a crisis and responds to it

The level of vigilance, an understanding of how a crisis unfolds, how to respond to a crisis, etc.

Q23 – Have you defined – and shared with your teams – exactly what constitutes incidents, anomalies and early warning signs within your organisation? *

Yes, everything is defined and documented. The teams have been trained and we regularly update our lists and documents.
Technical incidents are defined, but not AI anomalies or weak signals
No, none of these concepts are clearly defined within our organisation

Q24 – Are mechanisms in place for detecting and reporting incidents, anomalies, deepfakes and weak signals, operating 24/7? *

Yes, we have a number of complementary measures in place – technical detection tools, an alert system with a clear protocol, and training and simulation exercises to improve staff vigilance
We have technical detection and alerting tools, primarily focused on technical incidents, and we have put in place an incident reporting procedure.
We have raised awareness among our teams about cyber risks and have put in place simple reporting procedures via line managers
Nothing in particular is in place

Q25 - Do you have a system in place to monitor what is being published about your organisation and emerging threats? *

Yes, we have an active and dynamic monitoring system in place, covering forums, social media, the mainstream media and the dark web, with alerts configured based on keywords, noise thresholds, sentiment analysis and so on.
We monitor mentions on social media and in the press, and have set up a system to provide information on new cyber threats
We only have Google Alerts set up

Q26 – Have you carried out at least one crisis exercise in the last 12 months? *

Yes, we organise at least two a year
No, but it’s been arranged and planned
Never

Q27 - Have response time targets been set according to the type of incident and the criticality of the assets affected? *

Yes, they are defined, documented, known to the teams and measured
We have a general framework with critical thresholds
No

Q28 – Have any ‘cyberIA ambassadors’ been appointed within your teams to quickly report unusual alerts, pass on instructions and sensitive information, or help manage stress? *

Yes, each department has its own designated contact person, who has received proper training in cyber threats and profession-related anomalies, as well as in managing cognitive biases and stress
Only the key departments have their own, properly trained cyberIA ambassador
A few of them were selected for their emotional intelligence, but they haven’t received any specific training beyond the cyber security training that everyone undertakes
No, everything goes through the area managers

Q29 – A cyber-AI crisis is often managed in a state of complete uncertainty, without having all the facts at hand (source and nature of the problem, scale, scope, etc.), and with a maximum of two hours to communicate. Is your management team trained to make decisions under these conditions? *

Yes, we have worked through this scenario and trained our senior management to make decisions in conditions of complete uncertainty, whilst taking into account regulatory requirements and the deadlines imposed by our industry
To some extent. We are used to dealing with stressful situations and are familiar with the legal requirements, but we generally wait until we have all the facts before communicating internally and externally
No, this sort of situation makes us very uncomfortable, and the regulatory requirements have not yet been incorporated into our crisis management plan

Q30 - Do you have an ‘anti-deepfake’ checklist for sensitive public statements? *

Absolutely. Every time we speak, we go back over the outline we’ve drawn up and adapt it as necessary.
There is no specific list, but we have drawn up a set of arguments and justifications
No List made

Q31 - Are your official documents (audio, video, documents, signatures, job vacancies, etc.) identified, classified, protected, authenticated and traceable to prevent any tampering or forgery? *

Yes, we have catalogued and classified all the official content we produce according to specific criteria, and technical, procedural and legal measures are in place to protect it
Only highly critical content is protected, based on common-sense criteria. The rest does not even qualify.
No, no official content is protected.

Q32 - Do you have a lawyer specialising in AI matters who can be called upon at short notice in the event that one of your AI tools is tampered with? *

Identified, qualified, hired
Looking for him(her)
Didn't even think about it

Q33 – Monday morning, 8am. A video is circulating showing your CEO announcing the redundancy of 200 people. It is a deepfake. What happens within your organisation in the first 30 minutes? *

We have a specific protocol that can be activated as soon as a deepfake is detected; it will be verified using a tried-and-tested system and countered with a pre-approved rebuttal, published within 30 minutes
Our communications team passes the information on to top management, who prepares the response to be issued and decide which account to use, using pre-defined rebuttal points but without any real verification process in place.
Someone from outside our organisation informs the management, who hastily draw up a firm denial, without any concrete evidence to support it.