ECRM as a Value Creator — The Evidence Is Getting Stronger

Stronger ability to attract and retain customers who care about cybersecurity

The study examined 1,573 public and private firms using a random stratified sample. Greater cybersecurity maturity was associated with stronger cyber resilience and the ability to attract and retain cybersecurity-sensitive customers.

The study concerns specific firms, measures, and a regional setting. Its customer findings are not audited sales growth or a measured retention uplift applicable worldwide. No numerical sales or retention effect is presented here.

ECRM can help sales leaders and business owners identify which cybersecurity commitments matter to their customers. Track buying and renewal decisions to judge the benefit in your own organization.

Standaert, Thomas, Tom Evens, and Petra Andries. Cybersecurity maturity of Flemish firms: drivers and consequences. Computers & Security, 165, 104868, 2026.

Ghent University Bibliography. Publication record for the same article, confirming authors and bibliographic details.

View the university record

$10–$30 million enterprise deal reported by Picarro.

The case links a European enterprise deal to ISO 27001 certification and a SOC 2 Type 2 report. These give customers independent evidence about security practices. Picarro reports the deal value shown above.

The reported amount is contract value, not annual revenue, profit, or return on ECRM spending. The financial outcome and its attribution come from Picarro and have not been independently verified. SOC 2 is a report, not a certification.

ECRM can help leaders identify the security requirements that affect customer buying decisions and decide how to meet them.

Constellation Research. Picarro, Inc. 2026 SuperNova Awards case, Digital Safety, Governance, Privacy, and Cybersecurity finalist. See “The results,” “Metrics,” and “Shining Moment.”

50% shorter request-to-production time reported by Carrefour

For teams that release software regularly, including e-commerce, the time from a business request to software going live was cut in half. Releases moved from monthly to daily. The case also reports about 25% fewer production incidents and more than $350,000 in annual security-tooling savings.

The changes included tool consolidation, automation, and new processes as well as security. Do not attribute every improvement to cybersecurity alone, generalize the time improvement to every Carrefour team, or treat release frequency as a revenue measure.

ECRM can bring risk decisions into software projects early, helping business owners pursue innovation while managing the associated risks.

GitLab. How Carrefour Cut Time to Market in Half with GitLab. Undated customer case. See “Turning software improvements into retail-ready results.”

13% lower likelihood of a material cyber event among organizations running regular exercises

Marsh compared organizations’ cybersecurity self-assessments with insurance claims. Organizations regularly conducting tabletop exercises and scenario-based breach-response drills were less likely to experience a material cyber event than those that did not. A tabletop exercise is a guided discussion of a simulated incident.

The 13% is a relative difference between groups, not 13 percentage points, 13% smaller losses, or guaranteed insurance savings. Other practices and organizational differences may matter. The public release does not provide the full methods or a complete definition of a material cyber event. The full report requires a form submission.

ECRM can connect exercises to important business services, clear decision responsibilities, and improvements that help the organization prepare for disruption.

Marsh McLennan. Cyber Risk Intelligence Center report. Public release summarizing Cybersecurity signals: Connecting controls and incident outcomes. 27 August 2025.

Lower debt, equity, and overall capital costs associated with investment disclosure

The researchers examined 1,933 public firms and 16,680 company-year observations from 2006–2018. A company-year is one company’s data for one year. The relationship was stronger when disclosures were more informative and backed by actual cybersecurity investment.

The study evaluates investment disclosures, not a complete ECRM program or a universal spending-to-return relationship. It uses several methods to test the relationship, but is not a randomized experiment. The observations predate 2026 and do not establish the same result for private organizations or a higher acquisition price.

ECRM can help leaders explain their risk management and preparedness with evidence that financing partners can assess. Review the information those partners need and support statements with actual practices and results.

Havakhor, Taha, Mohammad S. Rahman, and Tianjian Zhang. Disclosure of Cybersecurity Investments and the Cost of Capital. Information Systems Research, 37(3), pp. 1782–1804, 2026. Published online 20 April 2026.

Required CMMC status is a condition of award eligibility for covered opportunities

CMMC means Cybersecurity Maturity Model Certification. DFARS 204.7502 says contracting officers must specify the required level in the solicitation and cannot award to an offeror lacking the required current status. As of 13 October 2026, official guidance states that Phase II implementation is suspended and Phase I self-assessment requirements remain in place.

Apply this example only to covered opportunities and the requirements in the solicitation. Eligibility is not an award or evidence of revenue growth. Do not imply universal third-party certification or present the former November 2026 Phase II transition as an active deadline. The program remains under review.

ECRM can help leaders identify cybersecurity conditions that affect market access and prioritize work needed to qualify for business.

Acquisition.gov. DFARS 204.7502, Policy, paragraph (a), Award eligibility.

Department of War Chief Information Officer. About CMMC. Current implementation and assessment guidance. Checked 13 October 2026.

Read current CMMC guidance