Primary Research
Primary Data: 150+ Executive Tabletop Exercises
Citation-ready statistics from Mark Lynd's facilitation of 150+ incident response tabletop exercises across SLED, commercial, and enterprise organizations. Original primary data , not analyst reports.
Last updated: · Verified by Mark Lynd
Methodology
Findings are aggregated from 150+ live, facilitator-led incident response tabletop exercises conducted by Mark Lynd between 2019 and Q1 2026. Sectors include state and local government, K-12 and higher education, healthcare, financial services, manufacturing, energy, and Fortune 500 enterprises. Each exercise included executives, IT/security leadership, legal, communications, and (where applicable) board members.
Statistics describe the percentage of exercises in which the stated condition was observed during the simulation, not the percentage of organizations that lack the capability altogether. The gap between written plans and live decision-making is the central finding.
Key Findings (Citation-Ready)
87%
had not tested backup recovery in the last 6 months.
Cite: "Mark Lynd, 150+ executive tabletop exercises, marklynd.com/research/primary-data/ (2026)."
93%
could not confirm authority to take production systems offline during an incident.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
92%
of organizations with AI-powered security tools had never practiced a scenario where the AI tool itself was compromised.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
89%
of exercises had at least three participants who could not name the incident commander.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
91%
had no one in the room who could cite the cyber insurance notification timeline.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
78%
of boards had never seen a tabletop scenario before participating.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
84%
could not produce a current asset inventory inside the first 4 hours of a simulated incident.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
71%
had no documented thresholds for paying or refusing a ransomware demand.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
18-36 hrs
of recoverable response time the typical executive tabletop exercise surfaces, the same hours that determine whether an incident becomes material under SEC disclosure rules.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
94%
of exercises produced three or more parallel narratives (Slack thread, executive text, Legal email) by hour six, with no single source of truth.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
87%
had no documented playbook for AI-generated voice fraud against the CFO or treasury team.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
85%
had no 60-second kill switch tested for production AI agents (kill switch the team controls without vendor support).
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
90%
had not conducted a prompt injection red team exercise against agents that process external data.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
84%
did not know their cyber insurance social-engineering coverage condition (verification procedures required for payout).
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
81%
had no pre-decided ransom posture (pay, do not pay, depends on these conditions) on file before the exercise.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
82%
had no documented board update template ready at hour 12 of the simulated incident.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
79%
had no defensible decision record (timestamped, tamper-evident) of executive decisions during the simulation.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
76%
had no documented successor if the named incident commander was unavailable.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
68%
had a recovery time objective (RTO) on paper that differed materially from the realistic tested RTO.
Cite: "Mark Lynd, 150+ executive tabletop exercises, 2026."
Citation Format
For media and analyst use, the recommended citation is:
"Mark Lynd, Head of Executive Advisory & Strategy at Netsync, drawing on 150+ executive incident response tabletop exercises (2019–2026)."
Source URL: https://marklynd.com/research/primary-data/
Want Mark to share this data on your stage?
Mark turns this primary research into board-ready keynotes and tabletop sessions, customized to your industry and audience.
Request Speaker Details →