Business continuity exercise software helps you plan, run and evidence the tests of your continuity, recovery and crisis plans: tabletop exercises, simulations, technical disaster recovery tests and full-scale drills. Three families of products answer the need. Continuity suites with an exercise module schedule the test, record the result and link it to the business impact analysis (BIA) and plans. Dedicated scenario testing and crisis simulation platforms run the live exercise, with injects, simulated media and AI actors. Technical tools automate IT recovery runbooks or simulate cyber attacks.
This comparison reviews 12 products and four adjacent tools. Every statement comes from the vendor's own page or a public source listed at the end, checked on 1 November 2026. When a vendor does not publish something (price, hosting), we say so instead of guessing.
Disclosure: this article is published by ResiPlan, which is one of the products listed. We applied the same grid to everyone, ourselves included, and we do not rank the products: the right tool depends on what you need to test, who takes part and which obligations apply to you.
Key takeaways
- An exercise only counts if it closes the loop: findings become tracked corrective actions, the plan is updated, the next test checks the fix. DORA Article 24(5) asks financial entities to prioritise, classify and remedy every issue a test reveals.
- Continuity suites (Fusion, Riskonnect, Everbridge, Preparis, Noggin, GlobalSuite, Continuity2, MAPSI, ResiPlan) focus on scheduling, evidence and the link to BIA and plans. Dedicated platforms (Conducttr, Exonaut, Immersive) focus on realism during play.
- Only two products in the main list publish a price on the pages we checked: Conducttr (annual team licences from £11,950 excluding taxes) and ResiPlan (from €199 per month, billed annually).
- Hosting is rarely stated: GlobalSuite and ResiPlan state European hosting; Exonaut and Conducttr offer an on-premises option.
Business continuity exercise software comparison table
| Product | Origin | Stated target | Exercise types | Scenario library | Injects / live play | After-action → corrective actions | Link to BIA / plans | Public price | Stated hosting |
|---|---|---|---|---|---|---|---|---|---|
| Fusion | United States | Complex and regulated organisations | Exercises, walkthroughs, scenario testing, data-driven scenario simulation | AI-generated library of plausible events | Not described | Remediation and issue tracking | Yes | Not published | Salesforce platform, regions not published |
| Riskonnect | United States | Not stated | Scenario-based simulations, plan stress tests | Not described | Not described | Corrective actions; AI agent recommends fixes | BIA and plans in the same product | Not published | Not published |
| Everbridge BC in the Cloud | United States | Not stated | Tabletop; automated business, technology, vendor or location exercises | Not described | Not described | After-action reviews, areas for improvement | Not described | Not published | Not published |
| Mitratech Preparis | United States | Any maturity level, multiple industries | Exercises run in the incident tool's exercise mode | Predefined scenario templates | Exercise mode in Incident Manager | Retrospective, issue-tracking reports | Plans added to the exercise roadmap | Not published | Not published |
| Noggin | Australia | Not stated | Tests of response plans and recovery strategies | Not described | Not described | After-action review, improvement activities | Response plans and recovery strategies | Not published | Not published |
| GlobalSuite | Spain | Not stated (2,000+ companies) | Technical, tabletop, live drills | Pre-configured crisis scenarios | Not described | Results and audit evidence | Yes (same processes and assets) | Not published | European regions |
| Continuity2 | Offices in Glasgow, Dubai, New York | Not stated | Drills and exercises of several types | Default exercises and custom scenarios | Not described | Post-exercise report with improvement actions, corrective action tracking | Scenarios built from system data | Not published | Not published |
| MAPSI | France | Not stated | Tests and exercises (types not named) | Scenarios linked to plans | Not described | Gaps and action plans | Yes (BCP, DRP) | Not published | Not published |
| ResiPlan | Belgium | Consultants, SMEs, mid-size, groups | 8 types, including tabletop, simulation, technical DR test, full-scale | Bilingual templates, game scenarios, AI draft | Timed injects; game clock up to ×8 | After-action report; findings → corrective actions | Yes; measured RTO/RPO vs BIA targets | From €199/month excl. VAT (annual) | EU (Ireland, France) |
| Conducttr | Not stated (prices in £) | Corporates, consultants, humanitarian, defence and security | Virtual-desktop simulations, in person or remote | Online exercise library (Conducttr Worlds) | Simulated mail and social media | Central reports, real-time analytics | Not described | From £11,950 per year (team licence) | Cloud, region not stated; on-premises for defence |
| 4C Strategies Exonaut | Sweden | Defence, government, public and corporate | Planned and controlled exercises, real-time evaluation | Central library, AI-assisted scenarios | Injects, including simulated media | Structured after-action reviews | Not described | Not published | Cloud or on-premise |
| Immersive Crisis Simulations | United Kingdom | Executives, incident leaders, cross-functional teams | Digital cyber crisis simulations | Built by AI around your systems and playbooks | Dynamic injects, AI actors | Performance evidence, playbook adherence | Playbooks (no BIA described) | Not published | Not published |
"Not published" means we did not find the information on the vendor pages listed in Sources. "Not described" means the vendor's page does not present the capability; it may still exist.
