A Fractional CTO’s First Ninety Days

When you walk into a system you didn’t build, the first thing to understand is that nothing is actually missing. The cloud doesn’t eliminate responsibility; it just moves it around. Servers still fail. Networks still partition. Data still leaks if you let it. People still make assumptions. What’s changed is how those realities show up: as permissions instead of locks, dashboards instead of blinking lights, invoices instead of power bills.

Your role isn’t to rewrite everything in your favorite stack, prove you’re smarter than whoever came before you, or ship features just to show momentum. Your job is quieter and more important than that. You are there to understand how responsibility actually flows through the system, to prevent costly mistakes before they turn into incidents, to give the team confidence that the foundation is solid, and to make sure the system can adapt as the business grows instead of locking itself into brittle decisions.

On the first day, resist the urge to “get hands-on” immediately. There’s no single server to log into that explains everything. Instead, approach the environment the way you would a facility you’re being asked to take responsibility for. Start with identity and access, because that tells you who can change what. Look at the network, because that shows where trust boundaries live. Look at what’s running right now, because that’s the actual system, not the diagram. Look at monitoring and logs, because that’s how the system tells you when it’s stressed. And look at billing, because costs reveal usage patterns and hidden assumptions faster than architecture decks ever will.

You’re not there to click buttons. You’re there to understand where things would fail if they went wrong.

Early conversations with the team matter more than technical deep dives. It helps to say out loud that you may be new to this specific stack, but you’re not new to operating systems in production. You’ll ask basic questions about failure modes, boundaries, and data flow not because you doubt their competence, but because that’s how you reduce risk later. Framed this way, those questions feel like protection rather than critique, and most teams respond with relief.

The questions you ask in the first few weeks are deceptively simple. What has to be true before we ship? What happens if a key vendor changes pricing or availability? Where does sensitive data actually move, and who can see it? Which parts of this system are fragile, and which ones can absorb stress? What worries you most about running this a year from now?

What you’re really doing is building a mental model. Can the system still evolve, or has it become rigid? Where does responsibility change hands between components or teams? What do we truly control, and what are we relying on external promises for? If something breaks, does the impact stay contained, or does it cascade? And are there critical decisions or knowledge living only in people’s heads, where they can’t be reviewed or audited?

That same mindset applies to your own setup. Your laptop isn’t where production runs. It’s where understanding lives. It should let you inspect and reason about the system without becoming a security liability. If losing your laptop would trigger a major incident, the architecture already has a problem. Favor tools that make the system clearer, even if they slow you down a bit. Speed without understanding creates hidden risk.

As you dig into the inherited stack, it helps to stop thinking in terms of technologies and start thinking in terms of hand-offs. Every time data moves from the UI into an API, from one service into another, from a database into a stream, responsibility shifts. Those boundaries are where bugs, outages, and compliance issues tend to surface. Managed services don’t remove that responsibility; they just handle the undifferentiated work. You’re still accountable for schema design, access control, data integrity, and the ability to explain later what happened and why.

AI fits into this same frame. An AI copilot isn’t a decision-maker; it’s an advisor that can be very helpful and very wrong. That’s not a philosophical claim, it’s an operational one. Sensitive data needs to remain under your control. Model behavior is something you depend on, not something you own. Inference results and overrides need to be logged so you can audit and improve over time. And if the AI is unavailable or produces bad output, the system needs to continue operating in a degraded but safe mode.

Over time, a strategy takes shape. You fully own the things that determine whether the business can operate tomorrow: core data, critical workflows, access control, and billing. You rent the parts that handle variability: burst capacity, analytics, geographic reach, experimental features. External services can amplify your capabilities, but they shouldn’t be single points of failure. The goal is a stable, understandable core with flexible edges, and a clear view of what can break without taking the company down.

This is also where restraint matters. Many systems fail not because of bad intentions, but because decisions get locked in too early. Hard-coding workflows before they’re well understood, optimizing tightly around current regulations, assuming automation can replace human judgment, or rewriting systems before learning how they’re actually used , all of these feel decisive, but they reduce flexibility. A resilient system enforces a few critical constraints for safety, while leaving room to learn and adjust as reality changes.

The first ninety days aren’t about dramatic interventions. Early on, you focus on seeing clearly and documenting honestly, so the system feels understood rather than judged. Then you help put basic governance in place: how decisions get made, what security guarantees are non-negotiable, how incidents are handled, how sensitive data is treated. After that, you enable the team , unblocking hard problems, guiding architectural choices, helping them ship what matters without creating invisible debt. Finally, you look ahead at scale: what breaks at two, five, or ten times the load, and what investments prevent painful rewrites later.

If you do this well, success is mostly invisible. The team trusts you and brings you the problems they can’t solve alone. The system is legible, with known risks and deliberate trade-offs. The product launches without drama. At least one expensive mistake never happens because you caught it early. And you’re not a bottleneck , good decisions get made even when you’re not in the room.

At a deeper level, your role is closer to infrastructure than heroics. You help the organization see clearly, think ahead, and avoid self-inflicted wounds. You take responsibility seriously without making it about yourself. You avoid premature closure, stay curious longer than feels comfortable, and leave the system stronger and more understandable than you found it.

After ninety days, “good enough” isn’t perfection. It’s a system that can grow without breaking, a team that feels supported, and a leadership group that trusts the technical foundation. You didn’t rewrite everything. You didn’t prove you were the smartest person in the room. You helped make the system understandable , and once that happens, change becomes possible without fear.