I don't think that budget is the problem. You can be very safe without a big budget. It's a lack of priority and management valuing quick development over security.