The 2 AM Call: A Ransomware Negotiator's Playbook with Wade Gettle

The 2 AM Call: A Ransomware Negotiator's Playbook with Wade Gettle

by SANS Institute

Applied Sciences & Engineering Computing & Cybersecurity URComputer securityURJComputer viruses, Trojans and worms
🎙 SANS Institute 👥 70K 📅 February 9, 2026 ⏱ 48 min 👁 714 📄 expert opinion 🧭 2026-08-15
Available in: English (current) Français

Keywords

ransomware negotiationthreat actor psychologydata validationincident responsecyber insurance

Summary

In this episode of the Blueprint podcast, host John Hubbard interviews Wade Gettle, a senior advisor at Flashpoint and a cyber mission planner for the New York Army National Guard, about his role as a professional ransomware negotiator. Gettle explains that his job begins with a 2 AM call when organizations face a ransomware attack, and he must engage with threat actors to manage the crisis. He emphasizes the importance of staying calm and having legal counsel involved. The conversation covers the initial 72 hours of an incident, where negotiators assess whether the company can or should pay, and how they buy time by requesting proof of data and validating it. Gettle describes how threat actors use psychological tactics, such as fake deadlines and knowledge of the company’s financials, to pressure victims. He also discusses the technical aspects, including the need for good logging and visibility to validate data and understand the attack vector. The episode highlights that paying the ransom does not guarantee data recovery and that the true cost of ransomware is often ten times the ransom itself. Gettle stresses the importance of preparation, including tabletop exercises and realistic training, to improve an organization’s response. He also notes that third-party breaches are a growing risk vector. The key takeaway is that ransomware negotiations are psychological warfare, and being prepared is the best defense.

225 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of the information is high, as it provides insider knowledge from a professional negotiator, offering practical insights into the negotiation process, threat actor tactics, and the importance of data validation. The argumentation is solid, based on real-world experience and specific examples, such as the initial ransom message and the process of verifying data. The discussion is coherent and well-structured, with Gettle explaining the rationale behind each step. However, the episode is primarily anecdotal and lacks empirical data or references to studies, which slightly reduces its scientific rigor. The advice is actionable and relevant for cybersecurity professionals, but it is not presented as a systematic analysis.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate; the content is based on expert opinion and practical experience rather than peer-reviewed research. The sources cited in the description include ransomware tracking sites (ransomware.live, ransomlook.io) and a ChatGPT simulator, which are relevant but not academic. The title accurately reflects the content, focusing on the negotiator’s perspective. The discussion is consistent with known cybersecurity practices, but the lack of formal citations limits its academic value. The podcast format allows for a conversational and accessible presentation, but it does not provide a comprehensive literature review or empirical evidence.

214 words

Title / Content Match

The title accurately reflects the content, focusing on the role of a ransomware negotiator and the high-stakes nature of the job.

Quality & Reliability

8/10

The episode features a seasoned ransomware negotiator with direct field experience, providing concrete examples and practical advice. The discussion is grounded in real-world scenarios, though it lacks formal citations or peer-reviewed sources. The information is consistent with known cybersecurity practices and threat actor behaviors.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • ransomware.live — Mentioned as a resource for tracking ransomware groups and their activities.
  • ransomlook.io — Mentioned as a resource for ransomware group tracking and statistics.
  • ChatGPT Ransomware Negotiation Simulator — Mentioned as a tool for training in ransomware negotiation.
  • Wade Gettle on LinkedIn — LinkedIn profile of the guest, mentioned for further contact.
  • Blueprint Podcast Website — Mentioned as the podcast's official website for feedback and contact.

Concurring Sources

  • ransomware.live — Provides real-time data on ransomware groups, consistent with the episode's discussion on tracking threat actors.
  • ransomlook.io — Offers statistics and tracking of ransomware groups, supporting the claims about threat actor behavior.

External References

Contribution & Novelties

This episode provides a rare insider perspective on ransomware negotiations, detailing the psychological tactics used by threat actors and the practical steps negotiators take to manage the crisis. It emphasizes the importance of data validation and the need for organizations to be prepared. The discussion offers actionable advice for cybersecurity professionals, such as the importance of having legal counsel involved and the value of tabletop exercises.

Pour aller plus loin :

  • Ransomware - Wikipedia — Provides a general overview of ransomware, its history, and impact.
  • NIST Incident Response Guide — Official guidance on incident response, relevant to preparing for and managing ransomware incidents.
  • MITRE ATT&CK Framework — A knowledge base of adversary tactics and techniques, useful for understanding attack vectors and improving detection.

123 words

Radar Profile

The radar profile shows high scores in information quantity, quality, and reliability, with a slightly lower technical level. This indicates a well-rounded episode that is both informative and credible, though it may not delve deeply into technical details for advanced practitioners.

Reliability 8/10

💬 No comments were provided for analysis.