A new security leader's first ninety days

The temptation is to arrive with a plan. The better move is to arrive with questions and leave with a plan the organisation recognises as its own.

Days 1 to 30: find out what's true

Not what the documents say. What's true. I'd want to see the last incident's timeline, the alert queue, the list of privileged accounts, the backup restore record, and the budget. Then I'd talk to the people who run the systems, not just the people who manage them. The gap between the two conversations is usually where the real risk sits.

Days 31 to 60: pick the few things that matter

Everything can be improved. Three things can be improved this quarter. I'd choose the ones that reduce the most consequential exposure, that the organisation can actually execute, and that produce evidence a board will understand. Usually that's some mix of identity, backup recoverability, and detection of the attack most likely to hit this particular business.

Days 61 to 90: show one result

A plan is a promise. A result is proof. By day ninety I'd want one thing demonstrably better, with a before and after, and I'd want the board to have seen it. It buys the credibility to do the harder things in the second quarter.

What I'd resist

Reorganising on arrival. Buying a platform to signal action. Declaring the previous leader's work a disaster. Each of those feels decisive and costs you the people whose help you'll need.

The conversation with the CEO

Early, and about one question: when something goes badly wrong, what do you want from me in the first hour? The answer tells you what kind of security leader they think they hired. If it doesn't match what you intend to be, better to find out in week one.

If you're stepping into a role like this, or hiring for one, I'm happy to talk it through.

Explore: More on executive leadership · Work with me