By Andreas Pettersson, Founder, Leaders ADAPT
On the first morning of a technology engagement I ask the owner for one thing. A list of every account that has administrator rights over the company, and whose name is on each one. Nobody has ever handed it to me on day one. Usually the owner calls the IT person, the IT person sends a partial list, and somewhere on it is a domain registered to a developer who left in 2019.
That missing list is where the first quarter starts. A fractional CTO first 90 days should produce four written registers the company did not have before: a systems inventory, a vendor ledger, an access list with security basics in place, and a one page AI decision. Not a strategy deck. Not a new platform. Four documents the owner can open, read and test without the CTO in the room.
Quick answer: A fractional CTO first 90 days builds four registers. The systems inventory lists every system and its owner of record by about day 30. The vendor ledger lists every contract and cancels the waste by day 60. The access list switches on five security basics by day 75. The AI decision memo says build, buy or wait by day 90. Each one gets tested at the day 90 review.
Leaders ADAPT places a fractional CTO from its own bench and stays accountable for the engagement, priced as a fixed monthly fee quoted after the first call. Every statistic below comes from the organisation that published it, linked, with the month I read it. Where their page now says something different, trust their page. No source named here is paid by us or pays us.
Four registers, not a roadmap
At Arcules, which grew past 150 people across three continents before Canon bought it, the technology seat was mine for a while along with the CEO and finance seats. The lesson I took from that time is simple. A technology roadmap written before you know what you own is fiction with dates on it.
So I ask a fractional CTO to work in registers instead of phases. A register is a living document with one row per thing, an owner per row, and a column that says what happens next. The four overlap in time. The inventory starts first because the others depend on it, but the vendor ledger begins filling in during week two, and the security work cannot wait for a finished list if the inventory turns up an open door.
| Register | What one row holds | Usable by | The owner's test |
|---|---|---|---|
| Systems inventory | A system, its owner of record, its business owner, what depends on it | About day 30 | Name any system and get its owner of record in under a minute |
| Vendor ledger | A contract, its renewal date, notice window, annual cost, keep or cancel | About day 60 | Every renewal in the next six months has a decision next to it |
| Access list | An admin account, the person behind it, MFA status, last review | About day 75 | Someone other than the IT person restores a file from backup |
| AI decision memo | One problem, the data it needs, build, buy or wait, owner, date | Day 90 | You can say what the company will not do with AI this year |
The dates are targets, not promises. A company with 40 systems and one office moves faster than a company with 140 systems and a warehouse in another state. What should not change is the order of the tests.
Register one: the systems inventory
The inventory is boring and it is the most valuable thing the first quarter produces. Every later decision reads from it.
A good fractional CTO builds it from three directions at once. Top down, by interviewing each department head for 30 minutes about what they log into every week. Bottom up, by reading the company card statements and the accounts payable file for the last twelve months, because every subscription leaves a charge. And from the inside, by logging into the email admin console and the identity provider and listing every connected app.
The three lists never match. The gap between them is the finding.
Each row gets five columns. The system. The owner of record, meaning whose name or email the account sits under. The business owner, the person who decides whether the company still needs it. What depends on it. And what happens on the morning it stops working. That last column turns a spreadsheet into a risk map. Payroll, the customer database and email will be on top. A design tool one person uses will be at the bottom.
The column owners skip and should not is owner of record. In owner led companies a surprising share of critical accounts sit in a personal name: the domain, the cloud account, the bank integration, the app store listing. Each of those is a single resignation away from a problem, and our page on key person risk explains why a buyer reads it as a price question. Moving those accounts into company control is usually the first real change the CTO makes, and it often happens before day 30.
Zylo's 2025 index found lines of business now account for 70% of SaaS spend, while IT is responsible for just 26.1% (Zylo, January 2025, read October 2026). Their sample skews toward larger companies. The pattern is the same in a $15M business, and it is why the inventory cannot be built by asking only the IT provider. They do not know about half of it.
Register two: the vendor ledger and the cleanup
Once the inventory exists, the vendor ledger is a sort and a phone call away. Every row from the inventory that costs money gets a contract line: annual cost, renewal date, notice window, who signed it, and whether it renews automatically.
Then the fractional CTO sorts it into four piles.
Cancel. Duplicates, tools nobody has logged into for 90 days, seats for people who left. Most first quarters find a handful of these. The CTO drafts the cancellation and the owner signs it inside a week.
Consolidate. Two tools doing one job, usually because two departments bought separately. One survives. The department that loses its tool will push back, which is why the owner has to sign this pile and not the CTO.
Renegotiate. Contracts that are needed but overpriced or overbuilt. These go into a calendar keyed to the notice window, not the renewal date. Most vendors want notice 30 to 90 days before renewal, and a missed window means another year at the old terms.
Keep and watch. Everything else, with a named business owner who reviews it before the next renewal.
