ECRM as a Value Creator: Is the Evidence Catching Up?

by Bob Chaput | Oct 3, 2026

A growing body of academic and commercial research is asking a different question about cybersecurity.

When I published Enterprise Cyber Risk Management as a Value Creator in 2024, I made a basic proposition: a strong, proactive Enterprise Cyber Risk Management (ECRM) program and cybersecurity strategy can do more than protect the organization from loss. Under the right circumstances, they can help create business value.

“I am not ready to say the proposition is proven. But I am increasingly convinced that it is being taken seriously enough to measure.”

That proposition was never meant to suggest that every cybersecurity investment produces a return, that every control creates revenue, or that more spending is automatically better. My argument was—and remains—that cybersecurity can become an enterprise capability when it aligns with business objectives, is well governed, and enables outcomes the organization values.

Part of that argument came from watching information technology mature over my career. In their seminal 1985 Harvard Business Review article, “How Information Gives You Competitive Advantage,” Michael Porter and Victor Millar described how information technology was changing industry structure, creating new ways to outperform competitors, and enabling entirely new businesses. I wondered whether cybersecurity might follow a similar path—from a largely protective function to an enterprise capability that, when governed and applied well, can contribute to competitive advantage and business value. I believed that was possible in 2024. The evidence emerging since then makes the question even more interesting.

Recently, I went back to the evidence to ask a simple question: Is that proposition holding up?

What caught my attention was not one study or one company example. It was the growing amount of academic and commercial work examining cybersecurity in business terms—customers, innovation, financing, productivity, resilience, market access, and enterprise value.

First, Is There Really More Research?

The answer appears to be yes—with an important qualification. The measurable increase is clearest for the broader intersection of cybersecurity and business, not yet for the narrower proposition that cybersecurity creates business value.

A 2025 bibliometric review by Luciano Barcellos-Paula, Anna M. Gil-Lafuente, and José M. Merigó analyzed 410 Web of Science articles published from 2004 through 2023 at the intersection of cybersecurity and business. The authors reported an annual publication growth rate of 27.63 percent. Read the study.

A separate 2025 scientometric study examined 129 peer-reviewed Scopus articles in business, management, and accounting from 2012 through 2022 and likewise found substantial growth in the field. Read the study.

And a 2026 systematic review by Chelsea Liu and Muhammad Ali Babar synthesized 203 empirical studies across 12 disciplines. Their review documents a steady increase in empirical corporate cybersecurity research over time. Read the systematic review.

Those findings matter because they establish something more than an impression: cybersecurity is increasingly being studied as a business and management issue. They do not, by themselves, prove the value-creation proposition. For that, we have to look at what researchers are actually measuring.

The Questions Are Changing

For years, much of the business literature around cybersecurity understandably focused on downside: the cost of data breaches, losses, stock-price reactions, regulatory exposure, operational disruption, and reputation damage. Those questions remain important.

What seems to be changing is the range of outcomes under study. Researchers are increasingly asking whether cybersecurity governance, maturity, disclosure, and management practices are associated with positive or economically useful outcomes.

Financial performance

A 2022 study in Computers in Industry examined 143 U.S.-listed companies and found that ISO/IEC 27001 certification was associated with improvements in profitability, labor productivity, and, in part, sales performance. The authors explicitly framed the study around “information security and value creation.” Read the source.

Competitive advantage

A 2020 Journal of Business Strategy study asked whether cybersecurity investment could produce competitive outcomes. Based on a literature review and interviews with executives and security professionals, the authors developed a model describing how cybersecurity capabilities can contribute to long-term competitive advantage. Read the source.

Market value and innovation

More recent research has pushed the question further. A 2025 Pacific-Basin Finance Journal study examined cybersecurity governance and corporate market value through investor and supply-chain trust. Read the market-value study. Another 2025 Finance Research Letters study found cybersecurity governance associated with corporate innovation in Chinese listed firms. Read the innovation study.

Cost of capital

In 2026, Information Systems Research published a study examining cybersecurity-investment disclosure and the cost of capital. Using 1,933 public firms and 16,680 firm-year observations, the authors found that substantive cybersecurity-investment disclosures were associated with lower costs of debt, equity, and overall capital. Read the source.

Customers

Also in 2026, Computers & Security published research on 1,573 firms in Flanders, Belgium. The study examined cybersecurity maturity not only in terms of resilience, but also in the ability to attract and retain cybersecurity-sensitive customers. Read the source.

Working capital and supply chains

A 2026 Journal of Accounting and Public Policy study used China’s 2017 Cybersecurity Law as a quasi-natural experiment and found improved access to trade credit, with cybersecurity practices, operational stability, and information transparency identified as important channels. That moves the discussion into a very practical business issue: supplier financing. Read the source.

Commercial Research Is Moving in the Same Direction

The academic evidence matters to me because it gives us something beyond anecdotes and marketing claims. But the commercial research is moving in a similar direction.

EY’s 2025 Global Cybersecurity Leadership Insights Study is unusually explicit. Based on a survey of 550 C-suite and cybersecurity leaders across 16 sectors and 19 countries, EY examined cybersecurity’s contribution to strategic initiatives such as technology adoption, innovation, customer experience, market expansion, and new products and services. EY framed the shift directly: from value protection to value creation. Read the EY research.

Commercial studies require their own caution. They are often survey-based, may use proprietary models, and should not be treated as equivalent to peer-reviewed causal research. But they matter for a different reason: they show that executives, advisors, insurers, analysts, and companies are increasingly trying to measure cybersecurity in business terms.

What This Does — and Does Not — Tell Us

I do not think the evidence lets us say the central proposition of my book has been universally proven. The studies vary widely in geography, industry, research design, variables, and strength of inference. Association is not causation. Certification is not strategy. Disclosure is not performance. And a cybersecurity program disconnected from business objectives can still waste substantial amounts of money.

There is also evidence that challenges—and disciplines—the value-creation argument. Some research shows, for example, that cyber risk can contribute to inefficient overinvestment. That is exactly why I continue to believe ECRM matters: the objective is not to spend more. It is to make better, defensible enterprise risk decisions enabled by a robust ECRM program.

What I do think we can say is this: a measurable body of business-oriented cybersecurity research has emerged and grown, and the questions are becoming more economically concrete. Researchers are no longer studying only what happens when cybersecurity fails. They are increasingly examining how cybersecurity governance and capability relate to the way organizations compete, innovate, finance themselves, serve customers, manage supply chains, and execute strategy.

So, Is There Something to It?

I started this review wanting to see whether the basic proposition I advanced in 2024 was holding up. I did not want to look only for evidence that agreed with me. If the evidence pointed somewhere else, that would be worth knowing too.

My conclusion, at least for now, is deliberately modest.

I am not ready to say the proposition is proven. But I am increasingly convinced that it is being taken seriously enough to measure.

That matters. The more researchers test cybersecurity against observable business outcomes—and the more carefully we distinguish association, causation, value created, and value protected—the better the ECRM conversation becomes.

Over the coming weeks, I plan to share some of the individual studies and real-world cases that caught my attention. Some provide strong support for parts of the value-creation proposition. Others qualify it. A few challenge comfortable assumptions.

All of them help move the discussion beyond the old question, “How much cyber risk can we avoid?” toward a more useful enterprise question: “What business outcomes can better cyber risk management help us achieve—and can we defend the connection?”

Sources Mentioned

#ECRM #CyberRiskManagement #RiskManagement #BoardOfDirectors #ValueCreation

Back to all Articles