How we compared
We used the criteria that separate an exercise tool from a shared calendar and a slide deck:
- Range of exercise types: from discussion-based (tabletop, walkthrough) to operations-based (simulation, drill), technical (disaster recovery test, failover) and full-scale activation.
- Running the exercise live: scenario library, timed injects, simulated channels, facilitator control.
- Closing the loop: after-action report, findings converted into tracked corrective actions, plan updated, re-test.
- Link to the BIA and plans: which plans an exercise tests, and whether measured recovery times are compared with the targets set in the BIA.
- Transparency: published price, declared hosting.
The regulatory backdrop is the same for everyone. ISO 22301 covers exercising and testing in clause 8.5. DORA (Regulation (EU) 2022/2554) requires financial entities to test their ICT business continuity plans and ICT response and recovery plans at least yearly and after substantive changes (Article 11(6)), to run a digital operational resilience testing programme that includes scenario-based tests (Articles 24 and 25), and, for entities identified by their competent authority, threat-led penetration testing (TLPT) at least every 3 years (Article 26). NIS2 (Directive (EU) 2022/2555) Article 21 lists business continuity and crisis management, and policies to assess the effectiveness of security measures, among the minimum measures, without setting a test frequency.
For ready-made scenarios, see our 10 crisis exercise scenarios. For the broader software market, see our business continuity software comparison.
Enterprise continuity suites with an exercise module
Fusion
Fusion (headquartered in Chicago) says its business continuity software is "designed for complex and regulated organizations". Plans are tested through "exercises, walkthroughs, scenario testing, and readiness reporting", and exercises are connected to BIA, risk, recovery, application, vendor, site and plan data, with remediation and issue tracking in the same system. Two products launched on 31 July 2024 extend this: Scenario Simulation and Intelligence, which can "run thousands of variations of a scenario" against plans using an AI-generated library of plausible events and is presented as making tabletops more productive, and Enterprise Exercise Management, which orchestrates large testing programmes from planning to post-event analysis. Fusion's trust centre lists the platform as Salesforce-managed. Prices are not published; a self-guided product tour is available. ResiPlan vs Fusion.
Riskonnect
Riskonnect (headquartered in Atlanta) lets you "run scenario-based simulations using threat intelligence data" to stress-test plans, and lists resilience testing to validate plans before they are needed. Its page cites "out-of-the-box alignment with ISO 22301, including corrective actions and management reviews", and a Business Resilience Agent that recommends corrective actions for weak plans. BIA and dynamic continuity plans sit in the same product. The page does not describe tabletop facilitation or injects. Pricing "depends on the size and complexity of the project"; hosting is not stated. The former Castellan website now redirects to Riskonnect. ResiPlan vs Riskonnect.
Everbridge BC in the Cloud
BC in the Cloud, now presented as "BC in the Cloud with Everbridge 360 AI", lets teams "conduct tabletop exercises, perform after-action reviews, and utilize benchmarking", and automate business, technology, vendor or location-based exercises tracked from start to finish, including areas for improvement. Its pages also list "detailed after-action reports, response analytics, and interactive dashboards". Neither price nor hosting is published on the product pages we checked. ResiPlan vs Everbridge.
