Incident Response
Incident Response: Speaking, Tabletop Facilitation, and Executive Advisory
Mark Lynd has facilitated 150+ incident response tabletop exercises, advised Fortune 500 boards through real ransomware events, and is a co-creating partner with IR-OS — the modern incident response platform built for the way executives actually work during a breach.
What Incident Response Actually Looks Like
Incident response is not the SOC drill. It is the live, board-visible scramble that begins the minute a CEO is told something is wrong — the call to legal, the call to insurance, the call to the named incident commander, the call about whether to take production offline. Mark Lynd has been in those calls.
The gap between a written IR plan and live decision-making is where most organizations actually lose time, money, and customer trust during a real event. Closing that gap is the work.
What Mark's 150+ Tabletops Reveal
93%
could not confirm authority to take production offline.
91%
had no one who could cite the cyber insurance notification timeline.
89%
had three or more participants who could not name the incident commander.
87%
had not tested backup recovery in the last 6 months.
84%
could not produce a current asset inventory in the first 4 hours.
71%
had no documented thresholds for paying or refusing a ransomware demand.
Three Ways Mark Engages on IR
1. Keynote Speaking
Board, C-suite, and conference keynotes on ransomware preparedness, the first 72 hours, cyber insurance and IR, AI-augmented attacks on IR, and rebuilding executive trust after an incident. Audiences from 50 to 5,000+. In-person, virtual, or hybrid.
Incident Response Keynote Speaker →2. Tabletop Facilitation
Executive tabletop exercises customized to your industry, threat profile, and board. Mark personally facilitates — not a junior consultant. Scenarios include ransomware, BEC, third-party breach, AI-deepfake CEO fraud, and supply-chain compromise.
How to Run a Tabletop Exercise →3. Executive Advisory and IR-OS Partnership
Mark partners with IR-OS, the modern incident response platform built for the way executives actually work during a breach. IR-OS turns IR plans into live, board-visible decision flow — the gap that 150+ tabletops have shown matters most.
Learn about IR-OS →Free IR Resources
- 60-Second Ransomware Exposure Quiz — Eight yes/no questions that read your exposure based on patterns from 150+ tabletops.
- Tabletop Scenario Generator — Pick industry, size, attack vector. Get a board-ready scenario in 30 seconds.
- How to Run a Cybersecurity Tabletop Exercise — Seven-step playbook from 150+ executive tabletops.
- How to Respond to Ransomware in the First 72 Hours — The decisions, in order.
- Primary Data: 150+ Tabletop Exercises — Citation-ready statistics.
- Incident Response Questions — Direct answers to the IR questions executives ask.
Incident Response FAQ
What is incident response?
Incident response (IR) is the structured process of detecting, containing, eradicating, and recovering from a cyber incident. It spans the technical work (forensics, isolation, restoration) and the executive work (legal, insurance, communications, board, regulators). The executive layer is where most organizations lose time during a real event.
What are the phases of incident response?
The widely-used NIST framework defines four phases: (1) Preparation; (2) Detection and Analysis; (3) Containment, Eradication, and Recovery; (4) Post-Incident Activity. SANS uses a six-phase model that splits Containment, Eradication, and Recovery into separate steps. The phases are useful as a checklist, but real incidents move non-linearly — preparation gaps surface as decisions are needed.
What is an incident response plan?
A documented set of roles, authorities, communications, and procedures for responding to a cyber incident. The plan should name the incident commander, document authority to take production offline, list the cyber insurance notification timeline, and specify decision thresholds for ransomware payment, customer notification, and regulatory disclosure.
What is an incident commander?
The named individual with authority to make operational decisions during a cyber incident, including taking production systems offline. In 89% of Mark Lynd's 150+ tabletops, three or more participants could not name the incident commander — the most common preparation gap surfaced.
What is the difference between incident response and disaster recovery?
Incident response addresses the cyber event itself — what happened, who knew, what to contain, who to notify. Disaster recovery addresses restoring operations — restoring systems, data, and business processes. They overlap; mature programs treat IR and DR as integrated, not parallel, with the same incident commander coordinating both.
How long does incident response take?
It varies. Containment of a ransomware event typically runs hours to days. Full eradication and recovery typically runs days to weeks. The legal, insurance, and regulatory tail typically runs months to over a year. Boards underestimate the tail; CEOs are still answering questions about an incident long after the systems are back.
Who should lead incident response?
Operationally, the named incident commander leads — typically the CISO or a designated deputy. Strategically, the CEO owns the decisions with material legal, financial, customer, or board impact. Counsel quarterbacks legal and regulatory; communications quarterbacks public messaging; the CFO quarterbacks insurance. Tabletop exercises clarify these lanes before a real event.
Bring IR to your stage or your boardroom
Mark delivers IR keynotes, facilitates IR tabletops, and partners with IR-OS to bring the modern IR platform to executive audiences.
Request IR Engagement →