New CISO
A new CISO joins. First 90 days = listening tour. Days 90–180 = strategy. Day 180+ = budget decisions on what gets kept, killed, or replaced.
Everything is open. Incumbent vendors lose their default. Vendors who get an early audience with the new CISO during the listening tour shape the strategy they will then sell against.
Consolidation or platformisation. The new CISO wants fewer vendors, clearer architecture, defensible board reporting. Often arrives with a thesis from their last job.
Days 90–270 from the CISO's start date. After 12 months the architecture is set and the window narrows to specific refresh cycles.
Pitching the technical capability before understanding the new CISO's thesis. The CISO is buying a story they can sell to their board — not a product. Lead with how this fits their narrative, not yours.