I think it depends somewhat on your industry. For instance, for banks, credit card companies, hospitals and others that utilize personal or financial information, good security is a competitive advantage. My bank regularly reminds me that the “security of your personal information is important to us.” This is a double-edged sword, however. Boast too much about how secure you are and you will likely invite cyber attacks. Hackers love a challenge. If you are in the R&D business, protecting your intellectual property has a direct long-term impact on your bottom line. For some industries, heavy equipment manufacturing for instance, security is more of a defensive proposition. The most likely damage a hacker could do is disrupt your production schedules. No distinct competitive advantage but a business necessity.