What a CISO's first 90 days look like: how new security leaders describe their early priorities

What these documents can and cannot tell you

This explainer draws on four primary documents: three company announcements of CISO appointments (Mitel on April 18, 2024; ABBYY on May 20, 2024; Flock Safety on December 8, 2025) and one question-and-answer profile of a CISO published by Luma Financial Technologies on June 24, 2026.

None of the four documents sets out a 90-day plan, a timeline or a list of first actions. They are announcements and a company interview. What they do show is what each employer and each new CISO chose to say publicly about the job. That is a statement of intent, not a record of what happened after the appointment. The sections below report those statements by company type and then compare them.

Business communications: Mitel

Mitel describes itself as a global business communications company. Its announcement is the most structural of the four. The release says Dunnion will oversee Mitel's information security strategy, security architecture, and security standards compliance.

The release describes his previous work in program terms. At Calian, the release says, he operationalized the program within the NIST framework and ensured compliance with ISO and SOC2 standards.

The company's Chief Information Officer, Jamshid Rezaei, frames the need around the products Mitel sells. He is quoted as saying that providing secure, reliable, and compliant digital tools, including communications and collaboration solutions, for employees, partners and customers is more crucial than ever.

Dunnion's own stated priority is integration. He says he is eager to work with the combined Mitel and Unify teams to provide a cohesive and comprehensive security program for all stakeholders.

AI software: ABBYY

ABBYY describes itself as a provider of purpose-built AI for intelligent automation. Its announcement ties the CISO's role to customer commitments. The company says Peddy will lead its infosec initiatives, ensuring ABBYY continues to maintain the highest standards of data protection, regulatory compliance, and innovation for its customers.

The release also links the appointment to product delivery. It says Peddy's appointment will accelerate the development and deployment of ABBYY's solutions. That is a different framing from Mitel's compliance and architecture language: security is presented as part of how the product ships.

Peddy's quoted priority is about where security sits in development. He says he wants security to remain not just a priority, but the driving force in the development of secure AI solutions.

Public safety technology: Flock Safety

Flock's announcement, dated December 8, 2025, focuses on scale, governance and public trust. The company says Castaldo will lead Flock's security strategy and partner across the organization to strengthen cybersecurity, risk management, and governance as the company scales its platform and customer footprint.

Founder and CEO Garrett Langley is quoted on what the hire is for. He says Castaldo will be an instrumental player in advancing the commitment to public trust, transparency, and responsible innovation.

The announcement leans on the new CISO's record in earlier CISO roles. It says he has served as CISO at Crossbeam, Dataminr, 2U, IronNet Cybersecurity, and Synchronoss Technologies. It also lists existing controls the new CISO inherits, including strict encryption standards, public disclosure and mitigation of vulnerabilities, and default multi-factor authentication for all users.

Castaldo's own quoted comment is about the mission rather than a task list. He says Flock is delivering real-world safety outcomes with a focus on privacy and data integrity.

Financial technology: Luma Financial Technologies

The Luma document differs in form. It is a first-person interview with Bryan Thompson, so it gives the clearest account of a new CISO's reasons for taking the job. He describes starting as a government contractor supporting the U.S. federal government.

On why he joined, Thompson contrasts how Luma treats security with a compliance-only view. He says he saw an organization valuing security as a business enabler rather than simply a compliance requirement.

His stated task is to keep the platform's defenses current. He says his role is to continuously enhance and strengthen the platform's security capabilities, so safeguards remain effective, adaptable, and resilient as threats change.

He also states a working method: partnerships with engineering, development and customer support so that security is embedded throughout the entire product lifecycle, not tacked on at the end. And he frames the work as continuous: security isn't a one-time achievement, he says, but an ongoing commitment.

How the stated priorities differ

Reading the four side by side, a few patterns show up in what is said. These are observations about the texts, not findings about the industry.

Themes that repeat. Customer trust, data protection and compliance appear in every document in some form. Each employer presents the CISO as someone who protects what customers rely on.

Where emphasis differs.

• Mitel's text is the most explicit about the CISO's formal remit: strategy, architecture and standards compliance, plus a single combined program after bringing teams together.
• ABBYY's text ties the CISO to AI product development and speed of delivery, and Peddy speaks of security as a driving force in building secure AI solutions.
• Flock's text stresses governance, risk management and public trust at a company that is scaling, and it names the controls already in place.
• Luma's interview stresses cultural position: security as a business enabler, built into engineering from the start, and kept current against changing threats.

Company type and priority. The documents line up with company type in the way the employers describe themselves. The communications vendor emphasizes a unified program and standards. The AI company emphasizes secure product development. The public safety technology company emphasizes trust and responsible use alongside growth. The financial technology company emphasizes embedding security in the product lifecycle. The documents do not state that company type causes these differences, and four examples cannot show a general rule.

Limits of the evidence

All four sources are written or approved by the hiring company. They are appointment communications and a company-published profile, so they present the role favorably and say little about constraints, budgets or reporting lines. They contain no outcomes, metrics or timeframes for any priority. For a profile built on sourced material, the safest reading is narrow: these are the public statements each company and CISO made at the time of the appointment, on April 18, 2024, May 20, 2024, December 8, 2025 and June 24, 2026.