Bob Chaput Author Blog
Enabling Board Cyber Risk Oversight
How cybersecurity data can support healthcare operating performance
Introduction St. Luke’s used connected-device visibility to strengthen security and improve decisions about medical-device utilization and...
How ECRM can support lower financing costs
Introduction Research links informative cybersecurity investment disclosures with lower financing costs. Examine what the findings support, their...
How boards can assess the business value of ECRM
Introduction How can directors judge whether ECRM contributes to business value? Bring the emerging evidence into board discussions with questions...
How ECRM can strengthen business resilience
Introduction Marsh’s claims-linked research associates regular response exercises with fewer material cyber events. Explore how ECRM can connect...
How ECRM can support faster software delivery
Introduction Carrefour reports faster software delivery after bringing development, security, and operations together. Its experience illustrates...
How ECRM can help earn customer business
Introduction Customer security requirements can influence buying and renewal decisions. Explore what Picarro’s reported experience and a study of...
ECRM as a Value Creator: Is the Evidence Catching Up?
A growing body of academic and commercial research is asking a different question about cybersecurity. When I published Enterprise Cyber Risk...
The Common Architecture of Every Credible Risk Assessment
Why Cyber Risk Governance Depends Less on Choosing the “Right” Methodology—and More on the Quality of the Assessment It Produces Introduction...
Boards Oversee Risk. Management Owns the Decision.
Cybersecurity failures are often described as technology failures. Sometimes they are. A missing patch mattered. A compromised credential mattered....
Methodology Matters: Why Defensible Risk Assessment Is More Than a Compliance Checkbox
What’s the Problem? Many organizations still treat risk assessment as a compliance task. A rule requires it. An auditor asks for it. A customer...









