Your plan says you’re ready.
Prove it before reality does.
We design and run crisis, continuity, and disaster recovery exercises with the realism of an actual incident. Built by practitioners who have led real crises inside Fortune 100 companies.
- Delivered through your real channels, up your real escalation chain,
all the way to the executives who own the hardest calls. - All-hazards: crisis management, business continuity,
IT disaster recovery, cyber, and AI-era threats - From a $1,799.99 self-run kit to enterprise simulations with 70+ participants
Every exercise ends as a prioritized roadmap, not a binder
What we hear from the people who call us
“We have plans. We’ve never really tested them.”
“Our last exercise was a slide deck. Half the room was on email by minute twenty.”
“We exercised our team. But escalation is where it would actually break, and we’ve never tested that.”
“The board asked when the executive team last practiced a crisis. I didn’t have a good answer.”
“The auditors want an exercise every year. I need it to be worth more than the checkbox.”
Sound familiar?
Plans don’t fail in a binder. They fail at the seams between teams, in decisions nobody rehearsed, at 2 a.m. through channels nobody tested.
Organizations don’t rise to the level of their plans. They fall to the level of their training.
How We Build Exercises
- We test the full escalation chain. One connected scenario follows the incident from technical detection to the cyber crisis team, the corporate crisis team, business continuity at affected sites, and the executive leadership team. The seams between teams are the objective. Most exercises test a single layer and never determine whether escalation holds.
- We build fidelity that feels like the real thing. Threat actors modeled on real groups using real tradecraft. Real figures, real timelines, real pressure. A recent participant called our simulation “the closest thing to a real-life incident I have experienced.”
- Injects arrive through your real channels. Email, SMS, Teams, voicemail, and phone calls, timed to create the operational friction of a real incident. Not slides. Not paper.
- We facilitate live and adapt to what your team actually does. The scenario branches off from your decisions. Nobody can script their way out, and a pre-recorded platform can’t read the room.
- Your team does the work and makes the hard calls. Draft the press release. Stand up the support team. Decide whether to pay, when to notify regulators, and what to tell the board, in real time, with your own outside counsel in the room.
- Every exercise ends as a roadmap. Hot wash, anonymous participant survey, and an after-action report with prioritized, observation-linked recommendations. The exercise is one step in a maturity arc, not an annual event.
Find Your Exercise
Facilitated Tabletop Exercise
Choose Your Exercise Path
Scenario Library
These are representative examples of scenarios we have designed and run for clients. We have delivered many more, and every engagement can start from a custom scenario built around your organization, your industry, and the threats that actually keep your team up at night.
Cyber
- Ransomware and double extortion
- AI-accelerated vulnerability stormNew
- Cloud provider outage
- Third-party software compromise
Privacy & Data
- Data breach and disclosure
- Privacy incident and regulatory notification
- Third-party data breach
Physical
- Active shooter
- Workplace violence
- Mass casualty incident
- Corporate aviation disaster
Natural
- Hurricane, typhoon, and severe weather
- Tornado
- Winter storm
- Wildfire
- Regional power loss
Reputational
- Viral misinformation
- Deepfake of a senior leader
- Executive misconduct
- Franchisee misconduct
Operational & Product
- Product recall and contamination
- Food safety incident
- Manufacturing disruption
Supply Chain & Third Party
- Critical vendor failure
- Business process outsourcing failure
- Logistics disruption
- Sole-source supplier loss
Financial & Regulatory
- Regulatory investigation
- Major litigation
- Payment systems failure
Featured scenario
AI-Accelerated Vulnerability Storm
An open-weights AI model starts finding and chaining software vulnerabilities faster than anyone can patch. CISA, RAND, and the Cloud Security Alliance say this is the exercise organizations need next. We have already built it and run it.
How We Engage
Four steps. Each one delivers value before the next one begins.
- We start with your plans, your risks, and interviews with the people who would live the scenario. If you need a full program read, a Resiliency Diagnosis® gives you one in weeks, not months.
- A custom scenario engineered from real events, your own past incidents, and your own data. Iterated with your SMEs until it’s credible enough to sting.
- We facilitate. Your team decides, acts, escalates, and communicates. We capture every observation while they do.
- Hot wash, survey, after-action report, executive debrief, and a prioritized path to the next exercise. Readiness compounds.
“
This complex cybersecurity simulation was the closest thing to a real-life incident I have experienced.
Participant · Multi-Day Enterprise Cybersecurity Simulation
70+
participants in a single enterprise simulation
40+
injects delivered through real channels in one exercise
$18M → $8M
ransom negotiated in-exercise through a real negotiation firm
40+
after-action recommendations adopted by a single client
Exercises aligned to
ISO 22301 · ISO 22361 · NIST · FFIEC · HITRUST
Why Bryghtpath
You don’t need a vendor to read a deck at your team.
You need practitioners who have run real crises and will build the exercise your organization actually needs.
- Senior practitioners with Fortune 100 crisis and resilience leadership experience facilitate every engagement
- Every exercise is custom-built from SME interviews. Nothing off a shelf
- Simulation software gives you injects. We give you judgment, and an after-action report that drives program change
- Proprietary foundations: Resiliency Diagnosis®, Crisis Playbook®, Exercise in a Box®, Exercise in a Day®
- The field’s senior certifications (MBCP, MBCI, CBCP, CISSP) and authorship of the ASIS active assailant standard
Frequently Asked Questions
What does an exercise cost?
Exercise in a Box® is $1,799.99. Exercise in a Day® is $7,500. Facilitated tabletop exercises start at $25,000. Crisis simulations and executive exercises are scoped to your organization after a consultation.
Should we start with a tabletop or a simulation?
Tabletops validate plans and align leaders in a discussion-based setting. Simulations prove the whole response works under realistic pressure, with injects arriving through your real channels. If your team has never exercised, start with a tabletop and build toward a simulation.
How much lead time do we need?
Exercise in a Day® delivers in one business day. Facilitated tabletops typically need 4 to 6 weeks of design and coordination. Full-scale simulations run 8 to 12 weeks of design, including SME interviews and scenario iteration.
Can exercises be run remotely?
Yes. We deliver virtual, in-person, and hybrid exercises. Some of our largest enterprise simulations have been fully remote, with injects delivered through email, SMS, Teams, and phone.
Do exercises satisfy our audit and regulatory requirements?
Yes. We align exercises to ISO 22301, ISO 22361, NIST, FFIEC, HITRUST, and your regulator’s expectations, and the after-action report is built to stand up in an audit.
What’s in the after-action report?
Observations tied to what actually happened in the room, the gaps those observations reveal, and prioritized recommendations. Clients treat it as a working roadmap, not a filing-cabinet document.
How often should we exercise?
A continuous exercise calendar beats an annual event: microsimulations and tabletops through the year, with a major simulation on a one- to two-year cycle. We help you build the cadence that fits your program’s maturity.
Can you exercise our executives and board?
Yes. The hardest decisions in a crisis belong to the top of the house, and it is the layer most programs never test. Our executive and board exercises put those decisions on the table before they are real.
Ready to find out how your team really performs?
Fifteen minutes with a practitioner.
A straight answer about which exercise fits, what it costs, and what you’ll get.