My specific instance was that I was the application security champion for a critical application application that had a SQL injection vulnerability (with full schema owner privileges!), but lower-level management wasn't making it a priority and didn't even assign any resources to remediate the issue. So I went to explain the issue to the department head because he was the owner of the application. As an ASC I answer to, and represent, the security division so I can talk to the owners of apps that I support regardless of the hierarchy. I think he didn't understand that dynamic, as I typically see managers breaking company policy and not caring (I'm smart enough to keep my mouth shut on those issues). I didn't go to complain. I went to explain the problem and give him options and my recommendation.

He told me that we have a real-time backup system so he didn't think it was worth fixing. I then asked if we ever ran tests of that system and if we had documentation on how to restore from it. We don't. This is for financial trading application handling billions of dollars. Being down for even a few hours could be catastrophic.

The big man spoke. I don't agree with the outcome, but I'm not the boss. So that was the end of it (except for in discussions like this on here). I left for another team because there's no way I'm going to be the security champion for a system with that level of risk. And thank God you weren't my manager or I would have been fired under your #2 scenario.

On a side note, just because a small number of people are complaining doesn't mean their opinions are invalid. Minorities are often disenfranchised due to this thinking. Also, managers may not know all the policies for the company and may be violating them.

For a real life example combining these, company policy states that a person be evaluated against the standard and recieve a rating that way. Some departments mandate that if a manager pick a higher than average rating for someone, then they must pick someone else to balance it out with a lower rating. This would only affect 10% of the population and the number unjustly affected would be lower than that. So the other 90% recieved good rating, so why would they complain? The objective way I know that I was unjustly rated was because I had a manager friend who told me what happened in the meeting and said it was wrong.