Sometimes it is the management that doesn't understand anything. In their perspective, security doesn't improve the bottom line.

I worked for an SME that dealt with some sensitive customer data. I mentioned to the CEO that we should invest some time in improving our security. I got back that "what's the big deal, if anyone wants to look they can just look..."