Ransomware
Keynote Speaker
Mark Lynd has facilitated over 150 incident response tabletop exercises — ransomware scenarios are the most requested. As a 5x CIO/CISO and author of Cyber War: One Scenario, his keynotes come from operational experience, not news coverage. Fee range: $15,000–$50,000+.
The First 72 Hours Determine Everything. Mark Lynd Has Practiced Them 150+ Times.
Ransomware doesn't announce itself politely. It hits at 2 AM on a Saturday, encrypts everything it can reach, and gives you a countdown timer. The decisions your team makes in the first 72 hours determine whether you survive it or whether it defines you.
Mark Lynd has facilitated over 150 incident response tabletop exercises across SLED, Commercial, and Enterprise organizations. Ransomware scenarios are the most requested because they're the most likely. And they reveal every gap in your plan that you didn't know existed.
As a 5x CIO/CISO, Mark has been on the receiving end of these attacks. As the author of "Cyber War: One Scenario," he's written about what coordinated attacks look like at infrastructure scale. His ransomware keynotes don't come from news articles. They come from 150+ exercises where he watched organizations discover what actually breaks under pressure.
Ransomware Keynote Topics
The First 72 Hours: Decisions That Save Companies and Mistakes That Sink Them
Based on 150+ tabletop exercises, Mark walks your audience through a ransomware attack from the first alert through the 72-hour decision window. Who gets called. Who has authority. When to isolate systems. Whether to pay. How to communicate externally.
Best for: Enterprise security events, C-Suite offsites, insurance conferences, business continuity forums
Length: 45–90 minutes
Why Your Ransomware Plan Won't Survive First Contact
Every organization has a plan. Most of them fail within the first 90 minutes. Mark reveals the five failure patterns he sees in almost every tabletop exercise: the incident commander nobody can name, the escalation chain with disconnected numbers, the backup system that shares compromised credentials.
Best for: CISO summits, security team offsites, compliance conferences, risk management events
Length: 30–60 minutes
Ransomware + Tabletop Exercise Combo
Mark's most impactful format. A 45-minute keynote that sets the context, followed by a 2–3 hour hands-on tabletop exercise where your leadership team practices surviving the exact scenario they just heard about. Your team leaves with documented gaps and prioritized action items.
Best for: Corporate offsites, annual security summits, board retreats, insurance readiness programs
Length: Half-day (4–5 hours total)
The 5 Failure Patterns Mark Sees in Almost Every Exercise
The incident commander is a title, not a person. Nobody can name who's actually in charge.
Escalation contacts are stale. Phone numbers disconnected. People who left months ago.
Authority boundaries are undefined. "Can we take production offline?" triggers a 20-minute debate that costs the critical window.
Backups are assumed, not verified. "We'll restore from backup" falls apart when the backup shares compromised credentials.
Legal and communications are surprised. They've never been in the room. Their first breach experience is the real one.
Read Mark on Ransomware and Incident Response
Frequently Asked Questions
What does Mark Lynd cover in a ransomware keynote?
The first 72 hours of a ransomware attack: the 90-minute critical window, why untested backups fail, authority gaps, business continuity planning, ransom negotiation realities, and insurance implications.
How many ransomware tabletop exercises has Mark facilitated?
Over 150, covering double extortion, supply chain ransomware, RaaS, and OT targeting.
Can Mark combine a keynote with a tabletop exercise?
Yes. The combined format is his most popular: a 45-minute keynote followed by a 2–3 hour hands-on exercise.
What makes Mark different from other ransomware speakers?
Most ransomware speakers study attacks. Mark has facilitated 150+ exercises where real organizations practice surviving them.
Book a Ransomware Keynote Speaker
150+ exercises. Every failure pattern. The keynote that prepares your team.
Fee range: $15,000–$50,000+
Formats: Keynote, tabletop exercise, keynote + tabletop combo
Duration: 30 minutes (keynote) to half day (keynote + exercise)