There’s a line in Titanic that any IT or security professional can relate to. The ship’s architect explains that he wanted to include enough lifeboats for all the passengers, “but it was felt the deck would look too cluttered.”

That decision takes on a tragic significance in the second half of Titanic, and yet it’s a choice that’s replicated (although with less dire consequences) in companies to this day. It’s a constant challenge to get leadership to invest in breach prevention–many leaders would prefer to pay for cybersecurity insurance and hope for the best.

Yet, just as the famous shipwrecks of old inspired today’s laws about lifeboats, there are signs that the endless parade of data breaches is forcing greater investment in vulnerability management. (To be clear, we’re talking about “vulnerability management” in the broadest sense; not just patch management.)

In the past few years, NIST, the SEC, ISO, and PCI DSS have all published updated guidelines that mandate more proactive vulnerability management. Many of those guidelines specifically call out the role of leadership, such as the SEC, which now requires companies to report on how their managers and board of directors deal with vulnerabilities.

This is good news for IT and security teams; in a 2023 survey, 50% of respondents said that their organization’s vulnerability management program had support from leadership to “a large/great extent.” But obviously, that still leaves 50% of respondents out in the cold.

If you’re trying to get buy-in at your own organization, come equipped with the facts about the risks you’re facing, and come with a clear plan to remediate them. Thankfully there are plenty of resources available to help prioritize your needs. And if you’re still not getting through, you’re welcome to borrow the Titanic analogy.

To learn more about how vulnerability management is changing, read the full blog post.