IHEDN Mondays are now available in audio format!
Click below to listen:
Digital technology represents a major upheaval for intelligence. The acceleration of information flows, the dematerialisation of interactions, the massive exploitation of data and the growing use of digital technologies by adversaries are profoundly changing the conditions under which forces, personnel, information and national strategic capabilities are protected.
In addition to traditional espionage and interference, hybrid threats are now emerging, combining cyber attacks, information manipulation, digital intrusions and the misuse of civilian technologies such as drones. The boundaries between the military, economic, technological and information fields are becoming more porous, making it harder to identify, attribute and neutralise risks.
One of the heirs to the «Second Bureau» of the French Army General Staff, created in 1871, the Defence Intelligence and Security Directorate (DRSD) is responsible for protecting France against threats to the armed forces and defence industry. Alongside the Directorate General for External Security (DGSE) and the Directorate of Military Intelligence (DRM), it is one of the three services in France's first intelligence circle to report to the Ministry of the Armed Forces.
Its director since 1er August 2025, Lieutenant General Aymeric Bonnemaison has spent his career in the French armed forces in the fields of intelligence and cyber defence. As the first head of the DRSD to come from the cyber defence command, he is the embodiment of the service's adaptation to new areas of conflict.
DOES DIGITAL TECHNOLOGY REPRESENT A PARADIGM SHIFT FOR COUNTER-INTELLIGENCE MILITARY INTELLIGENCE, WHICH HAS OVER 150 YEARS OF HISTORY BEHIND IT?
Digital technology represents a real paradigm shift for intelligence, including counter-intelligence, with major consequences for our modes of action, our capabilities and the very nature of the threats we face.
Each technological advance brings opportunities that enhance our operational effectiveness, but also generates new vulnerabilities that can be exploited by our adversaries to carry out acts of interference. The evolution of our missions is therefore part of a global transformation, structured around several fundamental axes.
Cyberspace has established itself as a field of operations in its own right, in which computer attacks and disinformation actions are now instruments of intelligence and sub-threshold warfare. This development has profoundly transformed military counter-espionage, which today relies on a hybrid approach combining traditional methods, based on the field and human sources, with the exploitation of advanced digital technologies.
In addition, the distance between attackers and their targets in cyberspace gives them greater freedom of action and makes the identification and attribution of attacks more complex. Finally, the increasing accessibility of digital tools broadens the number of actors capable of taking action, even without advanced expertise, which contributes to the multiplication of threats and complicates their characterisation.
The digitisation of data makes it possible to collect, structure and exploit very large volumes of information from a variety of sources and using a wide range of communication media, including satellite networks, mobile networks, social networks, connected objects and environments. Cloud. The support of automated processing, based in particular on artificial intelligence and the machine learning, enables this data to be analysed at unprecedented speed and scale.
However, this new capacity comes with increased risks. The concentration of large amounts of data makes it a prime target for attacks, attempts to capture it or actions to disclose it. Digital technology has profoundly renewed the methods of counter-intelligence, offering more effective tools while requiring constant adaptation to opposing modes of action that exploit these same technologies. This is leading us collectively into a race to innovate, into «creative evolution»!
HOW IS DRSD ADAPTING ITS OPERATIONS TO THIS CHANGE?
Historically, the DRSD was mainly involved in physical counter-intelligence, particularly on behalf of the Defence Technological and Industrial Base (DTIB), through intrusion prevention and regulatory compliance monitoring.
The evolution of the cyber threat has led the DRSD to broaden its field of action to include cyber counter-intelligence on behalf of these players. The DRSD has thus developed its capabilities in cyber security and network reputation monitoring, enabling it to provide a continuum of protection between the physical and digital domains. One of its strengths lies in its ability to correlate weak signals from different fields in order to shed light on a situation as a whole.
This adaptation has resulted in the creation of the CERT [ED], Inaugurated in 2023, it is designed to help protect companies in the DTIB, particularly the most vulnerable among them: SMEs and VSEs in the supplychain. The CERT [ED] offers awareness-raising initiatives, vulnerability monitoring and support in managing cyber incidents. It relies on the DRSD's territorial network, which guarantees proximity and in-depth knowledge of companies, as well as increased responsiveness in cyber support.
