Vincent Strubel (Anssi) "Anssi Now Takes a Stronger Stance of Authority Over the Administration"

Vincent Strubel, director general of Anssi, explains how the agency is evolving to better protect the state from data leaks.

JDN. After the DGFiP data leak in August 2026, ANSSI, France's national cybersecurity agency, faced sharp criticism from professionals and politicians. In particular, it was accused of failing to detect the threat in time. Is ANSSI facing a legitimacy crisis?

Vincent Strubel. No, quite the opposite. ANSSI has never been as widely listened to as it is today! What we're seeing is more of an awakening to vulnerabilities that aren't new—ones we've been warning about for a long time. However, these vulnerabilities are now being exploited in new ways. The real change isn't that systems suddenly became vulnerable overnight. It's that they're being attacked differently, with different goals, including by individuals from outside organized crime—young French people motivated purely by reputation. I hope we can break this cycle. It's truly disheartening to see young French teenagers start their lives with a stint in prison just to make a name for themselves in cybersecurity, when there are so many other ways to stand out in the field. Our top priority right now is to address these basic vulnerabilities.

After the DGFiP leak, Prime Minister Sébastien Lecornu asked you to launch the Interministerial Response and Action Operation for Data Breaches (REACTIV). This allows ANSSI to impose immediate measures on ministries in the event of data leaks. Is ANSSI becoming the State's CISO?

Let's say instead that we now have a stronger position of authority over the administration. This new power to issue directives doesn't have a specific legal basis. It's not hard law. It comes directly from the Prime Minister, who asked ministers to comply with ANSSI's decisions on cybersecurity. This isn't a permanent arrangement. It's an emergency measure to limit the damage from data leaks while the State's 2026-2027 digital security roadmap is being implemented. That roadmap is the long-term fix that will address these vulnerabilities on a large scale. What we need is to enshrine REACTIV's measures in law and extend them beyond government agencies to local authorities and businesses, thanks to NIS 2.

But is there mistrust among ministries toward ANSSI, if the Prime Minister has to force them to comply with your requests?

No, not at all. But government agencies have to deal with a whole host of conflicting demands. They're expected to simplify processes, move faster, make life easier for users, drive digital transformation, and ensure the cybersecurity of their information systems, among other things. REACTIV simply makes cybersecurity a priority among all these competing directives. Some projects, like digital transformation, will inevitably slow down as a result.

How will NIS 2 expand ANSSI's power to issue directives?

The legislative transposition of NIS 2 is set to give ANSSI authority over State agencies and beyond. We'll be able to seek sanctions against entities that don't comply with the directive. These sanctions could include fines for companies and orders requiring government agencies to publicly disclose their cybersecurity failures.

Since its creation, ANSSI has provided cybersecurity advice, especially to government agencies. With this new power to issue directives, it can also prescribe measures. Doesn't that make it both judge and jury? Isn't that a problem?

No. Advising and issuing directives are really part of the same continuum. Whether we're advising or directing, we'll be saying the same things—just more forcefully. We'll warn first, then impose sanctions if our warnings aren't heeded. To prepare for NIS 2, we've been building a compliance function within ANSSI for some time now, with clear procedures for how it interacts with our other roles. We're careful to ensure a separation of duties within the same organization so there's no confusion about our functions.

REACTIV also gives ANSSI responsibility for crisis communications in the event of a cyberattack, for all government agencies. How do you plan to fulfill this obligation?

The real issue isn't so much crisis communication as it is ensuring transparency. Our incident report on the DGFiP data leak, published in September 2026, is a good example of this approach. We're not planning to speak on behalf of ministers about the consequences of a cyberattack affecting their agencies.

So was there a lack of transparency until now?

No... Well, we weren't as proactive as we are now. We used to communicate in response to attacks. But the Prime Minister has now asked us to ensure transparency whenever the State is hit by an attack. So we're adjusting our approach to meet this new requirement. However, this doesn't apply to businesses.

REACTIV, NIS 2... Does ANSSI really have the resources to meet all these new obligations?

ANSSI's resources are indeed limited. We have three times fewer staff than our German counterpart, even though we have the same missions. Like every government agency today, we're constantly juggling priorities. With REACTIV, we do have to devote less effort to other areas of cyber threats. Given the current budget situation, our resources can't be stretched indefinitely. However, we've optimized our model to rely heavily on the private sector and other government services. The new regulations will also let us multiply our impact thanks to our new enforcement powers, all with the same headcount.

This article was automatically translated from French. Read the original version: https://www.journaldunet.com/cybersecurite/1556867-l-anssi-n-a-jamais-ete-aussi-ecoutee-qu-aujourd-hui/