Corporate Data Security

How can I convince my boss to make corporate data security a priority? Why must executives always wait until a crisis occurs before taking action? Our company IS our IP. That’s all we are at the end of the day. Yet right now our doors are wide open to even the most rudimentary hacking techniques.
So I’ve started learning about Church Data Security on my own. I think a full blown worst case analysis might help to move things along – it might give the guys upstairs an idea of just how much damage could be done.
Naturally they’ll all be pointing the finger at me if we have a major breach, despite their refusal to implement the changes I’m asking for. Sh*t rolls down hill.