What to expect from your vCISO in the first 100 days

Before the clock starts, agree on the job

The first 100 days will drift if the company has not defined why the vCISO is there.

One founder may expect help closing enterprise deals. The CTO may expect a technical security roadmap. Legal may need support with contracts and privacy obligations. The board may want a clearer view of risk. All of these needs can be valid, but they cannot quietly become four separate programmes.

Start with a short mandate. It should name the business outcomes that matter, the decisions the vCISO can make, the internal person responsible for coordinating the work, and the founders who will resolve tradeoffs.

The mandate does not need to be complicated. It needs to make one point clear: the vCISO is there to lead a security programme, not to become a remote owner for every security task.

Days 1 to 30: understand the business before prescribing controls

The first month should be spent learning how the company actually operates, not importing a standard checklist.

The vCISO should understand:

This work will involve conversations with founders, engineering, IT, legal, sales, customer success, and operations. It should also involve looking at the systems and evidence behind the answers. A policy saying access is reviewed is not the same as a working access review.

At the end of 30 days, the useful output is a concise view of the company: its important assets, obligations, material risks, urgent gaps, and decisions that require leadership attention.

It is not a hundred-page assessment. Founders should be able to read it and understand what could affect customers, revenue, operations, or the company itself.

• How the company makes money and which deals matter next.
• What customer and employee data the product handles.
• How the product is built, hosted, accessed, and supported.
• Which security and privacy promises already exist in contracts.
• Which compliance milestones are approaching.
• Where incidents, customer escalations, or recurring exceptions have already appeared.

Days 31 to 60: turn findings into decisions

The second month is where the vCISO should separate important work from merely visible work.

Most growing companies already have several security lists. Engineering has vulnerabilities. The audit team has evidence requests. Sales has customer questionnaires. Legal has contract commitments. IT has access and device issues. Treating each list as a separate priority creates constant competition.

The vCISO should combine them into one risk-based roadmap. Each priority should have an owner, a realistic date, and a reason it matters to the business.

This is also the point to make uncomfortable decisions visible. Some risks will need immediate action. Some can be accepted for a period. Some customer promises should stop until the company can support them. Some compliance work may be less urgent than a basic operational weakness.

By day 60, leadership should be able to answer three questions:

If the output is only a longer backlog, the company has documented its uncertainty rather than reduced it.

• What are we doing now?
• What have we deliberately deferred?
• Who accepted the risk of waiting?

Days 61 to 100: install the operating rhythm

The final stage is not about finishing security. It is about making sure progress no longer depends on the vCISO remembering every action.

The company should establish a small set of repeatable routines: a regular risk review, an owned security backlog, clear escalation for incidents and exceptions, and practical workflows for access, vendors, vulnerabilities, customer requests, and contractual commitments.

The rhythm should fit the company. A 50-person startup does not need the governance structure of a bank. It may need a fortnightly review with the CTO and operations lead, a monthly founder decision meeting, and a short quarterly update for the board.

The measures should be equally practical. Track whether important risks are moving, whether overdue actions have owners, whether access is being removed, whether critical vulnerabilities are being addressed, and whether customer promises match reality. Counting policies or completed training sessions alone will not show whether the programme works.

By day 100, there should also be a resourcing view. It should explain which work belongs with existing teams, which specialist help is required, and whether the next hire should be an engineer, a compliance operator, a privacy specialist, or a permanent security leader.

What founders should expect on day 100

A good first 100 days will not eliminate risk, complete every control, or produce a perfect compliance programme. It should leave the company with:

The most important change is simpler: security should be easier to discuss and harder to ignore.

If the company reaches day 100 with a polished document library but founders still cannot name the top risks, engineering does not know what comes first, and customer commitments are being made without review, the engagement has created activity rather than leadership.

The first 100 days are successful when the company is making better security decisions, work is moving without constant chasing, and the vCISO is building a system that will eventually need less dependence on them.

• A clear view of the risks that could materially affect the business.
• One prioritised roadmap connecting security, customer, and compliance work.
• Named internal owners for the actions that matter.
• A record of the decisions leadership has made.
• A working cadence for reviewing progress and new risks.
• A realistic plan for people, specialist support, and future hiring.