Simulate · Prepare · Respond · Measure
Find the gaps in your crisis response. Then show they're closed.
CrisisLoop runs facilitator-led crisis exercises with your own people in the seats, turns what they expose into owned actions against a live model of how you operate, and lets you prove the gap was closed the next time you run it.
Hosted in Canada or Europe · Your data never enters a shared pool
The platform
See what your business actually stands on.
Every service, the processes that deliver it, and the suppliers and systems underneath. Concentration stops being a hunch and becomes something you can point at.
The product, not a diagram of it. Client authentication carries four of these services — which is how a team finds out that losing an identity provider costs more than losing the trading platform. Shown on a demonstration tenant, because publishing a customer's estate is not ours to do.
What you depend on
Written down once, then kept current by what the exercises find.
- Service model and dependency map
- Suppliers, what they touch, and signals
- Impact tolerances and recovery targets
- Risks and controls with evidence attached
The hour itself
Run by a person, with your people answering under real pressure.
- 45 scenarios, or author your own
- Injects as message, email, broadcast or a call
- Fog of war — each seat sees only its own
- Decisions scored as they happen
The same room, for real
Nobody learns a new tool at three in the morning.
- Declare from the platform or from Slack
- Playbooks executed and ticked off
- Status pages for customers
- Post-incident review from the record
What a board will accept
Readiness backed by dated evidence, not a self-assessment.
- Measured recovery against stated tolerance
- Risk position before and after
- Findings tracked to an owner and a date
- Exports for audit and assurance
What you can prove
Know what you've discussed, what you've demonstrated, and what still needs testing.
Most readiness reporting collapses into a single number, and a number cannot tell a board the difference between a recovery your team talked through and one they actually performed. CrisisLoop never collapses it. Every claim carries how it was obtained.
It happened for real, in an incident, and the recovery worked. The strongest thing you can hold.
An exercise actually performed the recovery and it was validated. Not discussed — done.
Walked through or estimated. Useful, and honestly weaker than doing it.
A figure exists but its provenance is too thin to call it demonstrated.
Nothing currently proves it. Stated plainly, because a blank is not a pass.
This is the distinction a regulator, an auditor and a board all actually ask for — and the one thing a tool running thousands of unattended simulations cannot give you. It has no humans in the seats, so nothing it produces is ever more than assessed.
How it works
One hour, and everything that follows from it.
A run, minute by minute. The clock deliberately does not stop when the exercise does — because the exercise is the door, not the house.
Six people join, in the roles they already hold
Overnight, the platform that takes customer orders stopped responding. The supplier has acknowledged nothing. The facilitator has a calm desk and can see everything. Nobody else can.
Knows only that orders are not flowing.
Not told: the cause, how far it reaches, or that anyone else has been contacted. Hover to lift the redactionThe phone rings, and it is a journalist
A reporter asks the finance director whether customer data is involved. It is a real voice call, recorded and scored like everything else in the hour.
Takes the call alone, with eleven minutes of information.
Not told: whether data is in scope. Nobody has established that yet, and the answer given here is on the record.The clock nobody started
Legal asks whether the notification window has begun. The desk has been holding that timer since minute four. When the room catches up, the gap has a name, a timestamp and an owner.
The decision that costs money
Fail over to the manual process, or keep waiting on the supplier. Whoever decides, the decision is recorded with their name on it — so the debrief can say who was carrying it, not merely that it went badly.
A debrief built from what people did
Not a questionnaire afterwards. Detection was quick and the recovery clock held. The handover between two teams did not, and the report names which one and by how long. Where a measurement was never taken, it says that too.
The findings stop being findings
Three become risks in the register, each with an owner and a date. One turns out not to be a risk at all but a dependency nobody had written down.
Run it again. The handover holds.
Same room, same people, a scenario shaped by what the register now says. The gap that was embarrassing in week one is dated, attributable evidence in week six. That is the loop closing, and it is the only part a board really wants.
12 November · not an exercise
Nobody had to learn an interface at three in the morning.
A monitoring alert declares a real incident into the same room. The roles are the ones people already hold. The playbook is ticked off where it will actually be used. The status page tells customers something true before anyone fields the same call twenty times.
And when it closes, the review writes itself into the same register the exercise fed. A team that has rehearsed here has the muscle memory to respond here.
AI helps scope the scenario. A person runs the room. Your people answer. We do not run thousands of automated variations with nobody in the seats. A plan is only proven when the humans who execute it have been under the pressure.
