The most common reasons for resistance are: you have insider knowledge that makes it easier to find/exploit bugs and that we're not a big enough target for peop

The most common reasons for resistance are: you have insider knowledge that makes it easier to find/exploit bugs and that we're not a big enough target for people to explicitly hack us. And they're not necessarily wrong either. Despite the paranoia about children's information, it's not actually worth very much, so why bother to steal it? If you do anything that has grades, you may find that students are motivated to hack you, but otherwise there are probably not a whole lot of people who will target you. If the issues are so brazen that automated tools like sqlmap will hack you, then that's probably a good thing to show. Even if you manage to convince people that security is truly lacking, security needs to be painless rather than something everyone buys into and is constantly vigilant about, so try to advocate for solutions that can handle security for you automatically, eg libraries, etc. But for most orgs, you're really not likely to get hacked through your webapp (unless it is truly atrocious), but rather someone in your org accidentally installing ransomware and encrypting your shared files.