[chewmieser]

The OP called out "negligence," which would leave some wiggle room for the executive in your scenario. Promoting and spending directly on security would be proof that you're at least making a conscientious effort.