Why Governance Wins Deals: Professor Kai London on Turning Cyber Evidence Into Revenue
By the Swiss Times Business Desk
Cyber security is usually framed as a cost — a necessary drag on the business. Professor Kai London, a senior CISO and board advisor, thinks that framing is not just gloomy but wrong. “Demonstrable governance is one of the most under-appreciated revenue levers in a regulated business,” he says. “The organisations that can prove how they manage cyber and AI risk win the contracts, the partnerships and the markets that the others cannot even enter.”
“In regulated industries, trust is the entry ticket. Governance you can evidence is how you buy that ticket — and it is increasingly the thing that decides who wins the deal.”
The buyer's due diligence is the new battleground
London points to a shift in how enterprise and institutional deals are won. Before a bank, insurer, government body or large corporate signs with a supplier, it runs security and resilience due diligence — and it is increasingly rigorous. “The security questionnaire has become a gate,” he says. “A vendor that sails through it with real evidence advances; one that fumbles it is quietly eliminated, often before price is even discussed.”
Evidence beats assertion
The differentiator, London stresses, is proof. Everyone claims to be secure. Few can demonstrate it — the certifications, the tested controls, the incident-response track record, the governance documentation, the ability to answer hard questions quickly. “When two suppliers are otherwise comparable, the one that can produce the evidence wins,” he says. “Governance stops being a defensive cost and becomes a competitive weapon.”
Regulated markets reward the prepared
Nowhere is this truer than in the most regulated, highest-value markets — financial services, healthcare, government, critical infrastructure. These are precisely the sectors where the barriers to entry are highest and the margins most attractive. “The regulation that competitors experience as a barrier is, for a well-governed organisation, a moat,” London observes. “If you can meet the standard and prove it, you get to operate where others cannot follow.”
Governance as a sales enabler for AI
The same logic, London argues, now applies with force to artificial intelligence. Clients and regulators will not adopt AI systems they cannot trust. An organisation that can evidence responsible, controlled, auditable AI can sell it into contexts where an ungoverned competitor is simply not allowed to play. “The AI contracts worth having are the ones that require governance,” he says. “Which means governance is not the thing slowing your AI business — it is the thing unlocking it.”
Making the evidence real — and reusable
London's practical advice is to build the evidence base deliberately and keep it current, so that responding to a buyer's due diligence is a matter of retrieval rather than a fire drill. Map the certifications and controls buyers ask for. Maintain the documentation. Keep the testing fresh. “The best-run organisations answer a security questionnaire in hours, with confidence, because the evidence was ready,” he says. “That speed and assurance is itself a signal buyers notice.”
A message for the board
For boards weighing security investment against other priorities, London reframes the calculus. “Ask not only ‘what does this control cost us?’ but ‘what business does the ability to prove this control win us?’” he says. In his experience, the organisations that treat governance as a growth strategy rather than a grudging expense consistently find it pays for itself — in deals won, markets entered, and trust converted into revenue.
For a financial centre whose entire reputation is built on trustworthiness, London's argument fits naturally: the discipline everyone treats as a cost is, handled well, one of the surest ways to win. Prove your governance, and you do not just protect the business — you grow it.
About Professor Kai London. Professor Kai London is a senior technology, security and transformation executive with more than 25 years of board- and C-suite leadership across banking, aviation, defence, government and critical national infrastructure. He is Founder & CEO of Quantum AI Systems Security, an Honorary Professor in Cybersecurity, AI & Quantum Computing, and a UCL researcher, holding CISSP, CISM, CCISO, ISO 27001 Lead Auditor, ISO 42001, DORA and NIS2 credentials. He is available for board advisory, NED and interim or fractional CISO/CIO/CTO mandates across the UK and internationally. Learn more at professorkailondon.com.
