A note on terms
Enterprise cyber risk management (ECRM) is how an organization manages cyber risks and opportunities that affect its business goals. An ECRM program puts that work into practice. Cybersecurity concerns protecting data, systems, and devices. These terms are related, but they are not interchangeable. I explain the distinctions in Chapter 4 and Appendix D of my book. [1]
When your business needs a new digital service or an improvement to an existing one, speed matters. So does the ability to deliver a service that customers can use safely and reliably. ECRM helps leaders consider those goals together and make informed decisions about the risks involved.
Since publishing Enterprise Cyber Risk Management as a Value Creator: Leverage Cybersecurity for Competitive Advantage in 2024, I have returned to the evidence to test whether a strong, proactive ECRM program and cybersecurity strategy can help create business value. Carrefour offers an example of building security into software delivery and, therefore, enabling innovation, a value creator.
What the book says
In Chapter 1, I discuss how a strong ECRM program and cybersecurity strategy can give an organization confidence to pursue digital transformation and innovation. Chapter 7 explains how to incorporate ECRM into business planning, funding, and decisions about new initiatives. The people responsible for business results also need responsibility for the associated cyber risks and opportunities. [1]
For a software project, that means considering cyber risks when deciding what to build and how to deliver it. The example below helps us examine that idea. It describes changes in software delivery and cybersecurity; it does not evaluate a complete ECRM program as I define it in the book.
What Carrefour reports
GitLab’s customer case reports that Carrefour cut the time from a business request to software going live in half for teams that release software regularly, including e-commerce. Releases moved from monthly to daily. The case also reports about 25% fewer production incidents and more than $350,000 in annual savings on security tools. [2]
These results came from a broader change called DevSecOps: bringing software development, security, and operations into a shared way of working. Carrefour also combined tools, automated work, and changed its processes. The case does not show how much of each improvement came from cybersecurity alone. GitLab publishes the account as a customer case; it has no stated publication date. [2]
Bring risk decisions into the project early
My recommendation is to involve business owners, developers, risk analysts, and cybersecurity staff early in a project. Ask what customers need, what could go wrong, and which safeguards are appropriate. Agree who can make decisions when delivery goals and risk concerns pull in different directions.
For example, a team developing an online ordering feature should consider how customer information will be handled and what happens if the service fails. Identifying those questions during design gives the team a chance to address them before the software is ready to launch. ECRM connects those choices to the business objective and the level of risk leaders are prepared to accept.
Measure more than speed
Record how long it takes to turn an approved business request into working software. Also track post-release failures, serious security weaknesses that remain unresolved, and rework caused by late-discovered requirements or cyber risks. Faster delivery is more useful when the service also meets customer needs.
Business owners, developers, and cyber risk management leaders should agree on the measures. Installing a tool does not establish that delivery improved. Releasing software more often does not establish that customers received more value.
Keep financial results separate. Savings on security tools, time available for other work, and increased sales are different benefits. Compare costs with what you spent before the change. Use evidence from the business team when claiming that a software improvement helped generate revenue.
A practical next step
Choose one project where delays have a clear business consequence. Review the steps from the original request to release, including where cyber risk decisions are made. Identify one avoidable delay or repeated task, agree on a change, and track the result.
Carrefour’s case gives leaders a reason to examine how cybersecurity fits into software delivery. Applying ECRM to your own project can help you judge whether changes support innovation while keeping the risks within limits your organization accepts.
Explore the supporting findings in the ECRM Evidence Hub. For more on putting these ideas into practice, explore the audiobook.
Sources
[1] Chaput, Bob. Enterprise Cyber Risk Management as a Value Creator: Leverage Cybersecurity for Competitive Advantage. Apress, 2024. Chapter 1, pp. 12–13; Chapter 4, pp. 110–113; Chapter 7, pp. 188–190; Appendix D. Explore the book in all formats
[2] GitLab. How Carrefour Cut Time to Market in Half with GitLab. Undated customer case published by the software vendor. See “Turning software improvements into retail-ready results.” Read the Carrefour case