Mitratech Preparis
Exercise Manager is included with Preparis Incident Manager; Mitratech acquired Preparis in October 2024. Teams plan and schedule exercises in one place, load predefined scenario templates or write their own, then launch the scenario into Incident Manager "in exercise mode". Takeaways, an executive summary and issues are captured in the system, which generates "audit-ready exercise, incident, and issue-tracking reports"; plans can be added to an exercise roadmap. The product page says the platform supports organisations "of any maturity level, across multiple industries". Price and hosting are not published.
Noggin
Noggin (headquartered in Sydney, acquired by Motorola Solutions in 2024) bundles an exercises and testing module with its Continuity product: exercise management, testing of response plans and recovery strategies, after-action review, lessons learned and improvement activities. The module page does not detail exercise types, scenario libraries or injects. Price and hosting are not published on that page. ResiPlan vs Noggin.
European continuity software with exercise tracking
GlobalSuite
Spanish vendor GlobalSuite presents "tests and drills that leave an audit trail": you schedule tests, record the results and keep the evidence for the audit, with test categories shown as technical, tabletop and live drills. BIA, plans, risks, tests and crises share the same processes and assets; ISO 22301 and ISO 27031 are preloaded, along with DORA requirements. The page also mentions pre-configured crisis scenarios. Its trust centre states that the architecture is split across regions "within the European area". Pricing is not published.
Continuity2
Continuity2 (offices in Glasgow, Dubai and New York) schedules drills and exercises according to your policy or KPIs, offers default exercises or custom scenarios built from the data in the system (loss of systems, suppliers, locations, resources), invites participants by email and collects feedback through configurable forms. Post-exercise analysis records observations, recommendations and actions. The vendor states that reports with improvement actions are generated "in 20 minutes post-exercise", distributed for sign-off and stored for audit, with corrective action tracking. Price and hosting are not published.
MAPSI
MAPSI, published by OLING (Issy-les-Moulineaux, France), documents exercises, results, gaps and action plans, linked to the risks, scenarios, continuity plans and IT recovery plans they test, and keeps proof of execution for reviews. The page does not describe live exercise facilitation such as injects or a timeline. Price and hosting are not published.
ResiPlan
ResiPlan, published by a Belgian company, treats an exercise as part of the continuity model rather than a separate tool:
-
Eight exercise types: tabletop, walkthrough, simulation, drill, parallel test, technical disaster recovery test, full-scale exercise and live field drill, with the plans under test attached to the exercise.
-
Templates: bilingual (French and English) exercise templates with objectives, timed injects and an evaluation grid; your own exercises can be saved as templates. An AI assistant can draft the scenario and objectives from your sector, critical processes and top risks, for you to edit before saving.
-
Exercise control room: scoping, inject timeline, play log, 0–3 evaluation grid and lessons learned, with a facilitator pack and an after-action report exported as PDF.
-
Closing the loop: findings become corrective actions tracked in the actions module; completing an exercise updates the tested plans' last test date and result; measured RTO and RPO are compared with the BIA targets, and plans never tested are flagged.
-
Crisis Gaming, included in every plan: solo or facilitated tabletop runs on a shared clock (real time up to ×8), with decisions that have consequences; the debrief writes the score, evaluation and findings into the same exercise record.
-
Programme view: a recommended next exercise level, from discussion-based to full activation, based on scored history, and a test calendar with in-app reminders.
-
Price: from €199 per month excl. VAT, billed annually (Essentials, up to 10 users); free 7-day trial, no credit card.
-
Hosting: database in Ireland (Convex EU deployment on AWS), web servers at OVHcloud in France.
-
Caveat: injects arrive as messages labelled by source (press, regulator, SOC); there is no simulated social-media feed or virtual desktop of the kind dedicated simulation platforms offer. Software structures and records an exercise; it does not replace the facilitator.
Module details: ResiPlan business continuity software.
