EBIOS RM Workshop 4 — Operational scenarios

1Cadre de l'atelier

Objective	Build operational scenarios that model the technical courses of action used by risk sources.
Inputs	Missions, business values, supporting assets and security baseline (Workshop 1); selected risk sources and TOs (Workshop 2); selected strategic scenarios (Workshop 3).
Participants	CISO, IT management, information-system architects, and cybersecurity specialist.
Sorties	Operational scenarios and their likelihood assessment.

A operational scenario is the technical development of an attack path identified in Workshop 3: a sequence of elementary actions targeting supporting assets of the subject under study or its ecosystem.

2The four-step attack sequence

EBIOS RM structures operational scenarios as a cyber kill chain with four steps, inspired by frameworks such as MITRE ATT&CK:

Know (reconnaissance) → Enter (initial intrusion) → Find (lateral movement and privilege escalation) → Exploit (achieve the targeted objective).

The reasons that may lead a target to betray their organisation through recruitment or corruption are often summarised by the four MICE : Money, Ideology, Compromission, Ego.

3Biens supports critiques

A critical supporting asset is an asset considered highly likely to be targeted by a risk source and therefore a probable entry vector. Combining the Workshop 1 supporting-asset list with security-baseline gaps—potentially exploitable vulnerabilities—produces realistic rather than purely theoretical scenarios.

4Assess likelihood

Each elementary action in the chain receives an individual likelihood, from which the operational scenario's overall likelihood is derived. Combined with severity inherited from Workshop 1 through the strategic scenario, it positions the risk in the Workshop 5 matrix.

Common mistake: over-detailing operational scenarios. MITRE ATT&CK-level detail helps substantiate likelihood during workshops but undermines the final report's readability; keep a summary that decision-makers can understand.