Helsinki · Finland

Readiness
is not a plan.
It is a practice.

Stave Advisory works with leadership teams in the public and private sectors to close gaps between current readiness and what a real crisis demands, through exercises and workshops that are built from the actual pressure your organisation faces.

Start a conversation See the work
Governance and accountability
Board-level liability is a regulatory baseline
NIS2, CER, and DORA place personal accountability for crisis preparedness on management bodies across critical sectors. A leadership exercise serves as preparation and documented evidence.
Infrastructure and continuity
Critical services face pressure from multiple directions
Sabotage, service disruption, and supply chain interference affect energy, transport, communications, and water operators as baseline conditions, and not as exceptional events.
External operating environment
Geopolitical competition reaches private organisations
State-influenced pressure campaigns, regulatory coercion, and strategic interference target defence-adjacent companies, sensitive technology providers, and critical service operators.
Reputation and stakeholder trust
Coordinated information campaigns are an operational risk
Disinformation, data exposure, and orchestrated reputational attacks can be as operationally disruptive as any physical incident. Leadership teams that have not rehearsed this dimension will discover it under pressure.
What Stave Advisory brings

The case for a different approach.

01
Exercises built from real threat intelligence, not adapted templates
Stave Advisory builds each scenario from actual threat vectors, specific regulatory obligations, and the institutional pressures that apply to the client's operating environment. This is the difference between a plausible exercise and one that reveals gaps.
scenario specificity over template efficiency
02
Cross-domain experience, not single-lane expertise
Cyber advisory, crisis communications, geopolitical analysis, and continuity planning each provide depth within their lane. Real crises do not respect those boundaries. A decade working at the intersection of EU and NATO policy, national security institutions, private sector exposure, and exercise design produces an advisor who can see the whole board and build scenarios that reflect it.
cross-domain by design, not by assembly
03
Institutional knowledge of the authorities and regulators your organisation answers to in a crisis
Knowing what regulatory authorities expect when an incident is reported, how ministries react in crisis, what a senior government official looks for in the first three hours of a major event. This knowledge does not come from secondary sources. It comes from having been on both sides of those interactions, consistently, at the most senior levels, over years. That experience is built into every Stave Advisory scenario and debrief.
institutional knowledge as methodology
04
Accessible at the scale where the gap is most acute
Significant operational and reputational exposure is not confined to large organisations. Smaller regulated entities, defence supply chain manufacturers, and companies in sensitive technology sectors often carry substantial risk. They meet different thresholds, mandate timelines, and minimum fee structures that large advisory firms require. Stave Advisory is designed to address this reality. A scoping workshop that any leadership team can commission as a first step, and a full-day exercise that produces the same quality of insight as any institutional programme. The question of readiness does not scale with headcount.
senior-level methodology at mid-market access
About
Maxime Lebrun — Stave Advisory

The gap is closeable.
But only before.

Helsinki
Finland

An energy operator's control infrastructure can be targeted during a national crisis. Manufacturers embedded in defence supply chains are subject to coordinated pressure campaigns. Financial institutions navigating regulatory incidents can simultaneously face an operational crisis and a reputational emergency. Executive teams possibly don't have an agreed decision authority for the first six hours. Communication functions may not have practised those crises. The question becomes: has the leadership team rehearsed this? The problem is when the answer is no.

Stave Advisory exists to practice crises before they upend your organisation.

Maxime Lebrun served from 2020 to 2026 as a seconded national expert at the European Centre of Excellence for Countering Hybrid Threats in Helsinki, deployed by the French Ministry of the Armed Forces. He filled successive roles as Senior Analyst for Research & Analysis and for Training & Exercise, as well as Deputy Director for Research and Analysis. He became responsible for one of the Centre's flagship training and exercise programmes. He designed and delivered scenarios and briefings for heads of state and government, ministers, senior intelligence officials, and critical infrastructure executives across more than thirty EU and NATO member states.

He led major EU and NATO-funded projects that produced exercise frameworks, policy tools, and operational recommendations for European institutions and member states, while strengthening the preparedness of private entities operating within the common market. He delivered exercises, including at the EU Council level, for the NATO Parliamentary Assembly, and in bilateral settings with national authorities across European capitals.

He has spoken at international security conferences including the Paris Defence and Strategy Forum, the Heinrich Böll Berlin Foreign Policy Conference in 2025, the European Dialogues in Helsinki in 2024, and has participated in restricted expert fora on strategic competition and emerging technology. A regular contributor to European media on security and strategic affairs, with interviews and commentary in Le Monde, RFI, La Libre Belgique, and Yle.

