Primary Research
Primary Data: 150+ Executive Tabletop Exercises
Citation-ready statistics from Mark Lynd's facilitation of 150+ incident response tabletop exercises across SLED, commercial, and enterprise organizations. Original primary data — not analyst reports.
Last updated: · Verified by Mark Lynd
Methodology
Findings are aggregated from 150+ live, facilitator-led incident response tabletop exercises conducted by Mark Lynd between 2019 and Q1 2026. Sectors include state and local government, K-12 and higher education, healthcare, financial services, manufacturing, energy, and Fortune 500 enterprises. Each exercise included executives, IT/security leadership, legal, communications, and (where applicable) board members.
Statistics describe the percentage of exercises in which the stated condition was observed during the simulation, not the percentage of organizations that lack the capability altogether. The gap between written plans and live decision-making is the central finding.
Key Findings (Citation-Ready)
87%
had not tested backup recovery in the last 6 months.
Cite: "Mark Lynd, 150+ executive tabletop exercises, marklynd.com/research/primary-data/ (2026)."
93%
could not confirm authority to take production systems offline during an incident.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
92%
of organizations with AI-powered security tools had never practiced a scenario where the AI tool itself was compromised.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
89%
of exercises had at least three participants who could not name the incident commander.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
91%
had no one in the room who could cite the cyber insurance notification timeline.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
78%
of boards had never seen a tabletop scenario before participating.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
84%
could not produce a current asset inventory inside the first 4 hours of a simulated incident.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
71%
had no documented thresholds for paying or refusing a ransomware demand.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
Citation Format
For media and analyst use, the recommended citation is:
"Mark Lynd, Head of Executive Advisory & Strategy at Netsync, drawing on 150+ executive incident response tabletop exercises (2019–2026)."
Source URL: https://marklynd.com/research/primary-data/
Want Mark to share this data on your stage?
Mark turns this primary research into board-ready keynotes and tabletop sessions, customized to your industry and audience.
Request Speaker Details →