New CISO, new priorities

A new CISO starts with a review, and the review ends in a list. That list becomes the security budget for the next two years.

If you sell security, risk or compliance work, get to the CISO before they finish writing it.

Why the seat changed hands

Find out why the new CISO is there. It tells you what they'll do first.

Sometimes the last CISO left after an incident. Then the new one has a mandate to fix what broke and prove it can't happen again. Spending moves fast.

Sometimes the company is growing into a new level of risk. A first CISO hire, or a step up from a security manager to a real executive, usually follows a big contract with demanding customers, a move into a regulated market or pressure from the board.

And sometimes it's a routine change. The previous CISO retired or moved on. Even then, a new leader will look at everything with fresh eyes and won't feel bound by the old plan.

What the review looks for

In the first 90 days, a new CISO usually asks the same questions.

What do we actually have? Many inherit a pile of tools with overlapping features and no clear owner. Consolidation is a common early move.

Where are the gaps? Identity, cloud security, third-party risk and incident response are frequent finds.

What do regulators, auditors and customers require that we can't show today? Compliance gaps often turn into funded projects quickly, since the deadline is set by someone else.

And who's helping us? The CISO will look hard at managed services and consulting partners. Some get renewed. Some get replaced. More on the seat itself in selling to a CISO.

Stack it with other signals

A new CISO alone tells you the door is open. Other signals tell you where they'll walk.

A 10-K that adds new language on cybersecurity risk or names a recent incident tells you the pressure behind the hire. Job posts for security engineers in a specific area, like identity or cloud, tell you where they're building. A recent acquisition means a new environment to secure and a new set of tools to merge.

And watch what they post or speak about. New CISOs often show up at security events in the first months, and their talks are a clear statement of priorities. The buying signals guide covers how these combine.

What to send

CISOs are skeptical by trade. Skip the fear. Skip the breach headlines. Lead with what you saw and a calm, specific guess.

Say a mid-sized healthcare technology company names a new CISO a few months after signing several large hospital customers, and it's posting for identity and access engineers.

You joined as CISO a few months after the company signed several large hospital customers, and the identity engineering roles suggest access is a near-term focus. Hospital buyers tend to bring long security questionnaires and audit rights with them. My guess is the team is answering those by hand and finding gaps in how access is granted and reviewed. Is that close, or is the bigger issue something else?

That note doesn't sell a product. It connects the public facts to the CISO's first 90 days, makes a guess and invites a correction.

Reach the committee and move early

The CISO is often the economic buyer for security work, but larger programs may need the CIO or CFO to sign. Find out who holds the budget.

Find the champion, often a security architect or a manager who's been pushing for the same fixes for years. Find the technical lead in IT or engineering who'll have to live with any change.

And look for a warm path first. Security leaders trust peers more than vendors. An intro from someone they've worked with will carry further than any cold note.

The review takes a quarter, give or take. After that, priorities are set and partners are chosen. Show up before the list is done.