A note on terms
Enterprise cyber risk management (ECRM) is how an organization manages cyber risks and opportunities that affect its business goals. An ECRM program puts that work into practice. Cybersecurity concerns the protection of data, systems, and devices. These terms are related, but they are not interchangeable. I explain the distinctions in Chapter 4 and Appendix D of my book. [1]
A board needs to understand how cyber risks could affect the business. What’s new? It also needs to ask how ECRM can help the organization achieve its goals. Can it drive growth, support customer relationships, enable innovation, or help important services continue through disruption? What evidence supports those expectations?
Since publishing Enterprise Cyber Risk Management as a Value Creator: Leverage Cybersecurity for Competitive Advantage in 2024, I have returned to the evidence to test whether a strong, proactive ECRM program and cybersecurity strategy can help create business value. The findings give directors specific opportunities to examine with management. [1]
What the book says
Chapter 6 explains the C-suite’s leadership role and the board’s oversight role. I recommend establishing clear ECRM guiding principles, requiring a documented program and strategy, and giving positive cyber opportunities attention alongside potential exposures. Chapter 7 connects ECRM with business strategy, financial planning, and business ownership. [1]
For directors, that means asking whether the ECRM program supports the organization’s priorities and whether management is accountable for the results. Management remains responsible for carrying out the work. The board should ask informed questions and oversee progress. [1]
What the evidence helps directors examine
Customer and market value: Picarro reports that security assurance helped close a European enterprise deal worth $10–$30 million. This is company-reported contract value; it is not a measure of profit and has not been independently verified here. A separate study of firms in Flanders, Belgium, links cybersecurity maturity with attracting and retaining customers who care about cybersecurity. [2, 3]
Innovation value: Carrefour reports faster software delivery within a broader change in how development, security, and operations teams work together. Its vendor-published case does not isolate cybersecurity’s contribution from the other changes. [4]
Resilience value: Marsh links regular incident response exercises with a lower likelihood of a material cyber event. Its comparison does not prove that exercises alone caused the difference. [5]
Capital and transaction value: The financing study links cybersecurity investment disclosures with lower capital costs. It does not establish a higher acquisition price or prove that every ECRM disclosure produces a financing benefit. [6]
These findings concern different outcomes. They do not add up to a percentage increase in enterprise value. Their usefulness to a board is in identifying business opportunities worth examining and the evidence needed to judge them.
Connect ECRM to a business goal
I recommend starting with one strategic initiative. Ask management which cyber risks could affect its success and which ECRM capabilities could help it proceed. Discuss the opportunity, the possible losses, and the level of risk the organization is prepared to accept.
For example, a new customer service may create a sales opportunity while adding responsibilities for safeguarding customer data and assuring reliable delivery. Ask the business owner how those responsibilities are being addressed, what remains unresolved, and what evidence supports proceeding. Further, ask how current cybersecurity capabilities can enable delivery of the new service. This keeps the discussion connected to the business decision.
Ask who owns the result and how it will be measured
The business owner should explain the expected benefit, with input from risk management and cybersecurity staff. A sales leader can judge whether customer requirements affect buying decisions. An operations leader can judge whether recovery arrangements meet service needs. The board should expect these leaders to be involved.
Ask where the organization stands today, what should improve, and how management will assess the result. A tool installed or an assessment completed shows activity. Meeting a customer requirement, reducing a delivery delay, or closing a recovery gap provides different information about business progress.
Keep the measures honest. When several changes happen together, management may not be able to isolate ECRM’s contribution. One improvement may also appear in several reports. Ask how overlapping benefits are handled so the same result is not counted twice.
Consider the people who depend on the organization
Enterprise and stakeholder value also concerns the organization’s ability to meet commitments to customers, employees, business partners, and investors. Ask which commitments depend on managing cyber risks well and what information each group needs to make its decisions.
The explanation should match what the organization can demonstrate. If important gaps remain, management should identify them and describe the action being taken. Clear ownership and credible reporting give the board a better basis for oversight than broad assurances about being secure.
A practical next step
At the next board discussion, ask management to connect one strategic initiative with its cyber risks, opportunities to use ECRM strengths, the business owner, and measures of success. Agree what progress should be reported and when the board will revisit it.
The evidence is getting stronger. Directors can use it to ask better questions about how ECRM protects value, helps create it, and supports the people who rely on the organization.
Explore the supporting findings in the ECRM Evidence Hub. For more on putting these ideas into practice, explore the audiobook.
Sources
[1] Chaput, Bob. Enterprise Cyber Risk Management as a Value Creator: Leverage Cybersecurity for Competitive Advantage. Apress, 2024. Chapter 4, pp. 110–113; Chapter 6, pp. 161–167; Chapter 7, pp. 184–190; Appendix D. Explore the book in all formats
[2] Constellation Research. Picarro, Inc. 2026 SuperNova Awards case. Company-reported commercial outcome. Read the Picarro case
[3] Standaert, Thomas, Tom Evens, and Petra Andries. Cybersecurity maturity of Flemish firms: drivers and consequences. Computers & Security, 165, 104868, 2026. Read the customer study • Ghent University publication record
[4] GitLab. How Carrefour Cut Time to Market in Half with GitLab. Undated vendor-published customer case. Read the Carrefour case
[5] Marsh McLennan. Cyber Risk Intelligence Center report. Public release summarizing Cybersecurity signals: Connecting controls and incident outcomes. 27 August 2025. Read the Marsh release
[6] Havakhor, Taha, Mohammad S. Rahman, and Tianjian Zhang. Disclosure of Cybersecurity Investments and the Cost of Capital. Information Systems Research, 37(3), pp. 1782–1804, 2026. Published online 20 April 2026. Read the financing study