REACTIV is a “temporary shift in effort” designed to “limit the damage.”
Vincent Strubel, the chief executive of ANSSI, describes this mechanism as it was launched on September 1, 2026.
In the background, an order from the Prime Minister. At the end of August, he asked for the creation around the agency of “a first-response unit, engaged from the moment a breach of a sensitive access occurs and kept in place until restoration.”
Thus results REACTIV (RÉponse et ACTion Interministérielle face aux Violations de données).
The ANSSI does not specify the scope of this “enhanced capacity to respond, intervene and assist state services.” It does, however, say it will strengthen its authority within this framework. It may, in particular, “require ministries, within tight deadlines, to take the immediate measures necessary to protect the data of citizens entrusted to the administrations.”
« Limit the damage » in the face of the « hit & run »
Strubel recontextualizes: for about a year now, the cyber threat landscape has undergone a major evolution. In addition to state-backed and organized-crime attacks, there are those carried out by “young French people, not highly coordinated but who exploit bases of accounts compromised by infostealers or prior intrusions.” The ANSSI, he notes, does not know their deeper motivations, nor what triggered this rise in intensity.
In any case, their attacks pose a particular challenge. On the one hand, because they target systems that had been little targeted until now. On the other, because the modus operandi is different. It is a “hit-and-run” approach, without seeking high privileges or a real effort to mask traces.
Restricted to the post-incident phase, REACTIV represents a temporary patch, applied while the measures laid out in the State’s 2026-2027 digital security road map take effect. Among other essential priorities, it defines the strengthening of authentications and access controls, as well as the elimination of obsolescence.
