Introduction
St. Luke’s used connected-device visibility to strengthen security and improve decisions about medical-device utilization and operations. The case illustrates how cyber data can become useful business data while leaving important limits on financial attribution.
A note on terms
Enterprise cyber risk management (ECRM) is how an organization manages cyber risks and opportunities that affect its business goals. An ECRM program puts that work into practice. Cybersecurity concerns the protection of data, systems, and devices. These terms are related, but they are not interchangeable. I explain the distinctions in Chapter 4 and Appendix D of my book. [1]
The Business Challenge
Hospitals depend on thousands of connected medical devices. Security teams need to know what those devices are, where they are, how they are connected, and whether they are exposed to threats. Operations teams need much of the same information for a different reason: they have to keep equipment available, maintained, scheduled, and used effectively.
That overlap creates an interesting ECRM question. When a cybersecurity capability produces better information about critical assets, can that information also improve business and operating decisions?
What the book says
In Enterprise Cyber Risk Management as a Value Creator, I argue that leaders should examine both the downside risks and the positive business opportunities associated with cyber risk management decisions. The business owner remains accountable for the business objective and owns the risk-management decision, working alongside the risk analysis team. [1]
That means the value question is not simply whether a security tool found more devices or vulnerabilities. It is whether the resulting capability helped the organization make a better decision about an objective that matters to the business.
What St. Luke’s and Cylera report
A 2024 Cylera case study describes St. Luke’s University Health Network managing connected medical devices across 300 sites, 12 hospitals, and 10 counties. The health system wanted better security visibility, but it also had an operational problem: without reliable usage data, device and consumables purchasing could be inefficient and revenue opportunities could be lost. [2]
Cylera reports that the platform gave St. Luke’s real-time device and usage intelligence. The case says those insights influenced asset location, scheduling and access, maintenance and remediation, purchasing efficiency, consumables availability, and the use of previously under-utilized devices. The case explicitly reports generating additional revenue from those under-utilized devices, although it does not provide an amount. [2]
The CISO describes the capability in terms of business priorities and revenue goals. That is useful because the business connection comes from the named customer, not merely from an outside interpretation of the security data. [2]
What the case does not establish
The evidence has important limits. This is a vendor-published customer case study, not an independent empirical evaluation. It does not disclose revenue amounts, before-and-after utilization rates, time savings, investment cost, or return on investment. It also combines security visibility with asset intelligence and operational management, so it can’t isolate the contribution of cybersecurity. [2]
Those limits are precisely why the case should be used as an example of a value pathway, not as proof that every medical-device security investment will increase revenue.
How leaders can apply the lesson
The practical lesson is to look for information created by the cyber program that may also improve another business decision. For connected assets, useful questions include: Do we know what we own? Where is it? Is it being used? Is it available when the business needs it? Are we maintaining or replacing assets based on reliable information? Could better visibility reduce unnecessary purchases or free up underused capacity?
The cyber team can help produce the evidence. The business owner should decide which business outcome matters, which measures indicate improvement, and whether the result justifies the investment.
The broader ECRM implication
Cybersecurity data does not become business value merely because it exists. Value depends on how leaders use the information and whether it changes a decision or outcome that matters.
The St. Luke’s case is compelling because it illustrates that connection. A capability built to understand and secure connected medical devices also became a source of operating intelligence. That is the kind of crossover worth looking for when assessing ECRM as a potential value creator.
Explore the supporting findings in the ECRM Evidence Hub. For more on putting these ideas into practice, explore the audiobook.
Sources
[1] Chaput, B. (2024). Enterprise Cyber Risk Management as a Value Creator: Leverage Cybersecurity for Competitive Advantage. Apress. https://link.springer.com/book/10.1007/979-8-8688-0094-8
[2] Cylera. (2024). Innovative, Operationally Efficient Healthcare IoT Security: St. Luke’s University Health Network case study. https://cylera.com/resources/st-lukes-university-health-network/download/