IR Expert Speaking.
Incident Response Expert Speaker
One hundred and fifty tabletop exercises is not a marketing number. It is a library. Patterns in how legal reacts at hour six. Where communications teams freeze when a customer reporter calls. The specific moment executive teams stop being rational and start being reactive. That library is what an IR expert brings to the stage — real signal drawn from real exercises across financial services, healthcare, public sector, energy, and retail. Mark Lynd built that library one tabletop at a time.
Live on stage · International keynote
Quick Answer
One hundred and fifty tabletop exercises is not a marketing number.
Last updated: April 2026 · Verified by Mark Lynd, 5x CIO/CISO with 25+ years of experience
Keynote Topics
Expert-Level IR Tabletop Design
What separates a tabletop that drives change from a tabletop that fills a compliance checkbox. Scenario construction, injects, realistic time pressure, cross-functional representation, and after-action design that actually closes gaps.
Best for: CISO programs, IR community events, audit and compliance summits
Duration: 60-90 minutes
Real Incidents, Real Lessons: What 150+ Tabletops Taught
Patterns from a decade of exercises. The top ten failure modes Mark has observed repeatedly, the controls and rehearsals that prevent them, and the uncomfortable truths most IR plans paper over.
Best for: Security conferences, executive forums, insurance events
Duration: 45-75 minutes
Building Organizational IR Muscle Memory
Why muscle memory beats documentation when the pager goes off at 2 a.m. An expert-grade framework for cadenced exercise programs, cross-team rehearsal, and leadership-level drills tied to NIST CSF 2.0's Respond and Recover functions.
Best for: Enterprise security programs, CISO development, resilience conferences
Duration: 45-90 minutes
The incidents I've learned the most from are the ones where the technical response was perfect — and the business response failed.
— Mark Lynd, 5x CIO/CISO, Head of Executive Advisory & Strategy at Netsync
Why Organizations Book Mark as Their Incident Response Expert Speaker
150+ IR tabletops facilitated. Quite possibly the deepest single-practitioner IR exercise catalog in the industry.
Has been the executive on the call. Five times CIO/CISO — the decisions discussed on stage are decisions Mark has owned.
Expert frameworks: NIST SP 800-61 Rev. 3, NIST CSF 2.0 (Respond/Recover), MITRE ATT&CK, CISA IR playbooks, FAIR for loss scoping.
US Army 3rd Ranger Battalion + 82nd Airborne Division. Background in operating under pressure informs the work.
Jo Peterson (Clarify360): the IR expert I point clients to when stakes are real.
Speaker Reel
Watch Mark on Stage
A sampling of keynotes, panels, and live broadcast appearances — RSA, Oracle CloudWorld, Dell Technologies World, ESPN College Football Awards, and the Technology Ball.
What Audiences Say
Feedback From Event Hosts and C-Suites
Mark stands apart. His credibility isn’t rooted in a title from years ago — it’s built through the work he’s doing every day in the field. When he speaks about our technology, enterprise buyers pay attention because they know his perspective is grounded in real-world experience.
Shira Rubinoff
CEO, The Cybersphere Group
Mark delivers more than a presentation — he delivers operational insight from the front lines. Instead of theory, he shares what is actually working in real environments. Our audience of CISOs and security leaders left with practical strategies they could begin implementing immediately.
Jo Peterson
CIO, Clarify360
Where Has Mark Spoken?
According to venue records, Mark has delivered keynotes at: RSA Conference · Oracle CloudWorld · Cisco Partner Summit · Dell Technologies World · IBM Think · T-Mobile Events · Gartner Security & Risk · InfoSecurity · ISACA Conferences · ISSA Events · Cloud Security Alliance · CyberSecurity Summit · BSides · FLGISA · MISAC · SMU Cox School of Business · and 100+ more.
How Do You Book Mark Lynd for Your Event?
The booking process is straightforward and typically completes within 3 business days. Mark customizes every keynote to the audience, industry, and event objectives.
- Submit an inquiry. Fill out the contact form with your event date, audience, and objectives. Response within 48 hours.
- 15-minute discovery call. Discuss your event in detail, including audience makeup, key messages, and desired outcomes.
- Proposal & contract. Receive a tailored proposal with format options (keynote, workshop, panel), fee, and travel terms.
- Customization. Mark customizes content to your audience, industry examples, and desired takeaways.
- Expert delivery. Mark brings 25+ years of real-world executive experience to every stage.
Frequently Asked Questions
Why expert-level versus keynote-level IR speaking?
Can Mark combine an expert talk with a live tabletop exercise?
Which industries are represented in Mark's 150+ tabletops?
What are fees?
Ready to Book Mark?
Mark customizes every keynote to the audience, industry, and event objectives. Contact the booking team to check availability.
100+ keynotes · audiences from 50 to 5,000+
Formats: In-person, virtual, hybrid · international available
Duration: 30–120 minutes depending on format
Custom by event · educational pricing available
Cluster
More under Ransomware & Incident Response
All keynote angles in the ransomware & incident response cluster. See the cluster hub.
- Incident Response Keynote Speaker
- Ransomware Keynote Speaker
- Tabletop Exercise Facilitator
- Business Continuity Keynote Speaker
- Data Breach Keynote Speaker
- Tabletop Exercise Facilitator for Schools & Universities
- Top Incident Response Speaker
- Best Ransomware Speaker
- Hire an Incident Response Speaker
- Hire a Tabletop Exercise Facilitator
- Incident Response Speaker
- Incident Response Tabletop Facilitator