Before the Hybrid CoE, he served at the Baltic Defence College as Lecturer in War and Conflict Studies and Acting Director of the Department of Political and Strategic Studies. He taught and mentored officers on Joint Command, Higher Command, and Senior Leaders courses, interacting with a generation of leaders who now occupy senior positions across EU and NATO member states. Engagement extended beyond the classroom: wargames, dedicated seminars, capitals visits, and field exercises. Maxime Lebrun helped shape a cohort of leaders whose institutional networks and decision-making loops his current clients need to understand and engage with.

A decade engaging with senior leaders, knowing how they think and what drives them.
Get in touch
Work
01Two hours
Scoping Workshop
A structured conversation that maps where your organisation actually stands on crisis preparedness, instead of where it assumes it does. Produces a written gap assessment your leadership and board can act on and that your regulator can inspect.
What this involves
  • A facilitated assessment across four dimensions: decision authority, communications, operational continuity, and stakeholder management. Surfaces gaps through conversation rather than questionnaires or audits.
  • No preparation required from the client. The session is designed to work with what is in place, and to be direct about what is not.
  • A two-page written gap assessment, delivered within three working days, structured for leadership and board-level reading and regulatory inspection. Identifies priority vulnerabilities and recommends specific next steps.
  • The scoping workshop is designed as a first engagement. Organisations identify gaps they assumed were covered. It is the least demanding way to find out where your organisation stands for real.
02Half day
Crisis Exercise
A scenario built around your organisation's sector, the threat profile, and your regulatory environment. Leadership teams make real decisions under realistic pressure. The after-action report documents what the exercise revealed.
What this involves
  • A custom scenario built from the actual threat vectors, regulatory obligations, and institutional pressure points that are specific to the client's needs and of the sector. Energy operators, financial institutions, defence-adjacent manufacturers, and public sector bodies each face different scenarios.
  • Structured decision points and timed injects over three to four hours, such as a regulatory notification deadline, a media inquiry with incomplete facts, an operational disruption, a board demand for information. Each inject forces the decisions that cannot be postponed, with adapted levels of situational intensity.
  • A facilitated debrief that names what held and broke, and what the exercise revealed about the organisation's actual decision-making under pressure. The debrief contains specific and attributed observations rather than a generalised list of lessons.
  • A written after-action report, delivered within five working days, that constitutes documented evidence of leadership-level crisis rehearsal for NIS2, CER, DORA, and other compliance purposes.
03Full day
Preparedness Training
For leadership teams who understand their organisation but have not been briefed on the operating environment it now faces. Sector-specific, grounded in real cases, and designed to move from situational awareness to rehearsal in one session.
What this involves
  • A structured briefing in the morning on the threat landscape specific to the client's sector. State-influenced disruption, coordinated pressure campaigns, regulatory risk, and supply chain exposure illustrated with real cases from comparable organisations.
  • A facilitated self-assessment to make the briefing personal and relatable. Where is this organisation exposed, and how does that compare to what happened to another company in the same sector?
  • A tabletop exercise in the afternoon that puts the morning's framework under pressure. It revolves around a compressed scenario with structured injects, immediately testing what the group has just learned about itself.
  • NIS2 and CER Directives require management bodies to receive crisis preparedness training. This programme constitutes that training and produces documented evidence of delivery for regulatory purposes.
04Three hours
Crisis Communications
A live simulation of the communications decisions that matter most in a crisis. Allows practising who speaks, when, and what to say when the facts are incomplete and stakeholders are watching. For executive teams, not communications departments.
What this involves
  • A scenario with timed injects using the formats a real crisis produces, such as a journalist with a source inside the organisation or a regulatory notification request with an incomplete picture. A social media post going viral before internal confirmation, a board call at the wrong moment.
  • Participants work in their actual roles under real time pressure. Executive leadership, legal counsel, communications lead all making decisions that cannot be delegated and drafting responses reviewed in the debrief.
  • A structured debrief with a selection of specific communication outputs produced during the simulation. Outputs are examined and re-drafted as a group. Participants leave with a concrete template for action, not just a list of observations.
  • The hardest communication decisions in a crisis are not made by communication departments. They are made by executives who have not rehearsed them. This session changes that.
Contact

Every engagement starts with a conversation.

If your organisation faces questions about crisis readiness, leadership preparedness, or the compliance obligations that now apply to your management body, please get in touch.

Emailmaxime.lebrun@stave-advisory.fi
LinkedInMaxime Lebrun
LocationHelsinki, Finland