ECRM Evidence
The Evidence Is Getting Stronger
Current academic and commercial research continues to test how cybersecurity practices can
support business results. This Hub examines what those findings mean for enterprise cyber risk
management.
Last updated:
October 2026
OUR EVIDENCE STANDARD
We highlight credible research and real-world examples from academic, industry and government sources. Each item includes key results, source details and, where available, a methodological note.
Customer & Market
Increase trust, unlock revenue growth, and improve customer outcomes.
Load More →
Customer & Market Value
Cybersecurity maturity is linked to customer relationships
A study of firms in Flanders, Belgium, links cybersecurity maturity with attracting and retaining customers who value cybersecurity. It does not establish a sales increase or retention percentage that other organizations can assume. [4]
Prominent Result
Stronger ability to attract and retain customers who care about cybersecurity
Source: Computers & Security • Peer-reviewed study • 2026
Customer & Market Value, Featured Evidence
Security assurance can help earn customer business
Picarro says independent checks of its security practices helped it meet a customer’s requirements and close an enterprise deal. The outcome is company-reported; independent security assurance does not verify the deal value. [1]
Prominent Result
$10–$30 million enterprise deal reported by Picarro.
Source: Constellation Research • Company-reported case • 2026
Related Articles
Innovation
Enable new ideas, new products and greater agility.
Load More →
Innovation Value, Featured Evidence
Security can support faster software delivery
Carrefour reports faster software delivery after bringing development, security, and operations together. The improvements came from a broader transformation; the vendor-published case does not isolate cybersecurity’s contribution. [2]
Prominent Result
50% shorter request-to-production time reported by Carrefour
Source: GitLab • Vendor-published customer case • Undated
Related Articles
Resilience
Build adaptability and withstand disruption.
Load More →
Resilience Value
Response exercises are linked to fewer material cyber events
Marsh links regular tabletop exercises and breach-response drills with a lower likelihood of a material cyber event. This is an observational comparison; it does not prove that exercises alone caused the difference. [6]
Prominent Result
13%lower likelihood of a material cyber event among organizations running regular exercises
Source: Marsh McLennan • Claims-linked observational analysis • 2025
Related Articles
Capital & Transactions
Increase enterprise value and reduce transaction risk.
Load More →
Capital & Transactions Value, Featured Evidence
Cybersecurity disclosures are linked to lower financing costs
A study of U.S. public firms links informative cybersecurity investment disclosures with lower financing costs. The findings concern disclosure supported by actual investment; they do not promise a financing benefit for every organization. [3]
Prominent Result
Lower debt, equity, and overall capital costs associated with investment disclosure
Source: Information Systems Research • Peer-reviewed study • 2026
Related Articles
Enterprise & Stakeholder
Create broader value for all stakeholders.
Load More →
Enterprise & Stakeholder Value
Cybersecurity requirements can determine contract eligibility
For covered U.S. defense opportunities, contractors must hold the CMMC status required by the solicitation. Meeting that requirement enables eligibility; it does not guarantee an award or increased revenue. [7]
Prominent Result
Required CMMC status is a condition of award eligibility for covered opportunities
Source: Acquisition.gov and Department CIO • Official procurement policy and guidance • Status checked 13 October 2026
Related Articles
New Audiobook
The same insights.
Now in audiobook.
Enterprise Cyber Risk Management as a Value Creator is now available in audiobook format. Hear Bob Chaput’s insights on how cybersecurity can do more than protect value, it can help create it.
Available on
Executive Research Brief
The Business Value of Cybersecurity: What the Evidence Now Shows
A concise review of the latest academic and commercial research on how cybersecurity influences business outcomes across the five value themes.
Want the complete ECRM framework?
Explore the book or listen to the audiobook to see how the pieces fit together.