Make Crisis Readiness Second Nature.
Run realistic crisis management exercises continuously and automatically, alongside normal work patterns. Measure every response, expose gaps, and build a permanent record that helps you meet the obligations of NIS2, CER and DORA.
Free to use. Subscribe to access AI tools. See an Example Exercise →
- Changing threats and risk intelligence: What is happening in the world?
- Relevant exercise scenarios: What could this mean for our organisation?
- Continuous team practice: Can our people coordinate and respond effectively?
- Evidence, learning and improvement: What needs to change before the next incident?
Average first response: 22 min (illustrative)
Testing Once a Year Leaves You Exposed
01
Plans Gather Dust Until They Are Needed
A crisis management plan written, signed off and shelved stays frozen at the day it was approved. By the time it is needed, it is likely that the assumptions are wrong, the people have changed, the risk profile is different and the available resources are no longer the same.
02
One Day of Evidence Proves Very Little
A single exercise shows how a team performed on one prepared afternoon. It does not show whether readiness is holding, improving or slipping across the year, and that is increasingly what regulators and boards ask for.
03
The People Who Matter Are Rarely All in the Room
Leadership diaries, regional sites, night shifts, suppliers and partners make a single exercise day hard to fill. The response is then tested without the people who would actually run it.
04
New Employees Are Weak Links Until They Practise
A new hire who has to wait for next year’s exercise to understand their role, everyone else’s, and how different incidents will be managed, is a potential weak link.
Transform Crisis Management Training into Continuous Organisational Capability
Real incidents unfold over time, across locations and without warning. Your exercises should work the same way.
Exercise
continuously
Experiment
freely
Challenge
relentlessly
Adapt
quickly
Test any scenario
Sabotage, drones, cyber, unrest or supply chain failure, built around your sites and your risks.
Any team, any location
Participation around normal working patterns, across all your locations and all relevant stakeholders.
Scheduled or no-notice
Scenarios delivered to specific teams at scheduled or random intervals.
Automated - set & forget
Set the programme and let it run. AI systems generate injects as prompted, with minimal oversight.
Every response on record
Every response, decision and gap, held in a record that cannot be deleted.
Runs alongside daily work
No day out of the business. Teams respond around normal duties.
Reduced overheads
No venue, travel or controller fees. Let your scenarios unfold over time at no extra cost.
One subscription
Exercises, evidence and intelligence tools under one JTOC plan.
What Continuous Exercising Proves
A plan describes what should happen. Exercising it continuously shows what does.
01
Your Plan’s Assumptions Hold
Plans assume resources exist, roles are understood, partners will coordinate and authority is clear. Every inject tests one of those assumptions against how your teams actually respond.
02
What Your Teams Can Sustain
See the tempo your organisation can actually maintain, and who really makes the call, measured over months rather than assumed in a document.
03
That Readiness Is Improving
Response times, decisions and gaps tracked over time show whether your programme works, with evidence regulators and boards can see.
A Year of Readiness, Tested at Random
Illustrative self-run programme: 34 injects across four groups.
Who Needs to Demonstrate Readiness?
For organisations that already run, or are required to run, crisis exercises and readiness testing.
Tabletop and Crisis Management Exercises
Replace a single afternoon with an exercise that unfolds over days, reducing venue and travel expenses.
Business Continuity and Incident Response Testing
Test your plans against developments that arrive over time, with every decision recorded for auditors.
Cyber and Hybrid Threat Exercises
Combine cyber, physical, disinformation and supply chain developments in one scenario.
Multi-Agency and Cross-Functional Simulations
Bring in legal, insurers, suppliers and partner organisations, wherever they are.
Ongoing Readiness Programmes
Deliver injects to specific teams at scheduled or random intervals, all year round.
Typical Buyers
Heads of security, resilience, business continuity and crisis management in:
- Critical infrastructure
- Energy
- Ports and logistics
- Financial services
- Manufacturing
- Defence supply chains
- The public sector
Built for NIS2, CER and DORA
European regulation expects relevant organisations to train crisis teams and test response plans. Osinto exercises can help support those activities, alongside ISO 22301 and BS 11200. Beyond regulatory requirements, continuous exercises help teams practise coordination, expose weaknesses and track improvement over time.
