A note on terms
Enterprise cyber risk management (ECRM) is how an organization manages cyber risks and opportunities that affect its business goals. An ECRM program puts that work into practice. Cybersecurity concerns the protection of data, systems, and devices. These terms are related, but they are not interchangeable. I explain the distinctions in Chapter 4 and Appendix D of my book. [1]
If a cyber incident stops an important service, your organization may lose sales, miss customer commitments, or delay essential work. Business resilience means preparing for disruption, adapting, and recovering. ECRM helps leaders decide which operations matter most and what is needed to keep them running or restore them.
Since publishing Enterprise Cyber Risk Management as a Value Creator: Leverage Cybersecurity for Competitive Advantage in 2024, I have returned to the evidence to test whether a strong, proactive ECRM program and cybersecurity strategy can help create business value. Resilience is one place to look: maintaining important services helps preserve revenue and customer relationships. [1]
What the book says
In Chapter 1, I explain how operational continuity and resilience can create business value by preserving revenue and enabling an organization to keep serving customers. I recommend using ECRM to identify strategically important operations. Chapter 6 emphasizes executive leadership and the involvement of business owners. Those leaders need a place in decisions about preparing for disruption and recovering from it. [1]
An incident response exercise gives them a chance to practice those decisions. The evidence below concerns cybersecurity practices and incident outcomes. It does not evaluate a complete ECRM program as I define it in the book.
What Marsh found
Marsh McLennan’s August 2025 public release describes research that compared organizations’ cybersecurity self-assessments with insurance claims. Organizations that regularly ran tabletop exercises and scenario-based breach response drills were 13% less likely to experience a material cyber event than those that did not. A tabletop exercise is a guided discussion in which participants work through a simulated incident and decide how to respond. [2]
The 13% is a relative difference between the groups. It does not mean 13 fewer incidents per 100 organizations, 13% smaller losses, or a promised reduction in insurance premiums. The comparison does not prove that exercises alone caused the difference; other practices may also matter. The public release does not provide the full methods or a complete definition of a material cyber event. [2]
Make the exercise about the business
My recommendation is to start with one important service. Involve its business owner, operations staff, risk analysts, cybersecurity team, and others responsible for the decisions being tested. Ask what happens to customers and the business if the service becomes unavailable.
For example, imagine your ordering system is unavailable and the cause is still unclear. Who can authorize another way to take orders? How long can that process work? Who tells customers what is happening? Who decides when the system can safely return to use? These questions connect the exercise to business results.
ECRM helps leaders decide which risks need attention and which improvements deserve funding. Practicing together can reveal unclear responsibilities, missing information, and assumptions about recovery that need to be tested.
Use the findings to improve readiness
Record the decisions participants could not make and the gaps that prevented them from acting. Give each significant issue an owner and agree how it will be fixed. Then test the change in a later exercise. A completed exercise is a starting point for improvement.
Measure whether the important gaps have been resolved and whether people can make the decisions the service requires. Compare the recovery time assumed in the exercise with the time the business can tolerate being without the service. Ask what evidence supports that estimate and what needs further testing. If there is a gap, leaders need to decide what to change.
Explain the business benefit in terms you can support. Show which decisions became clearer, which recovery problems were addressed, and what still needs work. Marsh’s percentage cannot tell you how much revenue your organization will preserve or what financial return an exercise will produce.
A practical next step
Choose one important service and one realistic disruption. Run an exercise with the people who own the business decisions, agree on the improvements, and test them. This puts ECRM into practice with a clear business purpose.
The evidence is getting stronger. Tracking your own results will help you judge whether exercises improve your ability to keep serving customers and recover when something goes wrong.
Explore the supporting findings in the ECRM Evidence Hub. For more on putting these ideas into practice, explore the audiobook.
Sources
[1] Chaput, Bob. Enterprise Cyber Risk Management as a Value Creator: Leverage Cybersecurity for Competitive Advantage. Apress, 2024. Chapter 1, pp. 16–17; Chapter 4, pp. 110–113; Chapter 6, pp. 162–166; Appendix D. Explore the book in all formats
[2] Marsh McLennan. Cyber Risk Intelligence Center report. Public release summarizing Cybersecurity signals: Connecting controls and incident outcomes. 27 August 2025. Read the Marsh release