the real issue on this is you don't know what you don't know. the IT directors/management may even have a security dept which is doing "work", but doesnt have talented enough folks who recognize the real risk and address it. Im sure some project manager in the department has been producing vulnerability reports and defects closed to management, demonstrating how secure they are.