Make Crisis Readiness Second Nature.
Strengthen preparedness across your organisation with directed or autonomous exercises that run continuously alongside normal working patterns. Plug in your data sources, build and access institutional knowledge, respond faster, challenge assumptions and close gaps as operating environments and risks change.
Free to use. Subscribe to access AI tools. See an Example Exercise →
Drone sighted over the northern distribution centre. Police attending. A journalist is asking for comment.
Loading bays closed and staff moved inside. Requesting CCTV from the gatehouse.
Holding statement drafted. @Legal for approval.
Approved. No comment on cause until police confirm.
Illustrative scenarios.
Practise Continuously
Injects arrive automatically, inside the working week. No venue, no travel and no day out of the business.
Why once a year leaves you exposed →Practise Together
Every team, specialist and partner in one environment, breaking down silos before a crisis exposes them.
Who takes part →Prove It
Every response on a permanent record, as evidence for boards, regulators and insurers under NIS2, CER and DORA.
What continuous exercising proves →Testing Once a Year Leaves You Exposed
The typical resilience lifecycle relies on periodic, often infrequent testing, which leaves companies exposed to changing circumstances, with no evidence of readiness between tests.Regulators are now moving towards evidence that services can stay within tolerance under realistic scenarios, which favours continuous exercising and a running record over an annual report.
All four grow with every month since the last exercise.
01
A crisis management plan written, signed off and shelved stays frozen at the day it was approved. By the time it is needed, it is likely that the assumptions are wrong, the people have changed, the risk profile is different and the available resources are no longer the same.
02
A single exercise shows how a team performed on one prepared afternoon. It does not show whether readiness is holding, improving or slipping across the year, and that is increasingly what regulators and boards ask for.
03
Leadership diaries, regional sites, night shifts, suppliers and partners make a single exercise day hard to fill. The response is then tested without the people who would actually run it.
04
A new hire who has to wait for next year’s exercise to understand their role, everyone else’s, and how different incidents will be managed, is a potential weak link.
Transform Crisis Management Training into Continuous Organisational Capability
Real incidents unfold over time, across locations and without warning. Your exercises should work the same way.
Exercise
continuously
Automated - set & forget
Set the programme and let it run. AI systems generate injects as prompted, with minimal oversight.
Runs alongside daily work
No day out of the business. Teams respond around normal duties.
Experiment
freely
Test any scenario
Sabotage, drones, cyber, unrest or supply chain failure, built around your sites and your risks.
Reduced overheads
No venue, travel or controller fees. Let your scenarios unfold over time at no extra cost.
Challenge
relentlessly
Scheduled or no-notice
Scenarios delivered to specific teams at scheduled or random intervals.
Any team, any location
Participation around normal working patterns, across all your locations and all relevant stakeholders.
Adapt
quickly
Every response on record
Every response, decision and gap, held in a record that cannot be deleted.
One subscription
Exercise in the workspace for free. One JTOC plan adds the intelligence tools.
What Continuous Exercising Proves
A plan describes what should happen. Exercising it continuously shows what does.
01
Your Plan’s Assumptions Hold
Plans assume resources exist, roles are understood, partners will coordinate and authority is clear. Every inject tests one of those assumptions against how your teams actually respond.
02
What Your Teams Can Sustain
See the tempo your organisation can actually maintain, and who really makes the call, measured over months rather than assumed in a document.
03
That Readiness Is Improving
Response times, decisions and gaps tracked over time show whether your programme works, with evidence regulators and boards can see.
A Year of Readiness, Tested at Random
Illustrative self-run programme: 34 injects across four groups.
Who Needs to Demonstrate Readiness?
For organisations that already run, or are required to run, crisis exercises and readiness testing.
Tabletop and Crisis Management Exercises
Augment a single afternoon with an exercise that unfolds over days, reducing venue and travel expenses.
Business Continuity and Incident Response Testing
Test your plans against developments that arrive over time, with every decision recorded for auditors.
Cyber and Hybrid Threat Exercises
Combine cyber, physical, disinformation and supply chain developments in one scenario.
Multi-Agency and Cross-Functional Simulations
Bring in legal, insurers, suppliers and partner organisations, wherever they are.
Ongoing Readiness Programmes
Deliver injects to specific teams at scheduled or random intervals, all year round.
Typical Buyers
Heads of security, resilience, business continuity and crisis management in:
- Critical infrastructure
- Energy
- Ports and logistics
- Financial services
- Manufacturing
- Defence supply chains
- The public sector
Built for NIS2, CER and DORA
European regulation expects relevant organisations to train crisis teams and test response plans. Osinto exercises can help support those activities, alongside ISO 22301 and BS 11200. Beyond regulatory requirements, continuous exercises help teams practise coordination, expose weaknesses and track improvement over time.
