The Future of Exercises: Building a Modern 18-Month Cycle

For years, exercises in emergency management followed familiar patterns: annual tabletop, occasional functional, rare full-scale, and a review cycle that moved slower than operational risk. That model no longer works. The pace of disruption has changed, threats have evolved, and organizations are expected to perform under conditions more complex than ever before.

The old exercise model was built for stability.
The new exercise model must be built for velocity, pressure, and interdependence.

A modern exercise program is not a compliance requirement.
It is an operational readiness engine—one that must fuse cyber, physical, and interagency functions into a single, evolving system of practice.

The 18-month cycle is emerging as the new gold standard.
Not because it’s convenient, but because it aligns with how risk truly behaves in 2025 and beyond.

What’s Broken With Traditional Exercise Programs

1. Annual Exercises Can’t Keep Up With Modern Risk

Threats evolve faster than calendars.
Cyber actors don’t wait 12 months.
Climate impacts don’t wait for Q4.
Complex incidents don’t care about budget cycles.

Annual exercises leave organizations testing outdated assumptions while completely missing the risk that has already arrived.

2. Exercises Are Still Too Scripted

Many exercises remain:

• Predictable

• Comfortable

• Leadership-friendly

• Fully resourced

• Unrealistically calm

• Detached from operational stress

In the real world:

• Key staff are unavailable

• Information is incomplete

• Systems fail

• Decisions are made late

• Confusion is unavoidable

Exercises should reveal weakness, not protect egos.

3. Cyber and Physical Operations Are Still Exercised Separately

This is one of the most dangerous disconnects in emergency management today.

A cyber incident is an operational disruption.
An operational disruption is a cyber consequence.

Yet most organizations:

• Exercise ransomware without operational impact

• Exercise storms without digital impact

• Exercise continuity without cyber degradation

• Exercise response without vendor collapse

No threat exists in isolation—your exercise program shouldn’t either.

4. Too Many Organizations Only Test Their EOC—Not Their Enterprise

EOCs matter.
But the mission happens everywhere else.

If you’re not exercising:

• Logistics

• IT

• Communications

• Safety

• Security

• Operations

• Supply chain

• Executives

• Vendors

• Partners

…then your exercise isn’t testing capability.
It’s testing the EOC’s ability to send emails under stress.

5. Leadership Turnover Is Destroying Continuity

An exercise program that doesn’t anticipate:

• Leadership rotation

• Workforce churn

• Retirement waves

• Organizational realignment

…is an exercise program designed for a world that no longer exists.

Exercises must strengthen institutional memory, not just individual performance.

Why an 18-Month Cycle Works

The 18-month model allows organizations to run:

• Quarterly micro-exercises for decision-makers

• Semiannual functional tests

• Annual special-focus drills (cyber, medical surge, industrial hazard, etc.)

• 18-month full-scale or complex multi-agency exercises

This creates a continuous progression:
learning → testing → improving → retesting → validating.

It is the only model designed around:

• Workforce turnover

• Budget cycles

• Leadership churn

• Modern threats

• Organizational learning

• HSEEP quality assurance

• Multi-sector integration

What a Modern 18-Month Cycle Looks Like

Phase 1: Foundation (Months 1–3)

• Establish Exercise Planning Team (EPT)

• Identify enterprise objectives (not just EM objectives)

• Conduct initial dependency analysis

• Define constraints, gaps, and high-risk missions

• Initiate scenario development and inject planning

• Integrate cyber, continuity, and physical hazards from day one

Phase 2: Structural Development (Months 4–8)

• Write exercise documentation with operational realism

• Build injects that challenge—not comfort—leadership

• Conduct cross-department planning

• Train EPT and facilitators

• Run small-scale “decision sprints” to script leadership response patterns

Phase 3: Functional Testing (Months 9–12)

• Cyber-physical blend exercises

• Communications degradation tests

• Alternate facility and COOP drills

• Logistics and supply chain walk-throughs

• Response and continuity coordination

• Joint training with external partners

This stage builds muscle memory under pressure.

Phase 4: Full-Scale or Complex Multi-Agency Exercise (Months 13–18)

This is the capstone phase—your stress test.

It should incorporate:

• Real-time decision pressure

• System degradation

• Vendor failures

• Media pressure simulation

• Physical response elements

• Cross-sector coordination

• Leadership ambiguity

• Injects that force prioritization

• HSEEP-aligned evaluation

If the exercise doesn’t feel overwhelming, it wasn’t scaled correctly.

Sector-by-Sector Impact

Government & Public Safety

Annual exercises cannot keep up with evolving threats:

• Civil unrest

• Cyberattacks

• Disinformation

• Major storms

• Infrastructure failure

• Election-related pressure

18-month cycles stabilize performance between leadership turnovers and budget constraints.

Healthcare

Hospitals need constant readiness workups:

• Surge events

• Cyber disruptions

• Medical supply chain interruption

• Evacuation drills

• Continuity of patient care

Healthcare exercises must integrate IT, facilities, nursing, and leadership—not just EM.

Maritime & Industrial

Shipyards, ports, RMCs, and industrial nodes require:

• Fire/HAZMAT drills

• OT/IT integrated cyber exercises

• Dry dock casualty simulations

• Crane and terminal continuity testing

• Complex multi-agency waterfront operations

The maritime sector cannot afford one-and-done exercises.
The risk curve is too steep.

Education

Schools and universities need cycles that account for:

• Semester turnover

• Athletic seasons

• Active threat scenarios

• Campus political activity

• Building-specific vulnerabilities

Every academic year introduces a new risk environment.

Private Industry

Businesses need exercise programs that test:

• Workforce readiness

• Cyber response

• Continuity of operations

• Supply chain disruption

• Reputation and media management

• High-value asset protection

The private sector suffers the biggest losses from poor exercise design.

How Celtic Edge Builds Modern Exercise Cycles

Celtic Edge provides comprehensive exercise development services, including:

• Full 18-month cycle design and implementation

• Enterprise-wide training alignment

• HSEEP-compliant documentation and evaluation

• Cyber-physical integrated exercise development

• Maritime, healthcare, and industrial specialty exercises

• Scenario development grounded in real operations

• Leadership stress-testing and decision labs

• After-action reporting that drives real change

• Improvement planning with measurable outcomes

We don’t build exercises to check boxes.
We build exercises that change how organizations think, act, and operate under stress.

Final Thought

The future of exercises isn’t about bigger events, more observers, or longer spreadsheets. It’s about building real-world readiness through iterative testing, disciplined evaluation, and cross-sector coordination.

Organizations that embrace the 18-month model will build resilience that evolves as fast as the threats they face.
Those that cling to annual exercises will fall behind—quietly at first, catastrophically later.

Celtic Edge helps organizations train the way they fight, operate, and endure under pressure.