@ ascorbic
I recently urged those in charge of the IT arm of our organization to get an IDS/IPS (intrusion detection/prevention) device into place. With the recession and budgets getting tighter, it's really hard to convince those in charge of the budget, to see (like Vako referenced) the how the total cost of ownership is in their favor, if the cost of the mitigating the risk is less than the risk itself. A perfect example I recently gave, was demonstrating how an employee on our network could run a packet sniffer and capture unencrypted data without any alarms being triggered. Once my manager and our Director saw that, it sent up a red-flag for them and it became a no-brainer. ^_^