Who is in the room
A crisis does not check your job title first.
Not a security tool with a continuity label on it, and not a boardroom toy. The people who matter in the first hour are rarely the most senior in the building.
Built for financial services, critical infrastructure, manufacturing and supply chain, technology, healthcare and the public sector — and the exercises work the same way in all of them, because the hard part is never the technology.
Your data
Canada or Europe. On a private network. Never in a shared pool.
Usually your risk team's first question, so here is the whole answer before anyone has to ask it.
Scenario scoping and optional integrations use named sub-processors, some outside your region. We hand you that list in full, with what each one receives, rather than leaving you to find it during a security review.
Questions people ask before they book.
Answered plainly, including where the answer is no.
What is a facilitator-led crisis exercise, and how is it different from an automated one?
A facilitator-led exercise puts your own people in the seats they already hold and asks them to decide under pressure, while a facilitator runs the room from a calm desk. Events arrive as injects — a message, an email, a broadcast or a phone call — and what the room decides changes what happens next. Automated testing generates thousands of variations with nobody answering, which tells you about your systems. This tells you about your organisation: who decided, how fast, on what information, and what they could not find.
Does CrisisLoop support ISO 22301 and BCI Good Practice?
It is built around them. The service model records services, the processes that deliver them and the suppliers and systems underneath, so impact tolerance and recovery objectives sit against something real rather than a spreadsheet. Exercises produce the exercise record, findings and retests that ISO 22301 and the BCI Good Practice Guidelines expect of a continuity programme. It does not certify you and no tool can — your auditor does that. What it gives you is the evidence they ask for.
Can we use it for DORA or NIS2 operational resilience testing?
Yes, for the exercise and evidence part. Both regimes expect you to test your response, keep a record of it, and show that what you found was acted on. CrisisLoop produces a dated exercise record, findings with an owner, a due date and a verification method, and a retest in the next run that confirms closure rather than assuming it. It is not a compliance product and will not tell you that you are compliant.
What does the AI actually do?
It advises and it comes alongside the facilitator. It recommends what is worth exercising based on your risk register and what your services depend on, and you choose. During a session it supports the facilitator's conversation. It does not pick the scenario, it does not run the exercise, and it never plays the participants — the people in the room are the people being tested. Any finding it proposes is a proposal until a person confirms it.
What do we get out of an exercise?
An after-action review and a board report, built only from what the run actually evidenced. Every claim carries how it was obtained — observed in a real incident, demonstrated in an exercise, or merely discussed — and those are never collapsed into one number, because a number cannot tell a board the difference between a recovery a team talked through and one they performed. Findings become actions with an owner, a due date and a verification method, and the next exercise retests them.
Who should be in the room?
The people who would actually be in it. A crisis does not check your job title first, so a run typically seats six: an incident commander, operations or engineering, communications, legal or compliance, an executive, and HR or support as the scenario needs. This is not a cyber-team exercise. Most of what goes wrong in a real crisis goes wrong between functions, which is why the exercise is built to put them in the same hour.
How long does an exercise take, and how often should we run one?
The exercise itself is about an hour. Setup is a short conversation about your services and what you want tested, and the debrief follows the same day. Our readiness model looks for at least four exercises a year across a variety of disruption types, because a single annual test of one scenario tells you very little about the rest of the year.
Where is our data held?
In Canada or Europe. Your region is chosen at onboarding and named in the contract. The database is managed PostgreSQL on a private network with certificate verification, not exposed to the public internet. Backups are encrypted before they leave the machine and are restore-tested rather than merely configured. Your tenant is yours alone — never a shared pool.
Can CrisisLoop run a real incident for us?
No, and we would rather say so here than after you have asked. CrisisLoop rehearses crises and improves how your organisation responds to them; declaring and running a live incident, paging, war rooms and incident tickets are not part of it. Incident updates, inbound calls and escalations do happen — inside an exercise, as part of the scenario your team is rehearsing. If you need a live incident tool you already have one, and what it cannot tell you is whether your people can actually use it under pressure. That is the part we do.
Find the gaps before something else does.
Thirty minutes. We run a live exercise, show you the facilitator's desk and the debrief a board actually reads. If it is not a fit, we will say so.
Thank you. A person will reply within one working day.
That did not send. Please try again, or email hello@crisisloop.io directly.
One reply, from one of the people who build this. No marketing list. See our privacy policy.