PIVOT

The PIVOT module (Path, Impact and Vulnerability-Oriented Threat analysis) is a cybersecurity risk analysis method that complements EBIOS RM. Instead of starting from the ANSSI workshops (risk sources, business values…), it starts from the actual technical facility — zones, equipment, network links — and the compromise state an attacker can reach, to automatically generate attack paths and a risk assessment.

This is an experimental module, available for cyber project types (IT, OT, cyber-physical).

The module was called "VBRA", then "Attack Path Risk Analysis", then "APRISM"

It was first renamed because Vulnerabilities Based Risk Assessment had become partly inaccurate: the catalogue's fulfilment rules rely on the compromise state, not on an observed vulnerability — so the engine is no longer purely vulnerabilities-based. APRISM reflected what the module actually produced: attack paths. The current name, PIVOT, follows the same logic — path, impact and compromise state — and is identical in French and English.

Method principle

1. You describe the facility: zones (IT, OT, office, cloud, physical, DMZ) and the equipment present in each.
2. You model the topology: links between zones (type, protocols, filtering, trust level).
3. You check the vulnerabilities found (reference library V1-V34) on each zone and each link.
4. You define the stakeholders (SH) — potential attackers — with their access zones.
5. The ABE engine automatically generates strategic scenarios (SH → target zone), then operational scenarios detailing the ENTER → FIND → EXPLOIT → OBJECTIVE attack chain.
6. Risks (S × L) are calculated and can be treated (reduction, transfer, acceptance, suppression).
7. Results can be exported to an open EBIOS RM study, to complement or replace the corresponding workshops.

Workflow steps

Step	Page	Detail
1	Facility	Zones and equipment
2	Topology	Links between zones
3	Vulnerabilities	V1-V34 vulnerabilities by zone and by link
4	Strategic scen.	Stakeholders and scenario generation
5	Operational scen.	Attack chains and exploration graph
6	Risks	S×L matrix and treatment plan
7	Attack graph	Attack path exploration
8	EBIOS Export	Injecting data into an EBIOS RM study

Three reference libraries complete the module — see APRISM reference libraries.

Module home page

The home page (/abe) brings together:

• The study identification: name, organization, date, version, description/objectives.
• A dashboard (clickable KPIs): number of zones, links, active vulnerabilities, strategic scenarios, operational scenarios, critical risks.
• The ABE workflow: clickable cards covering the 7 steps in order.
• Study management: JSON export, JSON import, full reset.

Demo mode

If demo mode is active, a panel lets you inject sample data (a complete scenario or workshop by workshop) to explore the method quickly.

Recommended order

Follow steps 1 to 7 in order: each step builds on the data from the previous one (zones feed the topology, topology and vulnerabilities feed strategic scenario generation, and so on).