1Erreurs transverses

Mistake	Why it is a problem
Confusing a feared event with a scenario	A feared event describes an impact, such as loss of customer-data confidentiality, not a course of action; the course of action is developed in Workshops 3 and 4.
Trying to be exhaustive	EBIOS RM favours effectiveness over exhaustiveness. An overlong document that covers every conceivable case is rarely read or used.
Improvising a scale when it is first needed	Severity and likelihood scales must be defined in advance with several stakeholders to avoid a view biased by one business function.
Confusing a method with a standard	EBIOS RM is a method, not a standard; it applies the ISO 27005:2022 model. See the detailed comparison.

2Atelier 1 — Cadrage & socle

Mistake	Why it is a problem
Vouloir cartographier tout le SI	Workshop 1 is not an exhaustive mapping exercise. Five to ten business values and a high-level description of supporting assets are generally sufficient.
Sauter la matrice RACI	Without roles and responsibilities formalised in Activity 1.1, business departments remain disengaged even though they must participate in the analysis.
Failing to rate feared events	Without an associated severity, scenarios cannot be prioritised later in Workshop 5; severity is carried throughout the chain.

3Workshop 2—Risk sources

Mistake	Why it is a problem
Retenir trop de couples SR/OV	An exhaustive but superficial list is less useful than a small number of well-qualified pairs that are subsequently developed into scenarios.
Leaving a targeted objective generic	Espionage is too vague. Contextualise it, for example theft of information X, so that it points to a specific business value and supporting assets identifiable in Workshop 4.

4Workshop 3—Strategic scenarios

Mistake	Why it is a problem
Skipping the ecosystem	Many successful attacks go through an immature service provider or supplier. Ignoring the ecosystem means ignoring the most likely vector.
Considering only direct paths	A strategic scenario may contain several alternative attack paths, some more likely through a stakeholder than through a direct attack.

5Workshop 4—Operational scenarios

Mistake	Why it is a problem
Over-detailing operational scenarios	MITRE ATT&CK-level detail helps substantiate likelihood during workshops but would overwhelm the final report. Keep an accessible summary for decision-makers.
Travailler sans architecte SI autour de la table	Without technical expertise, it is difficult to assess the actual feasibility of an attack path across the relevant supporting assets.

6Atelier 5 — Traitement

Mistake	Why it is a problem
Failing to approve risk acceptance	Accepting a risk must be a formal, documented decision by the designated owner, not a silent omission from the treatment plan.
Assuming residual risk is zero	Security measures generally reduce likelihood rather than severity, so some residual risk almost always remains.
Ne pas dater le suivi	Without periodic information-security steering meetings and defined cycle triggers, the analysis becomes a static snapshot that quickly becomes outdated.