BLOG · 6 min read
First 90 Days as a Security Lead
New security leaders fail by trying to fix everything in month one. The job in the first 90 days is to understand, prioritize, and ship one obvious win.
Days 1-30: Listen
Interview engineering, IT, legal, product, support. Map the crown jewels. Read every past incident postmortem.
Days 31-60: Baseline
Asset inventory, identity inventory, current detections, current controls. Score against a real framework (CIS, NIST CSF).
- Top 5 risks with owner + date
- Detection coverage vs ATT&CK
- MFA, EDR, backup coverage %
Days 61-90: Ship one thing
Phishing-resistant MFA for admins, EDR on every endpoint, or backup verification. One visible win builds the trust you need for year two.
Tools mentioned
CIS ControlsNIST CSFATT&CK NavigatorVantaDrata
⟩ takeaway
Credibility before strategy. Ship one boring, obvious improvement before you propose the transformation roadmap.
⟩ keep reading
Related articles
Mobile Malware in 2026: How It Gets In and How to Stay Safer
Spyware, banking trojans and sideloaded RATs — how modern mobile malware lands on a device, the tools that detect it, and the habits that keep you off the target list.
Phishing Defense That Actually Works
AiTM kits, QR 'quishing' and callback scams beat old training. What actually lowers real risk: phishing-resistant auth, a detonation layer on the inbox, and drills that mirror current tradecraft.
Splunk Detection Tips: From Noisy Alerts to Real-Time Signal
SPL patterns, accelerated data models and tstats tricks that turn a slow, noisy Splunk into a near-real-time detection engine — with snippets you can paste in today.