While it's nice to have metrics and nice formulae to show your management or investors, convincing people to take a "sure cost hit" to prevent a loss that "may or may not happen in the foreseeable future" is usually not this trivial.

What are the best ways you've found to illustrate the need for security in your organization?

On the other hand, you need to be vigilant, and not fall for the latest survey with no questions asked. You want to be sure you are comparing apples to apples, as much as possible.