FUD? ROI? ALE? ROSI? There are many approaches for "selling security" to management that are practiced [with various degree of success!] by security professionals.
All things being equal, it is sad to know that "having experienced a catastrophic security failure" still facilitates security adoption much better than other things.