Zylo reports that SaaS spend now averages $4,830 per employee, a 21.9% increase year over year (Zylo, January 2025, read October 2026). I do not quote that number to scare anyone. I quote it because most owners I ask guess a figure well under it, and the ledger is the first time they see their own number.
The cleanup is also a security job. Verizon's 2025 report found that third party involvement in breaches has doubled to 30% (Verizon, April 2025, read October 2026). Every vendor you cancel is one less outside party holding your data. The ledger gets a column for that too: does this vendor hold customer or employee data, and do we have their security terms on file.
The fractional CTO does not replace the IT provider in this quarter. The provider knows things the inventory still needs. The CTO rewrites the provider's scope instead, in writing, with response times and a handover clause, and leaves the bigger decision for after day 90.
Register three: the access list and five security basics
The third register answers one question. Who can get in, and what stops the wrong person.
Verizon lists credential abuse (22%) as one of the leading ways attackers first get into a company (Verizon, April 2025, read October 2026). For a company of 40 to 300 people, that is the threat model in one line. Not a nation state. A stolen password on an account nobody watches.
The access list starts from the inventory. Every system with an admin role gets a row for each admin, the person behind the account, whether multifactor authentication is on, and when anyone last checked. Former employees and old contractors come off first. Shared admin logins get split into named accounts.
Then five basics, in this order.
- Multifactor authentication on email, finance, cloud and every admin account. CISA's guidance says the use of MFA on your accounts makes you 99% less likely to be hacked (CISA, read October 2026). It is the cheapest control on this list.
- Backups that have been restored. A scheduled backup is a hope. A restored file, done by someone other than the person who set it up, is a fact.
- Admin rights in company accounts, held by at least two named people, stored in a company password manager.
- A customer data map, one page, saying where customer data lives and who can reach it.
- A first hour plan. One page. Who gets called, in what order, with phone numbers, if email is compromised or files are encrypted.
For anyone who wants a frame around this, NIST publishes a small business quick start guide to its Cybersecurity Framework 2.0, written for organisations with modest or no cybersecurity plans (NIST SP 1300, February 2024, read October 2026). It is free, and it is a better starting point than a 60 page policy pack from a vendor. A fractional CTO uses it as a checklist, not a project.
Register four: the AI decision memo
Almost every owner who brings in a technology leader this year has an AI question sitting on the desk. A sales lead wants an assistant. A vendor is pitching a platform. Someone ran a pilot that worked in a demo and stopped there.
The fractional CTO does not answer it by running more pilots. They write one memo, one page, by day 90.
The memo names one business problem, stated as hours or money, such as quotes that take two days to produce. It lists the data the problem needs and whether that data is clean, in one place and owned, which the inventory has already answered. It sets out three options: buy a tool that exists, build something on the company's own data, or wait until the data is ready. It names what each option costs in money and in someone's time. And it ends with a decision, an owner and a review date.
For a company between $5M and $50M the answer is buy or wait far more often than build. Build makes sense when the company's own data is the advantage and someone inside can own the result after the CTO leaves.
The memo also has a second half, a short usage rule. Which tools staff may use, what may never be pasted into them, and who approves a new one. IBM's 2025 breach research found that about one in five organisations reported a breach due to shadow AI, and that 63% of breached organisations either lacked an AI governance policy or were still developing one (IBM, July 2025, read October 2026). A one page rule in month three is the cheapest answer to that number.
If you want to know before day one whether your gap is data, people or leadership, the free AI readiness assessment on this site takes about ten minutes.
Where AI fits in a fractional CTO first 90 days
AI is the subject of register four. It is also a tool for building the other three.
In the inventory, an AI assistant can read twelve months of card statements and payables exports and draft the first list of subscriptions in an afternoon. The CTO still checks every line, because the useful part is the owner of record, and no statement shows that.
In the vendor ledger, a model can read a stack of contracts and pull out renewal dates, notice windows and auto renew clauses into one table. A person signs off the table before anything gets cancelled.
In the access list, the identity provider and the email console already flag accounts without MFA and logins from odd places. The CTO turns those flags into a weekly five minute check that someone other than the CTO owns.
For companies running EOS, our AI for EOS companies guide shows where the registers can feed the scorecard and the quarterly rocks. What stays with people is the judgment on each row. Which vendor to cancel when a department head disagrees. Whether a contractor keeps admin rights. Whether the AI memo says build or wait. Our page on what not to delegate to AI is the longer list.
What a fractional CTO first 90 days does not fix
It does not fix a leadership team that cannot agree on what matters. If sales, operations and finance each want a different system first, the registers will show the conflict in plain rows, and the CTO will spend the quarter refereeing. That is a leadership team development problem, and it sometimes has to start in parallel.
It does not fix an owner who will not sign. Every pile in the vendor ledger and every row in the access list ends in a decision. If those decisions wait three weeks for a signature, the quarter runs out before the registers turn into change.
