SANS Network Security 2026 - SANS@Night: Why Your Ransomware Plan Is Wrong: Incident Command Lessons from Arrakis

Your Incident Response plan is lying to you. Not deliberately—it just hasn't met the incident yet. Steve unpicks the gap between the plan your board signed off and the ransomware incident your team is actually fighting at three in the morning.

The spice must flow, the business must keep running, and somewhere between those two truths sits an Incident Commander trying very hard not to pull their hand out of the pain box.

This is a Dune themed working session on the habits, instincts and small acts of discipline that separate Incident Commanders who hold the line from those who panic-pay the ransom by lunchtime. Bring your runbooks. Leave the blue pill at the door. The worm is already coming.