Imagine you are just starting your security program with no legacy systems, no technical debt, and a clean slate. What would a modern, defensible security program actually look like? We will discuss what we need to focus on in the first 90 days? What critical controls and quick wins can we get? Do we buy or build a service? Along the way, we will determine some trade-offs between people, process, and technology—and confront what they would stop doing if starting over.