NIS2
Essential and important entities must have crisis management measures in place, and their management bodies must be trained.
CER
Critical entities must have crisis management procedures and train staff through courses and exercises. (Critical Entities Resilience Directive 2022/2557)
DORA
Financial entities must test their response and recovery plans at least once a year and train all staff, including the management body.
The Record Is Your Evidence
Every development, message and decision is held in the JTOC's permanent record, which cannot be deleted. It shows regulators and auditors who took part, what they knew and what they decided.
Private. Only the people you invite can see it or take part.
Fictional. Nothing real needs to be shared for the exercise to work.
Permanent. No delete function, so participants must not post sensitive or confidential material.
Bring In Any Expertise You Need
Real incidents draw on people across and beyond your organisation. Invite anyone into the Training Environment, wherever they are, for as much time as they can give. A specialist can weigh in on a single development without blocking out a day.
Your Own Teams
Security, operations, communications, legal, HR, IT and leadership, across every site and region.
External Specialists
Legal counsel, insurers, crisis communications advisers, and technical or intelligence experts.
Partners and Suppliers
The organisations your response depends on, training alongside you.
Every exercise is designed by Osinto's experienced Security & Resilience practitioners, with backgrounds spanning Oil & Gas, Critical Infrastructure, Government and NGOs, International News Media and Financial Services.
Three Ways to Exercise
Choose a one-off exercise, run your own programme, or work with Osinto on a continuous readiness programme. Each approach gives your teams opportunities to practise and creates evidence you can use to identify and address gaps.
Self-Run
Write your own injects and deliver them to specific teams at scheduled or random intervals.
- Target any team, site or region
- Every response captured
- Reports on response times, decisions and gaps
Continuous evidence, not a single snapshot.
Bespoke
A scenario built around your requirements and run by an Osinto controller over defined days, with developments designed to test decisions, coordination and response.
- 1 day to a week or more
- Timed developments and decision points
- Official exercise summary to keep
You request, we configure, your team trains, you keep the lessons.
Retained
Osinto helps design and deliver a programme of scenario injects over weeks or months, paced to your teams and risks, so readiness can be tested and improved over time.
- Designed by Security & Resilience practitioners
- Paced to your teams and risks
Closer to a Real Incident Than a Tabletop
Injects arrive in the Exercise Room. Breakout discussion runs in the threat channels. The Intelligence Database sits alongside, open to every participant.
It Unfolds Like the Real Thing
Developments arrive on a schedule. Reports are incomplete, some conflict, and some are wrong.
It Fits Around the Working Day
No venue, no travel, and nobody taken off the line for a day, so more of the people who matter can take part.
It Uses the Tools You Would Use
Channels, decision records and the Intelligence Database. It drafts; people check, challenge and decide.
It Draws on Your Own Information
Upload reports, plans and reference material, or connect your preferred external sources.
One Subscription Covers Your Exercise
Traditional exercises require preparation, coordination and time away from normal duties. Osinto's digital environment lets teams participate from different locations and supports exercises over longer periods. Self-Run Programmes are free to use, with subscription to AI tools available on any pricing tier. Retained Programmes are charged as a separate monthly consultancy fee, on top of the Pro subscription.
Intelligence Tools are provided via Credits drawn down against the subscription, at the rates on our Pricing page. Top up if you use them all.
See It in Action: Exercise ‘Hybrid Security Threats, Europe’
A fictional hybrid campaign against a European port region, played out over five working days from 2 November 2026, with three new developments each day.
Any subject, anywhere, combined into a single scenario:
Request a Training Exercise
Tell us what you have in mind. Osinto will be in touch to discuss your requirements.
Training Services are governed by Section 4.7 of our Terms.
Questions
Do participants need training on the JTOC?
No. If you have experience of using instant messaging/collaborative workspace systems and LLMs, you're already 99% familiar.
Does it work on mobile?
Not recommended.
Can we bring our own scenario?
Yes. And controllers can deviate during the exercise too, if they wish, with unplanned injections.
Can we invite external partners?
Yes - and you're encouraged to do so. The JTOC is a collective intelligence system enabling full cross-functional, multi-stakeholder engagement.