We are in a bit of a different situation than most companies because we are a service provider. We were already using LEM for customer solutions and we believe in "eating our own dog food" so it made sense for us to get it as well. Besides my company didn't want me using our customer systems as a test bed for new rules and such.
When I pitch the idea to customers I focus on the single pane of glass for not just Infosec but also for operational data telling stories of how problems were quickly identified by having all of your log data in one place and easily searchable. Basic Firewall and AntiVirus are no longer considered adequate in today's Infosec world and a SIEM such as LEM is really the central focal point of a good security solution as it provides IPS, IDS, and audit capabilities to the environment.
Hope this helps!