Briefing
Burn the risk register
A CISO’s first 90 days. Why successful CISOs map the P&L before they map the network, find the risks nobody has written down, and walk into the boardroom with evidence instead of opinion.
How to find the Shadow Risk Register your predecessor never wrote down
How to measure the gap between board confidence and engineering reality
How to prioritize for commercial impact, not CVE scores
A complete 90-day action plan and 12-month roadmap
Free download
The risk register you inherited isn’t the real one.
Most new CISOs walk in and start mapping the network, cataloging assets and reviewing policies. It feels productive, but it’s almost entirely beside the point. The inherited register is a compliance artifact, built to make leadership comfortable, not to show what’s actually keeping the sysadmins awake at night.
The CISOs who thrive in their first 90 days do it differently. They find the risks people talk about at the coffee machine, audit the culture as well as the controls, and speak to the board in commercial impact, not CVE scores.
Written by CovertSwarm founder and former CISO Anders Reeves with contributing CISOs, this guide breaks your first 90 days into three phases (understand, assess and validate, decide) and ends with a full action plan and 12-month roadmap.
The real risks aren’t written down.
The official register is well formatted, neatly categorized and fully owned. The real risks live in what people say in Slack DMs, after the call ends, or at the off-site.
That’s your Shadow Risk Register.
Look for the gaps between policy and practice, and for the Shadow CISOs: the developers and IT leads making real security decisions every day.
Co-opt them instead of fighting them, and one of your biggest risks becomes your biggest asset.
Evidence beats opinion.
When you’re new, bad news gets dismissed as pessimism. Month 2 is where you get objective evidence: a realistic offensive assessment, an actual backup restoration test, and social engineering tests against the people attackers target first.
“We have backups” isn’t “we can restore from backups.”
Test it under realistic conditions before an attacker does.
The board doesn’t care about CVE scores.
They care about revenue, reputation and whether the business can keep operating. Translate every finding into commercial impact and you’ll have their full attention.
The guide gives you a prioritization framework for when you can’t fix everything, and a delivery framework for presenting hard news without panic, blame or lost credibility.
Stop testing.
Start knowing.
You’ll know exactly where you stand, and you’ll be able to prove it. To your board, your regulator, and yourself.
Transform to a proactive, continuous offensive security programme
Your budget is aimed at the risk that matters, not the one you were handed
You show the board what security prevented, not a request for more
Security clears the way for the business to move faster
You enter the boardroom in command
It starts with a 30-minute Attack Discovery call.
No access to your systems required.