It does not rebuild the product or migrate the core system. Ninety days is enough to know what you have, stop paying for what you do not use, close the obvious doors and make one AI decision. A platform replacement is a project for the quarters after, planned from the registers.
It does not decide whether you need a full time technology leader. That is a separate conversation, and the registers make it easier to have, because by day 90 you can see how much of the work is weekly and how much is daily. The fractional CTO guide covers the seat itself, and fractional CTO cost covers the money.
Who is on the bench for this
Sergey Dmitriev is the fractional CTO and AI systems partner on the Leaders ADAPT bench. Sergey builds and runs the AI and data work Leaders ADAPT delivers, including digital twin and company knowledge systems, and trains leadership teams on AI tools with me. In a first quarter that means the inventory and the AI memo are written by the same person who would build the system if the memo says build, so nobody recommends a project they will not have to deliver.
Thor Legvold is the leadership psychologist on the bench. When the registers show that the real risk is one person, the long serving IT lead who holds everything, Thor runs the fit read on whether that person can grow into a bigger role or needs a different one.
Every engagement runs through Leaders ADAPT. I take the first call, match the partner, agree the day 90 review date with you, and stay in the room. The full bench is on the fractional executive services page, and the engagement shapes are on Fractional Executives and Advisory. If the seat is lighter than a few days a week, the CTO advisor shape may fit better. And if your desk is crowded with operating decisions rather than technology ones, the fractional COO first 90 days is the closer read.
Fractional CTO first 90 days FAQ
What should a fractional CTO deliver in the first 90 days?
Four written registers. A systems inventory that lists every system, its owner of record and what breaks if it stops. A vendor ledger with renewal dates and a list of what gets cancelled. An access list with five security basics switched on. And a one page AI decision memo that says build, buy or wait, with a named owner and a date.
How many days a week does a fractional CTO work in the first 90 days?
Most first quarters run one to two days a week. The first month is heavier because the inventory needs interviews with every department and a look inside every admin console. After the registers exist, the work shifts to decisions and follow through, and the time often drops. If the clean up fills four days every week, the company has a bigger technology problem than a quarter.
Should a fractional CTO replace our IT provider in the first 90 days?
Almost never in the first quarter. The provider holds knowledge the inventory needs, and firing them before it is written down moves the risk rather than removing it. The fractional CTO rewrites the provider's scope instead, with clear duties, response times and handover terms. A replacement decision, if one is needed, comes after day 90 with the facts on paper.
What security basics should be in place after 90 days?
Five. Multifactor authentication on email, finance, cloud and every admin account. Backups that someone has restored in a test, not only scheduled. Admin rights held by named company accounts, with former staff and contractors removed. A written list of who can reach customer data. And a one page plan for the first hour of an incident, with phone numbers.
How does a fractional CTO decide on AI in the first 90 days?
By writing one memo, not by running five pilots. The memo names a single business problem, the data it needs, whether that data is clean enough today, what the company would buy, what it would build and what waiting costs. It ends with a decision, an owner and a review date. Most companies under $50M land on buy or wait.
How do I know if a fractional CTO first 90 days worked?
Run four tests on day 90. Ask for any system and get its owner of record in under a minute. Point to every renewal in the next six months with a decision next to it. Watch someone other than the IT person restore a file from backup. And read the AI memo and know what the company will and will not do with AI this year.
What does the owner have to do during a fractional CTO first 90 days?
Three things. Give the CTO admin access on day one, including the accounts that sit in personal names. Sign the decisions the registers produce within a week, especially cancellations that a department head will resist. And protect one hour every two weeks to review the registers together, because the owner is usually the last person who knows where some of the passwords went.
The day 90 review, and the list you can start tonight
The review is two hours, the owner and the CTO, with the four registers open. Run the four tests from the table at the top. Any test that fails becomes a dated item for the next quarter. Any that passes gets a named owner who keeps the register current, because a register that nobody updates is out of date by the next renewal.
You can start before anyone arrives. Tonight, write down every account that controls the company: domain, email admin, cloud, banking integrations, website, accounting. Next to each, write whose name it is in. If any line has a person's name instead of a company account, you have found the first row of register one.
What the first conversation looks like
You get 30 minutes with me, not with a salesperson. Bring your list of admin accounts, even if it has gaps, and the name of the AI idea that keeps coming back to your desk. I tell you which register looks most urgent, whether the first 90 days should open with the inventory or with security, and whether Sergey is the right partner or a lighter advisory hour is enough.
If we go ahead, Sergey joins the second call. We agree the days per week, the four registers and the day 90 review date in writing. The fee is fixed monthly and quoted after that call.
Your step for tomorrow morning: take the free assessments, which show me how leadership and AI readiness look from the inside before we talk technology. Then book a fit conversation.