NIS2
Essential and important entities must have crisis management measures in place, and their management bodies must be trained.
CER
Critical entities must have crisis management procedures and train staff through courses and exercises. (Critical Entities Resilience Directive 2022/2557)
DORA
Financial entities must test their response and recovery plans at least once a year and train all staff, including the management body.
The Record Is Your Evidence
Every development, message and decision is held in the JTOC's permanent record, which cannot be deleted. It shows regulators and auditors who took part, what they knew and what they decided.
Private. Only the people you invite can see it or take part.
Fictional. Nothing real needs to be shared for the exercise to work.
Permanent. No delete function, so participants must not post sensitive or confidential material.
Break Down Silos Before a Crisis Exposes Them
In a real incident, security, operations, communications, legal and leadership have to act as one team, often for the first time. Exercising together in one shared environment builds those working relationships before they are tested. Invite anyone into the Training Environment, wherever they are, for as much time as they can give. A specialist can weigh in on a single development without blocking out a day.
Your Own Teams
Security, operations, communications, legal, HR, IT and leadership, across every site and region.
External Specialists
Legal counsel, insurers, crisis communications advisers, and technical or intelligence experts.
Partners and Suppliers
The organisations your response depends on, training alongside you.
Every exercise is designed by Osinto's experienced Security & Resilience practitioners, with backgrounds spanning Oil & Gas, Critical Infrastructure, Government and NGOs, International News Media and Financial Services.
Three Ways to Exercise
Choose a one-off exercise, run your own programme, or work with Osinto on a continuous readiness programme. Each approach gives your teams opportunities to practise and creates evidence you can use to identify and address gaps.
Self-Run
Write your own injects and deliver them to specific teams at scheduled or random intervals.
- Target any team, site or region
- Every response captured
- Reports on response times, decisions and gaps
Continuous evidence, not a single snapshot.
Bespoke
A scenario built around your requirements and run by an Osinto controller over defined days, with developments designed to test decisions, coordination and response.
- 1 day to a week or more
- Timed developments and decision points
- Official exercise summary to keep
You request, we configure, your team trains, you keep the lessons.
Retained
Osinto helps design and deliver a programme of scenario injects over weeks or months, paced to your teams and risks, so readiness can be tested and improved over time.
- Designed by Security & Resilience practitioners
- Paced to your teams and risks
Closer to a Real Incident Than a Tabletop
Injects arrive in the Exercise Room. Breakout discussion runs in the threat channels. The Intelligence Database sits alongside, open to every participant.
It Unfolds Like the Real Thing
Developments arrive on a schedule. Reports are incomplete, some conflict, and some are wrong.
It Fits Around the Working Day
No venue, no travel, and nobody taken off the line for a day, so more of the people who matter can take part.
It Uses the Tools You Would Use
Channels, decision records and the Intelligence Database. It drafts; people check, challenge and decide.
It Draws on Your Own Information
Upload reports, plans and reference material, or connect your preferred external sources. AI tools turn the threat reports you already receive into a synopsis and scenario injects for your teams to practise.
One Subscription Covers Your Exercise
Traditional exercises require preparation, coordination and time away from normal duties. Osinto's digital environment lets teams participate from different locations and supports exercises over longer periods. Self-Run Programmes are free to use, with subscription to AI tools available on any pricing tier. Retained Programmes are charged as a separate monthly consultancy fee, on top of the Pro subscription.
Intelligence Tools are provided via Credits drawn down against the subscription, at the rates on our Pricing page. Top up if you use them all.
See It in Action: Exercise ‘Hybrid Security Threats, Europe’
A fictional hybrid campaign against a European port region, played out over five working days from 2 November 2026, with three new developments each day.
Any subject, anywhere, combined into a single scenario:
Request a Training Exercise
Tell us what you have in mind. Osinto will be in touch to discuss your requirements.
Training Services are governed by Section 4.7 of our Terms.
Questions
Do participants need training on the JTOC?
No. If you have experience of using instant messaging/collaborative workspace systems and LLMs, you're already 99% familiar.
Does it work on mobile?
Not recommended.
Can we bring our own scenario?
Yes. And controllers can deviate during the exercise too, if they wish, with unplanned injections.
Can we invite external partners?
Yes - and you're encouraged to do so. The JTOC is a collective intelligence system enabling full cross-functional, multi-stakeholder engagement.