The DRSD's cyber capabilities are spread throughout France. Around 10% of our staff, i.e. 160 civilians and military personnel, are currently working in the cyber domain. The profiles sought are varied, ranging from young cyber defence engineers to cyber intelligence analysts and digital investigation experts.
YOU ARE THE FIRST HEAD OF THE DRSD TO HAVE PREVIOUSLY COMMANDED CYBER DEFENCE. IS THIS A SIGN OF A CHANGE IN THE CYBER THREAT, AND THEREFORE IN YOUR DEPARTMENT'S PRIORITIES?
My cyber background is no doubt not entirely unrelated to the decision to entrust me with the management of the DRSD. The cyber threat is now ubiquitous and forms the backbone of the hybrid strategies implemented by our competitors. I had already been able to observe the evolution of this threat when I was in charge of the armed forces' cyber defence. Today I see it every day at the head of the DRSD.
The DITB is a prime target for cyber-attackers, which justifies increased attention and efforts. So there is a coherence between my experience in the cyber field and the Service's ongoing adaptation to deal with this growing threat.
However, as the threat is multifactorial, it would seem simplistic to limit this choice to this dimension alone. My entire career in operational and technical intelligence in the armed forces, at NATO, in the capabilities field and finally at the DGSE has certainly contributed to this trajectory. I imagine that it was the complementary nature of these experiences that led me to take command of the DRSD's counter-intelligence unit.
IN RECENT MONTHS THERE HAS BEEN AN INCREASE IN THE NUMBER OF DRONES FLYING OVER SENSITIVE FRENCH INFRASTRUCTURES. HOW DO YOU DEAL WITH THIS?
The DRSD has observed an upsurge in drone incursions over sensitive sites in France, with a significant increase in reports since early autumn. The number of overflights involving sites of defence interest rose sharply between 2024 and 2025, involving a wide variety of aircraft, from consumer drones to more sophisticated systems.
Unlike theatres of conflict, where detection and neutralisation systems are deployed on a permanent and intensive basis, France operates within a «peacetime» legal framework in the face of an emerging threat that is diffuse and spread throughout the country. Even when units are equipped with anti-drone resources, the effective impediments remain limited, as neutralisation requires a combination of several complex technologies.
The fight against drones is based on three complementary pillars: detection, identification and neutralisation. Detection can be based on radar or acoustic sensors; identification requires optical or electromagnetic means, day or night; neutralisation, finally, can use solutions such as jamming, nets or lasers, in compliance with the legal framework in force. Effectiveness depends on the integration of these capabilities in the face of ever more innovative drones.
The investigations conducted by the DRSD are continuing in order to characterise these overflights, whether they are malicious acts or, in some cases, the unintentional behaviour of insufficiently informed operators.
IN ADDITION TO THE ARMED FORCES, THEIR FAMILIES AND MILITARY BASES, THE DRSD PROTECTS PRIVATE ENTITIES IN THE DEFENCE INDUSTRY. ARE THEY AWARE OF CURRENT AND FUTURE THREATS? HOW DO YOU RAISE THEIR AWARENESS?
As part of its mission to protect the defence sphere, the DRSD provides support to all players in the DTIB, whatever their size, from major industrial prime contractors to SMEs, start-ups and research laboratories. This support is based in particular on personalised awareness-raising initiatives.
These actions are carried out throughout France, either at the request of the entities concerned, or on the Service's initiative when justified by the sensitivity of their activities, particularly with regard to armament programmes or following regulatory audits relating to the protection of secrecy. Each awareness-raising exercise includes an up-to-date assessment of the threat, whether human, physical, cyber, legal, capital-intensive or reputational.
Awareness-raising sessions are tailor-made to suit the sector of activity, the profile of the participants and the environment in which the entity operates. They can also be offered prior to specific events, such as trade fairs, visits by foreign delegations or international trips. These actions are systematically based on concrete cases and lead to operational recommendations.
Every year, the DRSD raises awareness among more than 20,000 people. These actions are complemented by thematic publications, such as the Economic Information Letter (LIE), which is distributed several times a year, and by the many interactions made possible by the Department's proximity to the ecosystem it is responsible for protecting.
