What was the question?
Where do we act first? A pharmaceutical company has complex infrastructure, data that competitors and criminals both want, and a supply chain that circles the world. Without central detection an attack can go unnoticed for days. Nine areas of risk ask for attention at the same time, and a board cannot fund nine things at once. The honest answer to “where first” needs a map, not a list of products. Darker tiles are readier. The roadmap starts at the lowest score and the highest risk, most often identity and access.
How does the programme work?
It runs in five phases that form one continuous loop. First I look at the posture in three layers: what faces the internet, with its attack surface, open services and known flaws; the network inside, with its asset inventory, misconfigurations and how far an intruder could move; and the applications, with static and dynamic analysis, dependency scanning, a review of logins and permissions, and OWASP Top 10 coverage. Then I compare what I found with ISO 27001, GDPR and PCI DSS, which gives a list of gaps with a name and a date on each.
From that list I draw the roadmap, ordering the work into phases by how critical each piece is and what depends on what. Then the changes are made, phase by phase, with progress checked at each gate. And the programme keeps improving after the first results, with audits, because a posture is not a state but a direction.
Each of the nine pillars gets a readiness score: risk management, data protection and privacy, governance and compliance, threat detection and response, network security, identity and access, application security, cloud security, endpoint security. The roadmap starts where the score is lowest and the risk is highest. In practice that usually means multi-factor login, role-based access and privileged access first, then a risk register, central detection and a round-the-clock SOC with an incident plan, then data classification, encryption and zero-trust networking.
What does it give leadership?
A plan with a reason for every line. Every workstream is tied to a business goal. The rollout is phased so operations never stop. Each gate has named deliverables and numbers to meet, so a steering committee can see progress without reading a single log. And when something specific is on fire, the same team helps with that too: removing injected gambling scripts and redirects from web assets with a full database clean-up, clearing false reputation flags on files and domains, hardening Linux servers to CIS benchmarks.