Dedicated exercise and crisis simulation platforms
Conducttr
Conducttr sells "crisis exercising software" to corporates, consultants, humanitarian organisations and defence and security clients. Players work in a virtual desktop with simulated mail, micro-blogging and social-media monitoring apps, in person, remotely or both. Exercises are built in an editor with an AI assistant, LISA, described as "a text-to-MEL chatbot"; Conducttr Worlds is an online library of ready-made exercises. Reporting is described as central reports and real-time analytics, and an Assessment Toolkit is sold as an add-on. Conducttr is the only dedicated platform here with public prices: four annual team licences from £11,950 to £25,725, excluding taxes, with a one-year minimum subscription. The hosting region is not stated; Conducttr Local, an on-premises version, is offered to defence and security clients. The site is published by Transmedia Storyteller Ltd and states ISO/IEC 27001 certification.
4C Strategies Exonaut
4C Strategies, founded in Lund, Sweden, in 2000 and headquartered in Stockholm, sells the Exonaut platform, used in defence training (NATO is named among its users) and also offered as resilience software for public and corporate organisations. Its Training & Exercise Manager coordinates people, logistics and timelines, develops "adaptive scenarios with AI support", creates injects such as regulatory changes or simulated media, lets evaluators record performance in real time on mobile devices, and runs "structured After Action Reviews (AAR)" so that lessons are prioritised and acted on. Exercises and scenarios are stored in a central library. Deployment is cloud-hosted or on-premise; prices are not published.
Immersive Crisis Simulations
Immersive (founded in 2017 in Bristol, UK, with a US office in Boston) offers crisis simulations in its Immersive One platform for "executives, incident leaders, and cross-functional teams" facing a cyber crisis. An AI Program Builder creates simulations around your systems, playbooks and risks; during play, "dynamic injects, live consequences" and AI actors you can question drive the scenario. Reporting "turns performance into evidence": decision weaknesses, playbook adherence and readiness benchmarks. The page does not describe links to a BIA or continuity plans. Price and hosting are not published.
Adjacent tools: useful, but not continuity exercise software
- Filigran OpenAEV (Paris-based Filigran) is an open-source adversarial exposure validation platform (breach and attack simulation mapped to MITRE ATT&CK) that also runs "hyper-realistic crisis tabletop exercises" with email and SMS injects; its scenario library includes an Akira ransomware tabletop. The Community Edition is free and installed on-premise; the Enterprise Edition runs on-premise or as SaaS.
- INJECT, developed by Masaryk University (Czech Republic) with the national cyber security agency NÚKIB as application partner, is an open-source (MIT) platform for cybersecurity tabletop exercises: injects across several channels, automated email injects, reactions to participants' decisions. It is self-hosted.
- NCSC Exercise in a Box (UK National Cyber Security Centre) is a free online resource with micro exercises and tabletop discussion exercises for cyber incidents, including what you need to identify post-exercise actions.
- Cutover is an automated runbook platform for IT disaster recovery testing: runbook templates in one place, real-time statistics on when each runbook was last tested and whether the test succeeded, immutable audit logs. It tests IT recovery, not the crisis team.
If your scope is IT recovery only, our disaster recovery plan guide and RTO vs RPO explainer help set the targets a test should measure.
How to choose
- First tabletop, small team: templates and a structured after-action report matter more than simulation realism. Start from a scenario, name the crisis management team roles, and make sure every finding gets an owner and a date.
- ISO 22301 programme: favour a tool where exercise, findings, corrective actions and plan updates form one chain. Ask each vendor to show a finding becoming a tracked action, and the plan's last test date changing.
- Financial entity under DORA: you need yearly tests of ICT continuity and response and recovery plans, a testing programme and a procedure to remedy what tests reveal; our DORA guide covers the rest. TLPT is a separate, specialised test on live production systems, carried out by testers, not in an exercise tool.
- Executive cyber crisis training: dedicated platforms (Conducttr, Exonaut, Immersive) bring simulated media and AI actors. Check how their results flow back into your continuity plans and corrective actions.
- IT disaster recovery tests: runbook automation (such as Cutover) or the technical DR test type of your continuity tool. Record the achieved RTO and RPO against the target, not just "test passed".
- Defence, government or air-gapped environments: Exonaut and Conducttr Local offer on-premises deployment.
FAQ
What is business continuity exercise software?
It is software that plans, runs and evidences the tests of continuity, recovery and crisis plans. Depending on the product, it covers scheduling, scenario libraries, timed injects during the exercise, evaluation grids, after-action reports and the tracking of corrective actions until the plan is fixed.
