A note on terms
Enterprise cyber risk management (ECRM) is how an organization manages cyber risks and opportunities that affect its business goals. An ECRM program puts that work into practice. Cybersecurity concerns the protection of data, systems, and devices. These terms are related, but they are not interchangeable. I explain the distinctions in Chapter 4 and Appendix D of my book. [1]
Your organization may need financing to expand, develop a new product, or improve an important service. Lenders charge interest, and investors expect a return for providing money. The cost of capital is the cost of obtaining that funding. How they view your business risks can affect the terms they offer. Credit- rating agencies—including Standard and Poor’s (S&P), Moody’s, and Fitch Group—have all implemented consideration of the financial impact of a cyberattack on an organization’s credit rating. [1]
Credit-rating agencies, including S&P Global Ratings, Moody’s Ratings, and Fitch Ratings, consider cyber risk in their credit analysis. That makes your organization’s ability to explain how it manages these risks relevant to financing discussions. [2–4]
Since publishing Enterprise Cyber Risk Management as a Value Creator: Leverage Cybersecurity for Competitive Advantage in 2024, I have returned to the evidence to test whether a strong, proactive ECRM program and cybersecurity strategy can help create business value. Financing costs are one place to look. [1]
What the book says
In Chapter 1, I discuss lower capital costs as a potential benefit of a strong ECRM program. I also discuss attracting investment. Chapter 7 explains how to incorporate ECRM into business strategy, financial planning, and decisions about where to invest. Those connections make financing a business issue for finance leaders, business owners, and the cyber risk management team to examine together. [1]
The newer study below addresses one part of that proposition: telling investors about cybersecurity investments. It does not evaluate a complete ECRM program as I define it in the book.
What the study found
A study published online in Information Systems Research on 20 April 2026 examined 1,933 U.S. public firms across 16,680 company-year observations from 2006–2018. A company-year is one company’s data for one year. The researchers linked cybersecurity investment disclosures in annual reports with lower costs of debt, equity, and funding overall. The relationship was stronger when statements were more informative and supported by actual cybersecurity investment. [5]
The researchers used several methods to test the relationship. Their findings do not mean that every organization can lower financing costs by increasing its cybersecurity budget or changing its wording. The data predate 2026, and the study does not establish the same result for private organizations. [5]
Understand and explain the importance of ECRM disclosures
I recommend bringing finance leaders, business owners, risk management, cybersecurity, and legal staff together to define what information your organization must provide and what its financing partners need. Consider the ECRM program as a whole: important business risks, management responsibilities, board oversight, and how the organization prepares for disruption.
For an organization with a credit rating, review the criteria and information requests of the agency that rates it. Ask what it needs to understand your cyber risks and their possible financial consequences. Treat rating-agency requests and legal reporting obligations as separate parts of the review.
The SEC’s cybersecurity disclosure rules provide useful background. Companies subject to these rules must describe their cybersecurity risk management, strategy, and governance in annual reports. U.S. domestic reporting companies generally must report a material cybersecurity incident within four business days after determining that it is material, rather than four days after discovering it. Material means important to a reasonable investor’s decision. [6]
These rules apply to companies subject to SEC reporting requirements, not automatically to every privately held business. Private organizations can use these topics as a starting point for financing discussions while confirming which obligations apply. [6]
Examine your current position and close the gaps
Compare the information you currently provide with the requirements and requests you identified. Can you explain who owns important cyber risks, how management makes decisions, what the board oversees, and how a disruption could affect the business? Identify missing information and weaknesses in the underlying ECRM program.
Develop an action plan with an owner for each gap. Some gaps may require clearer reporting; others may require changes to risk management, governance, or recovery practices. Agree how each improvement will be checked and when the information will be updated.
Keep the explanation and the evidence together
Describe the ECRM program as it operates today. Support statements about oversight, risk decisions, and preparedness with records and results. Distinguish work completed from work planned, and explain significant limitations. A spending total alone does not establish that business risks are being managed effectively.
Keep the account consistent across internal risk reports, rating-agency discussions, and any required public disclosures. Finance, risk management, and legal staff should agree what can be shared and how to protect sensitive details.
Judge the benefit from your own results
Ask financing partners whether the information helps them assess your organization. Record their questions and any changes in financing terms. Interest rates, credit quality, and many other factors affect those terms, so a lower rate alone does not show that ECRM caused the improvement.
The study supports a specific relationship involving investment disclosure. It does not prove that all ECRM disclosures lower financing costs or that cybersecurity produces a higher acquisition price. [5]
A practical next step
Review your current ECRM disclosures and financing partners’ information needs with the relevant business leaders. Confirm the requirements that apply, identify the gaps, and agree an action plan. Improve the program and the explanation together.
The evidence is getting stronger. Your own results will help you judge whether managing cyber risks and explaining that work clearly contributes to better access to funding or more favorable terms.
Explore the supporting findings in the ECRM Evidence Hub. For more on putting these ideas into practice, explore the audiobook.
Sources
[1] Chaput, Bob. Enterprise Cyber Risk Management as a Value Creator: Leverage Cybersecurity for Competitive Advantage. Apress, 2024. Chapter 1, pp. 13–16; Chapter 4, pp. 110–113; Chapter 7, pp. 183–189; Appendix D. Explore the book in all formats
[2] S&P Global Ratings. Cyber Risk in a New Era. Research topic page. Read S&P’s credit-risk perspective
[3] Moody’s. Enterprise Cyber Risk Management. See “Credit ratings and research.” Read Moody’s perspective
[4] Fitch Ratings. Cyber Risk. Read Fitch’s perspective
[5] Havakhor, Taha, Mohammad S. Rahman, and Tianjian Zhang. Disclosure of Cybersecurity Investments and the Cost of Capital. Information Systems Research, 37(3), pp. 1782–1804, 2026. Published online 20 April 2026. Read the financing study
[6] U.S. Securities and Exchange Commission. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure. Small Entity Compliance Guide, 30 August 2023. Read the SEC guide