I work for a small company with a couple of directors and several staff who all report directly to them. I'm the senior PHP developer here and over the last few years have built a content management system and I have just finished developing an e-commerce platform that we now sell.
Throughout my time here I've always had to fight for security to be given its due concern. For example, we have a test VPS server that was running MySQL v5.1, no longer supported and when cPanel stopped patching the server due to the MySQL version being out of date my bosses seemed completely unconcerned and were more concerned with the down time to update the server where people wouldn't be able to work. In the end I had to upgrade the server in my own time to make sure it got done.
There have been regular things like this where things that are important in my eyes just get glossed over by my bosses. It seems like the only thing that will make them sit up and take security seriously is a breach that affects our clients, and I'm just waiting for that day to happen when I'm going to have to clean up the mess.
How can I impress upon my bosses the importance of security? Or am I just being paranoid here?
I don't think this is a duplicate of Convince the Company I Work for to Implement Version Control? because the answers to that questions are about understanding why a process is there in the first place, and then figuring out how to change them. With my question there is no process there in the first place, and it's more about changing attitudes than processes. It's similar and there will probably be some crossover in answers, but I don't think it's the same.