California

Management rarely sells the concept of computer security to themselves. One company I looked into considered security patches to be the same as any other changes "If it isn't broke, don't fix it". My answer: "It is broke. You just haven't fallen through the hoe yet but you will".

They don't sell security to their employees as being a danger to the company as well as their jobs. Of course, it is difficult to sell concern for your company when your company treats you like dirt. It's difficult to be concerned about your job when at any moment, the CEO gets a big raise and they announce layoffs or move the jobs to China or India or even cut your benefits "to save money".

As to IT or security support, "They're overhead. We'll just outsource that to the company of the boss' friend. We won't know what's going on, will have nobody who really knows our systems and needs but we'll save money!"