In Scott Adam's cartoon Dilbert the Pointy-haired Boss has no name because Scott Adam's wanted his readers to relate the boss character to bosses known to the readers.
This is pointed out because (and unfortunately) many Information Security professionals all-to-often encounter naive attitudes from executive management similar to the ones Dilbert's pointy-haired-boss exhibits - such as:
We've had no cyber-security breaches in the last fiscal last year. Why do you suggest we need to spend more on cyber-security? Since there seems to be no threat, isn't there room to shift funds away from cyber-security?
This logic is like "The bank hasn't been robbed in years, therefore it doesn't need security guards!"
I've found at least 1 strategy works to influence attitudes like this: which is emphasizing the Return-On-Investment (ROI) mitigating risks is always less than that of accepting risk in the first place (i.e. "An ounce of prevention is worth a pound of cure!")
Since it's clear all effective information security strategies starts with executive management "buy-in", what strategies have folks found to be effective in changing some of these naive attitudes held by senior management towards appreciating the true nature of these risk, and in cultivate a corresponding appetite for investing in risk-mitigation?