It seems weird that CIO type decisions would ever roll up to the Marketing VP. Having worked on a company that sold multifactor auth software in the mid 2000's

It seems weird that CIO type decisions would ever roll up to the Marketing VP. Having worked on a company that sold multifactor auth software in the mid 2000's, I can tell you most companies won't pay for software until there is a breach. This is not unlike home owners installing alarms until after a breakin has occured in the neighborhood.