Operating While You Are Still Broken

Business Continuity Keynote Speaker

Incident response ends long before the business is running again. The gap between those two moments is where most continuity plans quietly fail. Mark Lynd works that seam, the handoff from we are containing this to we are operating degraded for the next nine days. It is the least rehearsed part of the whole discipline and the part that decides what the incident costs.

Mark Lynd, 5x CEO/CIO/CISO and Top Ranked Global Thought Leader for AI and Cybersecurity, delivering a cybersecurity and AI keynote to an international audience
Mark Lynd delivering a keynote at an international cybersecurity and AI leadership event.

Live on stage · International keynote

5x CEO/CIO/CISO Top Ranked Global Thought Leader for AI & Cybersecurity 100+ Keynotes Tailored quotes for your event
5x
CEO/CIO/CISO
100+
Keynotes Delivered
200+
AI, Cyber & IR Exercises
CISSP
ISSAP & ISSMP, certified by ISC2

Quick Answer

Incident response ends long before the business is running again.

Keynote Topics

The Handoff Nobody Owns

Containment has an owner. Recovery has an owner. The transition between them usually has neither. Mark covers what falls through that gap and how to give it a name and a person.

Best for: Resilience conferences, risk and continuity events

Duration: 45 minutes

Your Continuity Plan Assumes the Network Works

Most plans were written for fire, flood and power. A cyber event takes down the systems the plan depends on, including the plan itself. Mark covers what to change and what to print.

Best for: Business continuity events, operations leadership

Duration: 45 minutes

Running the Business on Paper for Nine Days

What manual operation actually requires. Which processes have a manual path, which only appear to, and how quickly the workarounds themselves become the risk.

Best for: Operations audiences, manufacturing and logistics events

Duration: 45 minutes

Recovery Objectives That Survive Contact With an Incident

Recovery time and recovery point targets are usually set once and never tested against a cyber scenario. Mark covers how to pressure-test them and what to do when the honest answer is uncomfortable.

Best for: Technology leadership, infrastructure and cloud events

Duration: 45 minutes

Telling Customers You Are Down

Continuity is a communications problem as much as an operational one. Mark covers holding statements, the cadence customers actually tolerate, and the specific phrases that create legal exposure.

Best for: Communications audiences, executive events

Duration: 30 to 45 minutes

Continuity for Organisations Without a Continuity Team

For schools, local government and mid-market operators, where continuity planning is somebody's third job. The shortest version of the work that still functions in a real event.

Best for: Public sector events, education conferences, associations

Duration: 45 minutes

I don't give speeches. I bring the view from the frontlines, what I'm actually seeing this quarter running enterprise AI and cybersecurity programs and advising boards, so your audience leaves with something real.

Mark Lynd, 5x CEO/CIO/CISO, Head of Executive Advisory & Strategy at Netsync

Why Mark on this subject

A 5x CEO, CIO and CISO who has been accountable for the business running, not only for the security of it. That distinction matters in continuity.

More than 150 executive incident response tabletop exercises. The exercises run past containment, which is where the continuity failures surface.

Ranked Top 10 globally by Thinkers360 in Data Center and in Cloud, which is where recovery capability actually lives.

Works from the operational reality that continuity is decided by the choices made in the first day, not by the plan on the shelf.

Author of three books on cybersecurity and AI, with a fourth publishing in 2026.

Publishes Hype Check Now and Hype Check Live, both evidence-first.

Comfortable telling a room that its recovery objectives are fiction. That conversation is the value.

Speaker Reel

Watch Mark on Stage

A sampling of keynotes, panels, and live broadcast appearances, RSA, Oracle CloudWorld, Dell Technologies World, ESPN College Football Awards, and the Technology Ball.

What Audiences Say

Feedback From Event Hosts and C-Suites

Mark stands apart. His credibility isn’t rooted in a title from years ago, it’s built through the work he’s doing every day in the field. When he speaks about our technology, enterprise buyers pay attention because they know his perspective is grounded in real-world experience.

Shira Rubinoff

CEO, The Cybersphere Group

Mark delivers more than a presentation, he delivers operational insight from the front lines. Instead of theory, he shares what is actually working in real environments. Our audience of CISOs and security leaders left with practical strategies they could begin implementing immediately.

Jo Peterson

CIO, Clarify360

Where Has Mark Spoken?

According to venue records, Mark has delivered keynotes at: RSA Conference · Oracle CloudWorld · Cisco Partner Summit · Dell Technologies World · IBM Think · T-Mobile Events · Gartner Security & Risk · InfoSecurity · ISACA Conferences · ISSA Events · Cloud Security Alliance · CyberSecurity Summit · BSides · FLGISA · MISAC · SMU Cox School of Business · and 100+ more.

How Do You Book Mark Lynd for Your Event?

The booking process is straightforward and typically completes within 3 business days. Mark customizes every keynote to the audience, industry, and event objectives.

  1. Submit an inquiry. Fill out the contact form with your event date, audience, and objectives. Response within 48 hours.
  2. 15-minute discovery call. Discuss your event in detail, including audience makeup, key messages, and desired outcomes.
  3. Proposal & contract. Receive a tailored proposal with format options (keynote, workshop, panel), fee, and travel terms.
  4. Customization. Mark customizes content to your audience, industry examples, and desired takeaways.
  5. Expert delivery. Mark brings 25+ years of real-world executive experience to every stage.

Frequently Asked Questions

How is this different from a disaster recovery talk?
Disaster recovery is about restoring systems. This is about running the organisation while they are still down, and about the handoff between the two, which is where the failures cluster.
Is this only about cyber events?
The focus is cyber, because a cyber event breaks the assumptions most continuity plans were written under. The material applies more broadly, but that is the sharp end.
Who should be in the audience?
Operations, technology, communications and finance together, if you can get them. Continuity fails at the seams between functions, so a single-function audience gets less from it.
Can he assess our continuity plan?
A tabletop exercise is the honest way to do that. A document review tells you whether the plan is well written. An exercise tells you whether it works.
Do you cover regulatory requirements like DORA or NIS2?
Where they bear on the decision, yes. He will not spend a keynote touring the regulations, because that rarely changes what a room does next.
Our board thinks we are covered because we have a plan. Can he help with that?
That is one of the more common reasons he gets booked. The exercise format is usually more persuasive than the keynote for that particular conversation.
Can this be combined with the incident response session?
Yes, and it is the natural pairing, because the two subjects meet at exactly the handoff the talk is about.

Ready to Book Mark?

Mark customizes every keynote to the audience, industry, and event objectives. Contact the booking team to check availability.

600+ projects, keynotes, panels and workshops · audiences from 50 to 5,000+

Formats: In-person, virtual, hybrid · international available

Duration: 30–120 minutes depending on format

Custom by event · educational pricing available