A note on terms
Enterprise cyber risk management (ECRM) is how an organization manages cyber risks and opportunities that affect its business goals. An ECRM program puts that work into practice. Cybersecurity concerns protecting data, systems, and devices. These terms are related, but they are not interchangeable. I explain the distinctions in Chapter 4 and Appendix D of my book. [1]
A prospective customer may ask you to show how you protect its information or keep an important service running. Your answer can affect whether you win the business. ECRM helps leaders decide which customer needs to address, what to invest in, and who is responsible.
Since publishing Enterprise Cyber Risk Management as a Value Creator: Leverage Cybersecurity for Competitive Advantage in 2024, I have returned to the evidence to test a central question: can a strong, proactive ECRM program and cybersecurity strategy help create business value? Customer relationships are one place to look. [1]
What the book says
In Chapter 1, I connect customer trust and brand loyalty with revenue growth. I also discuss how showing customers evidence of strong cybersecurity can help open sales opportunities. Chapter 7 explains how to incorporate ECRM into business planning and give business leaders responsibility for the risks and opportunities involved. [1]
The newer evidence below helps us examine those ideas. The sources address security assurance and cybersecurity maturity. They do not evaluate an entire ECRM program as I define it in the book.
What Picarro reports
Picarro reports that independent checks of its security practices helped it close a European enterprise deal worth $10–$30 million. Its 2026 case, published by Constellation Research, links the deal to ISO 27001 certification and a SOC 2 Type 2 report, which provide independent evidence about its security practices. [2]
The business lesson is straightforward: a customer needed evidence about security before committing. Picarro says providing that evidence helped close the deal. The deal value and explanation come from the company; they have not been independently verified here. The $10–$30 million amount is contract value, not a measure of annual revenue, profit, or return on investment. [2]
What the customer study found
A 2026 study by Thomas Standaert, Tom Evens, and Petra Andries examined 1,573 public and private firms in Flanders, Belgium. Greater cybersecurity maturity was linked to the ability to attract and retain customers who place importance on cybersecurity. [3]
That finding supports looking at cybersecurity as a factor in customer relationships. It does not tell us how much every organization’s sales or retention will improve. The study focuses on specific firms in one region, and it does not establish a customer retention percentage you can apply to your business. [3]
How leaders can apply the evidence
Start with one group of customers. Ask your sales leaders, business owners, and cyber risk management team which requirements affect buying and renewal decisions. A customer might need an assurance report, an explanation of how you handle its data, or evidence that an important service can continue during a disruption.
Then identify a recurring problem. If sales are delayed while customers review your cybersecurity, record what they ask for, how long your responses take, and what remains unresolved. Agree on an improvement and measure whether it helps. This brings ECRM into a business decision with a clear owner and purpose.
Keep the measures honest. Passing a customer’s security review is different from signing a contract. Contract value is different from revenue and profit. Pricing, product quality, and other factors may still determine whether you win the business. Sales leaders should help confirm what the ECRM program and cybersecurity strategy contributed.
For existing customers, ask whether you are meeting the cyber risk management commitments that matter to them. Record why customers renew or leave. That gives you a stronger basis for judging the business benefit than relying on a general maturity score alone.
A practical next step
Choose one customer requirement, record where you stand today, and agree how you will judge progress. ECRM can help you connect that work to the organization’s goals. The evidence is getting stronger. Tracking your own results will help you judge whether this approach benefits your business.
Explore the supporting findings in the ECRM Evidence Hub. For more on putting these ideas into practice, explore the audiobook.
Sources
[1] Chaput, Bob. Enterprise Cyber Risk Management as a Value Creator: Leverage Cybersecurity for Competitive Advantage. Apress, 2024. Chapter 1, pp. 7–12; Chapter 4, pp. 110–113; Chapter 7, pp. 184–190; Appendix D. Explore the book in all formats
[2] Constellation Research. Picarro, Inc. 2026 SuperNova Awards case. Company-reported outcome. Read the Picarro case
[3] Standaert, Thomas, Tom Evens, and Petra Andries. Cybersecurity maturity of Flemish firms: drivers and consequences. Computers & Security, 165, 104868, 2026. Read the customer study • Ghent University publication record