The National Agency for Information System Security (ANSSI) has published its third sector-specific kit for cyber crisis exercises, this time aimed at the agro-food sector. Yet drafting a scripted scenario does not automatically guarantee success when an unforeseen event occurs.
On June 25, 2026, ANSSI released its third sectoral training kit for cyber crisis management, following previous editions focused on higher education and the audiovisual sector. The target sector this time is the agro-food industry, not because it faces a special risk, but because no organization is immune to an attack.
The kit offers a calibrated scenario and three levels of complexity tailored to an organization’s maturity. It is a useful initiative: preparation, the agency notes, remains one of the keys to limiting the impact of a attack.
A pedagogy that has proven itself over several years
This approach is not new, and there is merit in continuing to pursue it. For years, ANSSI has encouraged organizations to train before a crisis rather than improvise during one. An exercise aims to involve the right people, in the right order, with backup tools. It also reveals the blind spots of plans left on a shelf for too long: an outdated contact, a backup that has never been tested, for example.
For sectors less accustomed to cyber exercises like agro-food, this initial foray carries real educational value.
A scripted scenario that stops where the unforeseen begins
A crisis drill always follows a scripted scenario, with a predetermined ending. This structure is necessary for training, but it has an intrinsic limit: a real crisis does not reveal its script in advance. It can change course, merge multiple incidents, and force decisions with incomplete information.
Replaying a known case leads to following a procedure, not to diverging from it when it no longer fits reality.
A boundary that separates training from real preparation
Two things, often confused, deserve to be distinguished. A crisis procedure establishes procedures, an order to follow in the actions to take, as well as the people to call upon; it can be learned, documented, and a well-designed exercise is enough to verify it.
A resilient organization, however, is measured by its ability to improvise when the procedure no longer suffices, for example by the option to take a system offline in production without waiting for cascading approvals. This capacity is built over time, not created in a single training session.
A stake that is played out before the crisis, in daily governance
This stake is decided long before the day of the exercise, within the organization’s ordinary governance. A leadership team that delegates all technical decisions in normal times will struggle to improvise during a crisis, regardless of the number of exercises conducted.
Conversely, an organization accustomed to shortening its validation loops approaches a real incident with reflexes that no kit alone can instill.
Markers that distinguish the best-prepared organizations
Organizations that weather a cyber crisis without collapsing are not necessarily those that have multiplied preventive drills. They are the ones that share subtler markers: a short decision-making chain known to everyone before the incident, and a habit of internal communication before all answers are in.
These markers do not appear in any single written scenario; they are verified in the gaps when the planned scenario no longer suffices.
The challenge, therefore, is not to choose between training and improvisation. Without regular exercise, an organization discovers its vulnerabilities on the day they cost the most. Without the ability to depart from the planned scenario, the exercise becomes a well-rehearsed performance.
The third sector kit from ANSSI deserves to be used, provided it is never mistaken for preparation itself: it is a tool, not a guarantee.
* Olivier Arous is the CEO of OGO Security
