My one and only foolproof strategy to getting a bureaucracy to take security seriously: wait for a giant breach and tell them "I told you so." If you've got a remediation plan on hand and ready to fire, that's your chance to get funding.