What is the difference between a tabletop exercise, a simulation and a disaster recovery test?
A tabletop exercise is a facilitated discussion of a scenario, with no systems touched. A simulation plays the scenario in near-real conditions, with injects arriving over time and decisions taken under pressure. A disaster recovery test actually restores or fails over IT systems and measures the recovery time and data loss against the targets.
How often should business continuity plans be tested?
ISO 22301 requires an exercise programme (clause 8.5) and leaves the frequency to the organisation. DORA requires financial entities to test their ICT business continuity plans and ICT response and recovery plans at least yearly and after substantive changes to the ICT systems supporting critical or important functions. NIS2 Article 21 requires business continuity and crisis management measures and policies to assess their effectiveness, without fixing a frequency.
Can software automate BCP testing exercises?
Partly. Software can schedule exercises, draft scenarios with AI, deliver injects on a clock, score decisions against an evaluation grid, generate the after-action report and track corrective actions. IT recovery steps can be orchestrated by runbook tools. The decisions taken during the exercise, and the judgement of the evaluators, stay human.
Does DORA require threat-led penetration testing for every financial entity?
No. Article 26 of DORA requires TLPT at least every 3 years only for the financial entities identified by their competent authority. TLPT covers critical or important functions on live production systems. It complements, but does not replace, the yearly testing of continuity and recovery plans.
How much does business continuity exercise software cost?
Most vendors do not publish prices. Public price points found on 1 November 2026: Conducttr's annual team licences from £11,950 excluding taxes, and ResiPlan from €199 per month billed annually, with exercises and Crisis Gaming included. Free options exist for cyber tabletops: NCSC Exercise in a Box, INJECT and the OpenAEV Community Edition.
Sources
Pages checked on 1 November 2026.
- Fusion: fusionrm.com/offerings/business-continuity-management; fusionrm.com/platform/scenario-simulation-intelligence; press release of 31 July 2024 (Scenario Simulation and Intelligence, Enterprise Exercise Management); fusionrm.com/contact-us; trust.fusionrm.com
- Riskonnect: riskonnect.com/business-continuity-software; riskonnect.com/contact-us; castellanbc.com (redirects to riskonnect.com/castellan-riskonnect)
- Everbridge: everbridge.com/bcic; everbridge.com/bcic-resilience; Everbridge newsroom (Burlington, Massachusetts office release)
- Mitratech: mitratech.com/products/preparis; Mitratech blog posts "Introducing Exercise Manager" and "Exercising Your Plans with Exercise Manager"; Mitratech press article "Mitratech Completes 16th Buyout"
- Noggin: noggin.io/library/business-continuity/exercises-and-testing; Motorola Solutions acquisition release (July 2024, reprinted by SecurityInfoWatch)
- GlobalSuite: globalsuitesolutions.com/business-continuity; trust centre infrastructure overview (help.globalsuitesolutions.com); globalsuitesolutions.com/company; press release of 12 April 2023
- Continuity2: continuity2.com; continuity2.com/business-continuity-management-software/exercise-testing
- MAPSI: mapsi.fr/fr/logiciel-pca-pra
- Conducttr: conducttr.com; conducttr.com/pricing; conducttr.com/security
- 4C Strategies: 4cstrategies.com/solutions/resilience-software/training-exercise-manager; 4cstrategies.com/about-4c
- Immersive: immersivelabs.com/products/crisis-sim; immersivelabs.com; immersivelabs.com/our-story
- Filigran: filigran.io/platforms/openaev; hub.filigran.io (Akira ransomware tabletop scenario); TechCrunch, 27 October 2024
- INJECT: inject.muni.cz
- NCSC: ncsc.gov.uk/section/exercise-in-a-box/overview
- Cutover: cutover.com/content-hub/it-disaster-recovery-testing
- Regulation (EU) 2022/2554 (DORA), Articles 11, 24, 25 and 26, and Directive (EU) 2022/2555 (NIS2), Article 21: official texts on EUR-Lex
- ISO 22301:2019, clause 8.5 (cited by number; the text of the standard is not reproduced)
- ResiPlan: product and pricing as of 1 November 2026
Spotted an outdated detail, or are you a vendor requesting a correction? Reach us through the contact page.