Zachary Lewis's account of battling LockBit ransomware at a major American university is the kind of audiobook that earns the word "gripping" in a sector, cybersecurity nonfiction, that usually earns "comprehensive" at best. Walter Dixon narrates Locked Up with the controlled urgency the story demands, and together they make nearly nine hours of incident response documentation feel like the closest thing to a procedural thriller this genre has produced. Lewis writes from inside the crisis as Chief Information Security Officer for Health Sciences and Pharmacy at Saint Louis University, and the honesty with which he describes his own errors, emotional state, and institutional constraints is what separates this from standard IT memoir.
The premise is specific and unvarnished: one of the world's most active ransomware criminal organizations, LockBit, targeted his institution, and Lewis was the person who had to figure out what to do. Reviewer Arthur J. Hedge III notes that writing this book at all took "a great deal of courage," because Lewis does not present himself as having navigated the crisis perfectly. He presents himself as having navigated it honestly, which is considerably more valuable for the readers and listeners who need to learn from it.
Pacing a Crisis Like a Novelist Would
The audiobook operates on two tracks simultaneously. The first is the chronological crisis narrative: the moment of discovery, the scramble to assess scope, the difficult decision about whether to engage with LockBit's demands, the negotiations themselves, and the long recovery process that followed. Lewis paces this with a novelist's instinct for tension, never lingering too long on any single moment but giving enough texture that you feel the accumulating pressure of an institution-wide emergency playing out across days and weeks of uncertainty.
The second track is the lessons layer, the explicit takeaways for IT professionals, business continuity planners, and organizational leaders about what preparation, response, and recovery look like from inside a real event. What makes the combination work is Lewis's refusal to sanitize the human dimension. He writes about the interpersonal strain between technical and administrative leadership, the moments of uncertainty that no incident response playbook can fully prepare you for, and the particular psychological weight of negotiating with a criminal organization that is simultaneously professional, ruthless, and strangely communicative. Reviewer Mike M notes that Lewis "guides readers through the twists and turns of navigating a ransomware attack with clarity and wit," and that wit is genuine, dark, and well deployed throughout the most tense chapters.
Dixon Modulates Between Tension and Analysis
Walter Dixon's narration is well matched to the material. He reads Lewis's first-person voice with a directness that suits the author's no-nonsense professional persona, and the technical passages, which could easily become dense in a less skilled reading, remain accessible without being simplified beyond usefulness. At eight hours and forty-two minutes, the audiobook is substantive but not exhausting. Dixon modulates effectively between the tense narrative sections and the more analytical retrospective chapters, giving the book a rhythm that rewards sustained listening across multiple sessions.
For non-technical listeners, the audiobook remains genuinely accessible. Lewis explains enough of the mechanics of ransomware, encryption, and incident response to keep a general audience oriented, and he is careful to distinguish between the technical decisions and the human and organizational ones, which are ultimately the book's real subject. Reviewer ALB describes it as "like living through a ransomware event without having to be there and deal with the stress in person," which captures exactly the experiential quality a well-produced audiobook delivers when both author and narrator are working at full capacity together.
The Ransom Decision, Handled With Real Seriousness
The negotiation chapters are the audiobook's most remarkable material. Lewis describes the back-and-forth with LockBit representatives with a combination of professional detachment and residual disbelief, and the section where he discusses the decision about whether to pay the ransom is handled with moral seriousness that the topic deserves but rarely receives in press coverage. He is honest about the institutional, legal, and ethical dimensions of that decision in ways that will be valuable to anyone in an organizational leadership role regardless of their technical background.
The chapters on technical mitigation and recovery provide hands-on detail that IT professionals will find directly applicable, covering data backup strategies, network segmentation approaches, and communication protocols for crisis management. Lewis is careful to note where his institution's specific context shaped decisions that might reasonably be made differently elsewhere, which gives the practical advice more credibility than a generic playbook would carry. The darkly funny quality the synopsis promises is real, particularly in the negotiation chapters, where Lewis's wry awareness of the absurdity of his situation comes through clearly in both the writing and Dixon's delivery of it.
Nine Hours That Work for Executives and Generalists
The obvious audience is IT and cybersecurity professionals in higher education, healthcare, and other mission-critical sectors who need to understand what a serious ransomware response actually looks like from inside the room. Business leaders, legal counsel, and board members at institutions that handle sensitive data will find it equally valuable, likely more efficiently than any tabletop exercise. The audiobook also works for general readers curious about how criminal organizations like LockBit operate and how institutions survive encounters with them. This is not a technical primer and is not trying to be one; it is a human account of a crisis, told with enough operational specificity to be genuinely instructive for professionals while remaining compelling enough for curious general listeners to stay with across the full nine hours.
